dotnet-nuget-dependency-mining

Read-only mining codemod that inventories NuGet dependencies and classifies .NET 8 migration risk. Parses PackageReference, packages.config, GAC, and HintPath references. No files are written to the target repo.

Registry: private. Use the public dotnet-migration-assessment-bundle to run all miners in one workflow.

What it does

1. Parses PackageReference, packages.config, GAC, and HintPath references in project files
2. Classifies each package against a .NET 8 compatibility knowledge base
3. Emits risk tier, target version, and migration notes per dependency

Metrics

Risk tiers

• supported — known-compatible on .NET 8
• requires-upgrade — needs a newer package version
• deprecated — consider replacing (e.g. log4net → Serilog)
• unsupported — requires a different library or rewrite (e.g. EF6 → EF Core)
• custom-binary / gac — HintPath or GAC references needing manual review

Run

Via bundle (recommended):

bash
Copy
npx codemod@latest workflow run -w codemods/dotnet-migration-assessment/dotnet-migration-assessment-bundle \
  -t /path/to/dotnet/repo \
  --allow-dirty --no-interactive

Standalone (local monorepo):

bash
Copy
npx codemod@latest workflow run -w codemods/dotnet-migration-assessment/dotnet-nuget-dependency-mining \
  -t /path/to/dotnet/repo \
  --allow-dirty --no-interactive

Testing

bash
Copy
npm test