Nuget packages are automatically changed to range version with CPM

[viveknuna]

I am using central package management CPM in my .net project. I have defined the package like this <PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.3.0" /> in the directory.packages.props. But If I update any other nuget package in my solution using nuget package manager. it is also updating the other packages declaration as well, like it has changed to the below format. I am not understanding why is it changing other packages in this format [2.3.0 , ). Is there any benefit of it? Is there a way to tell not do to this conversion?

<PackageVersion Include="Microsoft.AspNetCore.Http" Version="[2.3.0 , )" />

I am raising this because this can also break the changes, if it consider a higher version than this and if there are some breaking changes with the newer version. It should'nt change it, as I have used the pinned version originally.

Its also causing issue with my dependabot, as dependabot has issues if we give the pacage in the range, it doesnt work as expected. There is also issue reported dependabot/dependabot-core#5204, but that is different story.

[joelverhagen]

The NuGet/NuGetGallery repository is related to NuGet.org, the package registry. This issue will better fit in NuGet/Home where we track issues for NuGet Client software. I will move it.

[dotnet-policy-service]

Issue is missing Type label, remember to add a Type label

[donnie-msft]

Hi @viveknuna, I'll discuss with our CPM expert. In the meantime, could you please share the VS Version (Help -> About menu will let you copy/paste)? There was a point when CPM was introduced where VS had not yet been updated to take it into account. For example, in VS 2026 18.0.1, I wasn't able to reproduce this and it'd be helpful to know which version you're using. Thank you!