Pinned Dependency Package Gets Upgraded and Un-Pinned When Dependent Package is Upgraded
- Dominant language
- C#
- Stars
- 11.5k
- Forks
- 960
- PR merge metrics
- No merged PRs in 30d
Description
### What You Are Seeing?
When upgrading a package that contains a dependent package that is pinned. Both the main package and its pinned dependency package get upgraded and the dependency package looses its pin.
### What is Expected?
The upgrade operation should stop when it loads the dependency and finds that it is pinned. Then outputting unable to upgrade the package specified in the upgrade command due to being pinned. Then listing the dependency package name, version pinned, and reason if one is configured as part of the pin.
It appears Chocolatey isn't looking at what is pinned when performing an install or upgrade operation when looking at dependcy packages.
### How Did You Get This To Happen? (Steps to Reproduce)
1. Current system state is Chocolatey V 0.11.1 is installed and you wish to install the chocolateygui package.
1. Chocolatey V 0.11.1 is currently pinned. Can check via running `choco pin list`
1. Have a later version of the Chocolatey package in your repo as well as the chocolateygui package. For instance Chocolatey V 1.1.0 and chocolateygui V 1.0.0
1. Perform a choco install/upgrade chocolateygui
1. The pinned Chocolatey package will upgrade to meet the dependency threshold of the chocolateygui package and chocolateygui will also install.
1. If you run `choco pin list` the Chocolatey package will no longer be pinned and will have been upgraded.
**note**
Also tried this same testing with packages that aren't chocolatey & chocolateygui. Got the same result where the pinned package was unpinned and upgraded through the process.
### System Details
* OS Build : Windows 10 & Server 2022
* Windows PowerShell version: 5.1
* Chocolatey version: 0.11.1 and 1.1.0
### Output Log
Context for the log output.
Packages:
I created the following packages to test this
A firefox V 100.0.2 package with an explicit dependency of V 5.10.7.6120 of zoom.
A firefox V 101.0.1 package with an explicit dependency of V 5.11.1.6602 of zoom.
Process:
1. Ran `choco install firefox --version=100.0.2 -y` to install both firefox V 100.0.2 and zoom V 5.10.7.6120
1. Ran ` choco pin zoom --version=5.10.7.6120 --reason='Test Upgrade'` to pin the zoom package
1. Ran `choco ping list` to verify the zoom package was pinned.
1. Ran `choco upgrade firefox -y` to grab the firefox V 101.0.1 package i created that has the explicit dependency of V 5.11.1.6602 of zoom.
1. Both packages get upgraded even though zoom was pinned
1. Do a `choco pin list` and nothing is retuned meaning zoom is no longer pinned.
Full Log Output
~~~sh
PS C:\packages> choco install firefox --version=100.0.2 -y
Chocolatey v1.1.0 Business
Installing the following packages:
firefox
By installing, you accept licenses for the packages.
Progress: Downloading Firefox 100.0.2... 100%
Progress: Downloading zoom 5.10.7.6120... 100%
zoom v5.10.7.6120
zoom package files install completed. Performing other installation steps.
Installing ZoomInstallerFull.msi...
ZoomInstallerFull.msi has been installed.
zoom may be able to be automatically uninstalled.
The install of zoom was successful.
Software install location not explicitly set, it could be in package or
default install location of installer.
Firefox v100.0.2
firefox package files install completed. Performing other installation steps.
Using locale 'en-US'...
Installing Firefox Setup 100.0.2.exe...
Firefox Setup 100.0.2.exe has been installed.
WARNING: No registry key found based on 'Mozilla Firefox'
firefox may be able to be automatically uninstalled.
The install of firefox was successful.
Software installed to 'C:\Program Files\Mozilla Firefox'
Chocolatey installed 2/2 packages.
See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).
PS C:\packages> choco pin zoom --version=5.10.7.6120 --reason='Test Upgrade'
Chocolatey v1.1.0 Business
Unknown command zoom. Setting to list.
PS C:\packages> choco pin add -n zoom --version=5.10.7.6120 --reason='Test Upgrade'
Chocolatey v1.1.0 Business
Trying to add a pin for zoom
Successfully added a pin for zoom v5.10.7.6120.
PS C:\packages> choco pin list
Chocolatey v1.1.0 Business
zoom|5.10.7.6120|Test Upgrade
PS C:\packages> choco upgrade firefox -y
Chocolatey v1.1.0 Business
Upgrading the following packages:
firefox
By upgrading, you accept licenses for the packages.
You have Firefox v100.0.2 installed. Version 101.0.1 is available based on your source(s).
Progress: Downloading Firefox 101.0.1... 100%
zoom v5.11.1.6602
zoom package files upgrade completed. Performing other installation steps.
Installing ZoomInstallerFull.msi...
ZoomInstallerFull.msi has been installed.
zoom may be able to be automatically uninstalled.
The upgrade of zoom was successful.
Software install location not explicitly set, it could be in package or
default install location of installer.
Firefox v101.0.1
firefox package files upgrade completed. Performing other installation steps.
Using locale 'en-US'...
Installing Firefox Setup 101.0.1.exe...
Firefox Setup 101.0.1.exe has been installed.
WARNING: No registry key found based on 'Mozilla Firefox'
firefox may be able to be automatically uninstalled.
ShimGen has successfully created a shim for Firefox Setup 100.0.2.exe
ShimGen has successfully created a shim for Firefox Setup 100.0.2.exe
The upgrade of firefox was successful.
Software installed to 'C:\Program Files\Mozilla Firefox'
Chocolatey upgraded 2/2 packages.
See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).
PS C:\packages> choco pin list
Chocolatey v1.1.0 Business
PS C:\packages>
~~~
### References:
* [ZenDesk Ticket](https://chocolatey.zendesk.com/agent/tickets/14539)
Contributor guide
Research direction
Start by reproducing the behavior with `choco install firefox --version=100.0.2 -y`, `choco pin add`, and `choco upgrade firefox -y`. Trace dependency handling during the upgrade and verify that a pinned dependency is not upgraded or unpinned, with the requested package, pinned version, and reason reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 30/100