dependabot / dependabot/dependabot-core
NuGet dependency assets not considered
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
NuGet
### Package manager version
_No response_
### Language version
net6, net8
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: "nuget"
directory: "/"
registries: "*"
schedule:
interval: "daily"
```
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
When having a .csproj project file with the following package references
```xml
```
Dependabot fails with the following error:
```
dotnet build in GetAllPackageDependenciesAsync failed. STDOUT: MSBuild version 17.9.6+a4ecab324 for .NET
Determining projects to restore...
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1202: Package JetBrains.ReSharper.GlobalTools 2024.1.2 is not compatible with net6.0 (.NETCoreApp,Version=v6.0). Package JetBrains.ReSharper.GlobalTools 2024.1.2 supports: netcoreapp3.1 (.NETCoreApp,Version=v3.1) / any
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1212: Invalid project-package combination for JetBrains.ReSharper.GlobalTools 2024.1.2. DotnetToolReference project style can only contain references of the DotnetTool type
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1202: Package nbgv 3.6.133 is not compatible with net6.0 (.NETCoreApp,Version=v6.0). Package nbgv 3.6.133 supports: net6.0 (.NETCoreApp,Version=v6.0) / any
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1212: Invalid project-package combination for nbgv 3.6.133. DotnetToolReference project style can only contain references of the DotnetTool type
Failed to restore /tmp/package-dependency-resolution_cgbamk/Project.csproj (in 432 ms).
Build FAILED.
```
It seems that the dependency assets (https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets) are not respected when generating a temporary project file:
https://github.com/dependabot/dependabot-core/blob/c8fa18ef76af57b0a42d0df27682b4801fef9a2c/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs#L706
I could probably switch to _PackageDownload_ instead of _PackageReference_ for the problematic packages but this is not supported by Dependabot: https://github.com/dependabot/dependabot-core/issues/2920
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
```xml
net6.0
```
Contributor guide
Research direction
Start in nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs around line 706, where the temporary project file is generated. Reproduce the restore failure with the smallest net6.0 manifest containing nbgv with ExcludeAssets="all", then inspect how dependency assets are represented. Done means the temporary project respects those assets and restore no longer reports the NU1202 and NU1212 errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100