dependabot / dependabot/dependabot-core

NuGet dependency assets not considered

Open
#10,482 5 comments 0 reactions 0 assignees View on GitHub
L: dotnet:nuget T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

NuGet

### Package manager version

_No response_

### Language version

net6, net8

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

```
version: 2
updates:
- package-ecosystem: "nuget"
directory: "/"
registries: "*"
schedule:
interval: "daily"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

When having a .csproj project file with the following package references
```xml








```

Dependabot fails with the following error:
```
dotnet build in GetAllPackageDependenciesAsync failed. STDOUT: MSBuild version 17.9.6+a4ecab324 for .NET
Determining projects to restore...
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1202: Package JetBrains.ReSharper.GlobalTools 2024.1.2 is not compatible with net6.0 (.NETCoreApp,Version=v6.0). Package JetBrains.ReSharper.GlobalTools 2024.1.2 supports: netcoreapp3.1 (.NETCoreApp,Version=v3.1) / any
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1212: Invalid project-package combination for JetBrains.ReSharper.GlobalTools 2024.1.2. DotnetToolReference project style can only contain references of the DotnetTool type
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1202: Package nbgv 3.6.133 is not compatible with net6.0 (.NETCoreApp,Version=v6.0). Package nbgv 3.6.133 supports: net6.0 (.NETCoreApp,Version=v6.0) / any
/tmp/package-dependency-resolution_cgbamk/Project.csproj : error NU1212: Invalid project-package combination for nbgv 3.6.133. DotnetToolReference project style can only contain references of the DotnetTool type
Failed to restore /tmp/package-dependency-resolution_cgbamk/Project.csproj (in 432 ms).

Build FAILED.
```

It seems that the dependency assets (https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets) are not respected when generating a temporary project file:
https://github.com/dependabot/dependabot-core/blob/c8fa18ef76af57b0a42d0df27682b4801fef9a2c/nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs#L706

I could probably switch to _PackageDownload_ instead of _PackageReference_ for the problematic packages but this is not supported by Dependabot: https://github.com/dependabot/dependabot-core/issues/2920

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

```xml


net6.0



```

Contributor guide

Open the contributing guide

Research direction

Start in nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs around line 706, where the temporary project file is generated. Reproduce the restore failure with the smallest net6.0 manifest containing nbgv with ExcludeAssets="all", then inspect how dependency assets are represented. Done means the temporary project respects those assets and restore no longer reports the NU1202 and NU1212 errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.