fsprojects / fsprojects/Paket

NuGet / Paket Interop on transitive dependencies

Open
#3,686 0 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
F#
Stars
2.1k
Forks
528
Avg merge
1d 12m
Merged PRs (30d)
54

Description

Description

Consider the following scenario:

You build a class library with Paket and a direct dependency A (2.0.0)
A itself has a direct dependency on B (1.2.0), however there is also a newer version of B available (1.3.0), which is automatically referenced in the Paket lockfile.
If you package your class library (dotnet pack) the dependencies will only list A as it is the only direct dependency. This "usually works fine" (Even if it is already wrong, see below).

Now assume you work with your class library and add a feature which directly depends on B. As B is already referenced (indirectly through A) you can directly use all of Bs feature. This compiles fine without any changes. Your dependencies in the package will not change.

Now assume a regular NuGet user (or Paket user with strategy: min) uses the package:
-> The resolution will be A (2.0.0) and B (1.2.0), but as your class library is compiled against B (1.3.0) it will fail at runtime.

Repro steps

See above.

Expected behavior

Paket needs to add more direct dependencies if needed (like above) to the final package or fail with a message to add the package as direct dependency.

Actual behavior

Missing direct dependencies.

Known workarounds

Specify B as direct dependency in your class library.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files, tests, or entry points. Reproduce the Paket/NuGet packaging scenario with transitive dependency B resolved at 1.3.0 while A requires 1.2.0, then trace dependency generation during dotnet pack. Done means the package declares the needed direct dependency or fails with guidance to declare B directly.

Written by the indexing model from the issue text.

Assessment

Domain
build-system, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.