fsprojects / fsprojects/Paket

Most transitive dependencies are not included in paket.lock for net10.0-windows and net8.0-windows

Open
#4,274 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
F#
Stars
2.1k
Forks
528
Avg merge
1d 12m
Merged PRs (30d)
54

Description

Description

When using framework: net8.0-windows or framework: net10.0-windows, some transitive dependencies are not included in paket.lock.

This also means paket show-installed-packages --all won't show transitive packages.

Reproducible with paket 8.0.3, 8.1.0-alpha004, 10.0.0-alpha011, 10.3.1.

Repro steps

Using the following paket.dependencies file:

framework: net8.0-windows

source https://api.nuget.org/v3/index.json

nuget Newtonsoft.Json.Bson

will result in following paket.lock file:

RESTRICTION: == net8.0-windows7.0
NUGET
  remote: https://api.nuget.org/v3/index.json
    Newtonsoft.Json.Bson (1.0.2)

Compare this to e.g. net6.0-windows (expected behavior):

RESTRICTION: == net6.0-windows7.0
NUGET
  remote: https://api.nuget.org/v3/index.json
    Newtonsoft.Json (13.0.3)
    Newtonsoft.Json.Bson (1.0.2)
      Newtonsoft.Json (>= 12.0.1)
Known workarounds

Using net8.0 instead of net8.0-windows works as expected, but it obviously includes other packages needed for other platforms. For net10.0, this workaround no longer works.

net8.0-windows10.0.17763.0 works as expected.

Some transitive dependencies are, rarely, included.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided paket.dependencies reproduction and compare generated paket.lock files for net8.0-windows, net10.0-windows, and net6.0-windows. Check paket show-installed-packages --all as well; done means the affected Windows target frameworks include the expected transitive dependencies in both the lock file and command output.

Written by the indexing model from the issue text.

Assessment

Tech stack
fsharp
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.