microsoft / microsoft/aspire

Dependabot can't upgrade `Aspire.Hosting.Testing`

Open
#18,791 1 comment 1 reaction 0 assignees View on GitHub
area-tooling
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 12h
Merged PRs (30d)
201

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Dependabot failed to upgrade `Aspire.Hosting.Testing` in a test project of mine because the `Aspire.Hosting.Sdk` sdk force downgraded the `Aspire.Hosting.AppHost` assembly to an older version
https://github.com/afscrome/aspire-dotnet-jwts/pull/25
https://github.com/afscrome/aspire-dotnet-jwts/actions/runs/29183689960/job/86625944498?pr=25

```
/Users/alex/Developer/aspire-dotnet-jwts/tests/integration/AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: Aspire.Hosting.AppHost from 13.4.6 to 13.4.5. Reference the package directly from the project to select
a different version.
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.Testing 13.4.6 -> Aspire.Hosting.AppHost (>= 13.4.6)
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.AppHost (>= 13.4.5)
```

### Expected Behavior

The Aspire SDK should not include an explicit reference to `Aspire.Hosting.AppHost` (or any other `Aspire.Hosting` assemblies), if a newer version is referenced transitively from any other dependency.

### Steps To Reproduce

Take a basic test project on 13.4.5

```xml


net10.0
enable
enable
Exe




```

Simulate Dependabot by upgrading the `Aspire.Hosting.Testing` project to 13.4.6
```

```

```
Warning As Error: Detected package downgrade: Aspire.Hosting.AppHost from 13.4.6 to 13.4.5. Reference the package directly from the project to select
a different version.
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.Testing 13.4.6 -> Aspire.Hosting.AppHost (>= 13.4.6)
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.AppHost (>= 13.4.5)
```

### Exceptions (if any)

_No response_

### Aspire doctor output

_No response_

### Anything else?

There is a slightly larger issue here with Dependabot unable to upgrade the aspire sdk, but SDK upgrades are a missing feature from Dependabot.

Contributor guide

Open the contributing guide

Research direction

Start with the reproduced test project's .csproj and the Aspire.AppHost.Sdk/13.4.5 package, then run restore after changing Aspire.Hosting.Testing to 13.4.6. Trace how the SDK introduces the Aspire.Hosting.AppHost reference and verify that the restore no longer reports a downgrade when the newer transitive package is selected.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.