Dependabot can't upgrade `Aspire.Hosting.Testing`
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 201
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
Dependabot failed to upgrade `Aspire.Hosting.Testing` in a test project of mine because the `Aspire.Hosting.Sdk` sdk force downgraded the `Aspire.Hosting.AppHost` assembly to an older version
https://github.com/afscrome/aspire-dotnet-jwts/pull/25
https://github.com/afscrome/aspire-dotnet-jwts/actions/runs/29183689960/job/86625944498?pr=25
```
/Users/alex/Developer/aspire-dotnet-jwts/tests/integration/AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: Aspire.Hosting.AppHost from 13.4.6 to 13.4.5. Reference the package directly from the project to select
a different version.
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.Testing 13.4.6 -> Aspire.Hosting.AppHost (>= 13.4.6)
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.AppHost (>= 13.4.5)
```
### Expected Behavior
The Aspire SDK should not include an explicit reference to `Aspire.Hosting.AppHost` (or any other `Aspire.Hosting` assemblies), if a newer version is referenced transitively from any other dependency.
### Steps To Reproduce
Take a basic test project on 13.4.5
```xml
net10.0
enable
enable
Exe
```
Simulate Dependabot by upgrading the `Aspire.Hosting.Testing` project to 13.4.6
```
```
```
Warning As Error: Detected package downgrade: Aspire.Hosting.AppHost from 13.4.6 to 13.4.5. Reference the package directly from the project to select
a different version.
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.Testing 13.4.6 -> Aspire.Hosting.AppHost (>= 13.4.6)
AlexCrome.Aspire.Hosting.UserJwts.IntegrationTests -> Aspire.Hosting.AppHost (>= 13.4.5)
```
### Exceptions (if any)
_No response_
### Aspire doctor output
_No response_
### Anything else?
There is a slightly larger issue here with Dependabot unable to upgrade the aspire sdk, but SDK upgrades are a missing feature from Dependabot.
Contributor guide
Research direction
Start with the reproduced test project's .csproj and the Aspire.AppHost.Sdk/13.4.5 package, then run restore after changing Aspire.Hosting.Testing to 13.4.6. Trace how the SDK introduces the Aspire.Hosting.AppHost reference and verify that the restore no longer reports a downgrade when the newer transitive package is selected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100