Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NuGet dependency solver doesn't correctly handle a minimum version that doesn't exist. #11150

Open
brettfo opened this issue Dec 18, 2024 · 0 comments
Labels
L: go:modules Golang modules

Comments

@brettfo
Copy link
Contributor

brettfo commented Dec 18, 2024

Consider the following packages:

Top.Level.Package

  • depends on Transitive.Package version >= 1.0.0

Transitive.Package

  • versions 1.0.1 and 1.0.2 exist

When asked to update Transitive.Package from 1.0.1 to 1.0.2, ideally only Top.Level.Package would be updated, but its minimum dependent package version is >= 1.0.0, but that package doesn't exist; instead, 1.0.1 would be resolved.

This causes problems in the dependency solver because at certain points Transitive.Package is explicitly set to its minimum version of 1.0.0 to attempt an update, but since that doesn't exist, the packages can't be solved.

The likely solution is to set the minimum version of Transitive.Package to the smallest available version that satisfies the requirements; something like minVersion = allVersions.Where(v => v >= minVersion).First() so that all future calls to set the minimum version arrive at one that specifically exists.

Consider the unit test modified in PR #11151 as a good test scenario. (N.b. The transitive dependency of Buildalyzer Microsoft.CodeAnalysis.* 4.0.0 doesn't exist, but 4.0.1 does.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
L: go:modules Golang modules
Projects
Status: No status
Development

No branches or pull requests

1 participant