Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Paket do not keeps versions locked for dependencies #1457

Closed
tsibelman opened this issue Feb 4, 2016 · 24 comments
Closed

Paket do not keeps versions locked for dependencies #1457

tsibelman opened this issue Feb 4, 2016 · 24 comments

Comments

@tsibelman
Copy link
Contributor

Hi have following paket.dependencies file I set all 3 dependencies to be locked to specific version

source https://www.nuget.org/api/v2/

framework: net451
redirects: on

nuget Microsoft.Orleans.Core 1.1.1
nuget Microsoft.Orleans.CounterControl 1.1.1
nuget Microsoft.Orleans.OrleansRuntime 1.1.1

When paket.lock is created it looks like this:

Microsoft.Orleans.Core (1.1.1)
Newtonsoft.Json (>= 6.0.8)
Microsoft.Orleans.CounterControl (1.1.1)
Microsoft.Orleans.Core** (>= 1.1.1)**
Microsoft.Orleans.OrleansRuntime** (>= 1.1.1)**
Microsoft.Orleans.OrleansRuntime (1.1.1)
Microsoft.Orleans.Core** (>= 1.1.1)**

All dependencies are more permissive that is specified. I understand that these dependencies ranges are coming from nugets but I think they should be overridden in lock file. This will allow us to force users to use specific version of transitive dependencies

@forki
Copy link
Member

forki commented Feb 4, 2016

The indented lines are only showing the restrictions from the package nuspec. They are combined with the stuff that you specify in the dependencies file. As a result you see that we select the correct versions.

@forki
Copy link
Member

forki commented Feb 4, 2016

In other words: indented lines are only for information. They don't represent what we select

@tsibelman
Copy link
Contributor Author

Ok I see that when I create nuget packages the dependencies from paket.dependencies are not used in nuspec

@forki
Copy link
Member

forki commented Feb 4, 2016

Or maybe I don't understand what you are describing.

@tsibelman
Copy link
Contributor Author

I will try again :)

I created some nuget let's call it Common.dll, that has dependency on 3 Microsoft.Orleans nugets of specific version, I checked the nuspec file and it looks like all dependencies there are correct, here a sample:

  <dependency id="Microsoft.Orleans.OrleansRuntime" version="1.1.1" />
  <dependency id="Microsoft.Orleans.CounterControl" version="1.1.1" />
  <dependency id="Microsoft.Orleans.Core" version="1.1.1" />

But when I use the Common.dll nuget in my other project I don't get 1.1.1 versions but get 1.1.2 version of Orleans dependencies.

@tsibelman
Copy link
Contributor Author

Ok I see the issue is the forma of the version it writen as version="1.1.1" but it should be specified as version="[1.1.1]"
https://docs.nuget.org/create/versioning

1.0 = 1.0 ≤ x
[1.0] = x == 1.0

@forki
Copy link
Member

forki commented Feb 4, 2016

dependency id="Microsoft.Orleans.OrleansRuntime" version="1.1.1"

means >= 1.1.1

@tsibelman
Copy link
Contributor Author

Now i don't understand

@forki
Copy link
Member

forki commented Feb 4, 2016

sorr reformatted

@tsibelman
Copy link
Contributor Author

Yes but in paket i wrote it as specific version

@forki
Copy link
Member

forki commented Feb 4, 2016

are you sure? Can I see a repro?

@forki
Copy link
Member

forki commented Feb 4, 2016

wait a minute. I think I can reproduce

@tsibelman
Copy link
Contributor Author

You can use the samples I used in first post.

@forki
Copy link
Member

forki commented Feb 4, 2016

mhm. sorry I can't reproduce. 050bafb shows correct behaviour.

@tsibelman
Copy link
Contributor Author

Hi I am attached scenario that can reproduce it, just rename file to zip

ConsoleApplication1.txt

@forki
Copy link
Member

forki commented Feb 4, 2016

If I do pack I get:

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<package xmlns="http://schemas.microsoft.com/packaging/2011/10/nuspec.xsd">
  <metadata>
    <id>ConsoleApplication1</id>
    <version>1.0.0.0</version>
    <title>ConsoleApplication1</title>
    <authors></authors>
    <description></description>
    <dependencies>
      <dependency id="Microsoft.Orleans.OrleansRuntime" version="[1.1.1]" />
      <dependency id="Microsoft.Orleans.CounterControl" version="[1.1.1]" />
      <dependency id="Microsoft.Orleans.Core" version="[1.1.1]" />
    </dependencies>
  </metadata>
</package>

@tsibelman
Copy link
Contributor Author

I use following command to pack: paket pack output nugets minimum-from-lock-file buildplatform x64

@forki
Copy link
Member

forki commented Feb 4, 2016

minimum-from-lock-file

Why didn't you say that before? ;-)

@tsibelman
Copy link
Contributor Author

From my point of view every one should use minimum-from-lock-file exclusively :)

@forki
Copy link
Member

forki commented Feb 4, 2016

nope, that's only one of possible workflows.

@forki
Copy link
Member

forki commented Feb 4, 2016

anyways will add a test and a fix for that

@tsibelman
Copy link
Contributor Author

Thank you

@forki forki closed this as completed in d17214d Feb 4, 2016
@forki
Copy link
Member

forki commented Feb 4, 2016

please try latest

@tsibelman
Copy link
Contributor Author

Works perfect thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants