search

Inedo / pgscan

Dependency scanner for ProGet.
MIT License
11 stars 5 forks source link

Multiple versions of a dependency listed #29

Closed crotondo-dap closed 1 year ago

crotondo-dap commented 1 year ago

Hi,

due to different transitive dependencies we may end up with two versions of the same package (you can see an example in the attached image). So lets assume dependency "x" of my project has a dependency to "Microsoft.Web.Infrastructure 1.0.0" and dependency "y" of my project has a dependency to "Microsoft.Web.Infrasructure 2.0.0". Both versions of this library are written into the project.assets.json during nuget restore. But after building the project only the newer version is effectively used by my project. Therefore, there is a dependency listed we do not depend on. image What if an issue will be detected in "Microsoft.Web.Infrastructure 1.0.0"? Will there be an issue shown for my whole project? Even if my project isn't even using this dependency in the end?

Maybe pgscan could check for the newest version available while reading the project.assets.json?

crotondo-dap commented 1 year ago

Hi again,

I can now confirm that a release will have an unresolved issue, if two dependencies with different versions are listed. Which does make sense from ProGet's perspective. We have a release which is using Newtonsoft.Json 13.0.2. Through transitive dependencies also Newtonsoft.Json 11.0.1 is listed via pgscan, which has security vulnerabilities. Therefore, our release has an unresolved issue. But our product will be shipped with Newtonsoft.Json 13.0.2, since it is the only assembly in our build output.

Have you been able to think about this issue yet?

rhessinger commented 1 year ago

Hi @crotondo-dap,

We have discussed this internally, but we have not come up with a solution as of yet. It looks like CycloneDX has a similar problem to this as well. The biggest issue is that .NET supports referencing two different versions of a DLL package as well. Especially in .NET 5+ and multi-targeted solutions. So, unfortunately, taking the latest version would not be the best solution either.

I would say that the solution right now is to manually remove that dependency when you review the issues in that release.

Thanks, Rich

crotondo-dap commented 1 year ago

Hi @rhessinger,

I have not thought about multi-targeted solutions. I agree that taking the latest version is not the best solution. We will remove the dependencies manually for now. Maybe we can come up with a workaround or maybe cleaning up our dependency-hell will be a good start.

Thank you very much, Caterina