Nuget Central Package Management: behaviour with "VersionOverride" is strange

[WolfgangHG]

NuGet Product Used

Visual Studio Package Management UI

Product Version

"nuget.exe" reports 6.8.0.122

Worked before?

No response

Impact

It bothers me. A fix would be nice

Repro Steps & Context

I played with CPM and package references with "VersionOverrides", and I think I found a place where the behavior is a bit strange.

Attached sample contains a "Directory.Packages.props" with a reference to an older "Newtonsoft.Json" version. NugetCPMOverride.zip

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.2"/>
  </ItemGroup>
</Project>

Project "ClassLibraryOne" uses this reference:

  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" />
  </ItemGroup>

"ClassLibraryTwo" overrides the Newtonsoft version, and also introduced a completely new package:

    <PackageReference Include="System.DirectoryServices" VersionOverride="7.0.1" />
    <PackageReference Include="Newtonsoft.Json" VersionOverride="13.0.1"/>

When updating the Newtonsoft reference in Nuget Package manager, it switches only the version in "Directory.Packages.props" to the newest version, but not the differing version in "ClassLibraryTwo". But I think this behavior is OK, as the library is reported on the "Consolidate" tab.

But Nuget cannot handle the reference "System.Directory.Services" very well: it adds an entry to "Directory.Packages.props", but does not update the "VersionOverride". This is "Directory.Packages.props":

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.2" />
    <PackageVersion Include="System.DirectoryServices" Version="8.0.0" />
  </ItemGroup>
</Project>

The csproj file is unchanged:

    <PackageReference Include="System.DirectoryServices" VersionOverride="7.0.1" />
    <PackageReference Include="Newtonsoft.Json" VersionOverride="13.0.1"/>

And this version mismatch is not reported on the "Consolidate" tab, and the package update is shown again in the Nuget package manager when you open it next. So you are in an update cycle.

I would expect Nuget to update the "VersionOverride" in case the package is not defined in "Directory.Packages.props".

I probably could have worked around it by adding a "Directory.Packages.props" file to "ClassLibraryTwo" and import the base file. But the "VersionOverride" seems to be a simpler feature to add local package references to subprojects ;-).

Verbose Logs

No response

[WolfgangHG]

Update: the "Consolidate" feature of Nuget cannot handle the "VersionOverrides" at all. When clicking the button, the version mismatch is reported again afterwards.

[nkolev92]

VersionOverride is more of edge cases feature that doesn't have a lot of automation build around it. I think might be by design.

cc @jeffkl

Maybe we should have this documented in the VersionOverride doc page? https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management

[WolfgangHG]

At least error messages like "cannot update package, as VersionOverride attribute in file xyz.csproj is defined" would be helpful. Same for the "consolidate" feature.

My initial issue was that updating the package resulted in an unintended change (additional package was added) in the "Directory.Packages.props" file instead of updating the "VersionOverride" in the "csproj" file. Here, a error message instead of doing the update would be helpful.

What do you think?

[jebriede]

Team triage: @martinrrm can you do a timeboxed assessment of how easy it would be to enable this scenario?