NuGet pack should not fail for release packages with prerelease development dependency

[lostmsu]

Currently, release package can not have prerelease development dependency. For example, that prevents us from using StyleCop.Analyzers package currently in beta in any release package development,

Internal alias: vimilova

[zivkan]

@ardalis that command line argument only works for nuget.exe pack, which only supports packages.config. For projects using PackageReference (and therefore msbuild pack), you can use NoWarn NU5104:

<PropertyGroup>
  <NoWarn>$(NoWarn);NU5104</NoWarn>
</PropertyGroup>

[tonyqus]

Looks I encounter the issue today. Here is the story from NPOI team.

MSFT suggests the community to get rid of System.Drawing.Common since they don't wanna maintain this library anymore (There are a few weird excuse like libgdi is not well maintained. But why MSFT cannot hire someone to maintain it?). Then we have no choice but migrate to a new drawing package. We finally choose ImageSharp. And then it takes about a month to migrate from System.Drawing.Common to SixLabors.Fonts.

We released NPOI 2.6.0-rc3 (which reference SixLabors.Fonts) 2 month ago and everything looks fine (no errors). Then NPOI 2.6.0 is released today. It's almost the same nuget package from 2.6.0-rc3 except the version. However, Visual Studio cannot find SixLabors.Fonts in any case when the developer try to reference 2.6.0 package because nuget doesn't support dependency on a prerelease package. And it's interesting that a prerelease version can work well if it references a prerelease package.

I also tested ClosedXml package because it also reference SixLabors.Fonts package. Same error: 'Cannot resolve dependency SixLabors.Fonts'.

========Update ======== I can reproduce it while using .NET framework 4.7.2 project and it's a project using packages.config file

[zivkan]

@tonyqus

nuget doesn't support dependency on a prerelease package.

Yes it does. For years, NuGet treats it as a warning that can be ignored if you choose. See my comment immediately before yours.

In fact, NPOI 2.6.0 (a semver stable version) lists a dependency on SixLabors.Fonts version 1.0.0-beta18, so I don't understand why you're saying it's not supported when your package already does it.

Same error: 'Cannot resolve dependency SixLabors.Fonts'.

D:\src\test\npoitest> dotnet new console
The template "Console App" was created successfully.

Processing post-creation actions...
Restoring D:\src\test\npoitest\npoitest.csproj:
  Determining projects to restore...
  Restored D:\src\test\npoitest\npoitest.csproj (in 68 ms).
Restore succeeded.

D:\src\test\npoitest> dotnet add package npoi
  Determining projects to restore...
  Writing C:\Users\zivkan\AppData\Local\Temp\tmp2B6A.tmp
info : X.509 certificate chain validation will use the default trust store selected by .NET.
info : X.509 certificate chain validation will use the default trust store selected by .NET.
info : Adding PackageReference for package 'npoi' into project 'D:\src\test\npoitest\npoitest.csproj'.
info :   GET https://api.nuget.org/v3/registration5-gz-semver2/npoi/index.json
info :   OK https://api.nuget.org/v3/registration5-gz-semver2/npoi/index.json 826ms
info : Restoring packages for D:\src\test\npoitest\npoitest.csproj...

// cutting out a bunch of lines
info :   GET https://api.nuget.org/v3-flatcontainer/sixlabors.fonts/index.json
info :   OK https://api.nuget.org/v3-flatcontainer/sixlabors.fonts/index.json 904ms
info :   GET https://api.nuget.org/v3-flatcontainer/sixlabors.fonts/1.0.0-beta18/sixlabors.fonts.1.0.0-beta18.nupkg
info :   OK https://api.nuget.org/v3-flatcontainer/sixlabors.fonts/1.0.0-beta18/sixlabors.fonts.1.0.0-beta18.nupkg 72ms
info : Installed SixLabors.Fonts 1.0.0-beta18 from https://api.nuget.org/v3/index.json with content hash evykNmy/kEE9EAEKgZm3MNUYXuMHFfmcLUNPw7Ho5q7OI96GFkkIxBm+QaKOTPBKw+L0AjKOs+ArVg8P40Ac9g==.
info : Installed NPOI 2.6.0 from https://api.nuget.org/v3/index.json with content hash Pwjo65CUH3MiRnBEbVo8ff31ZrDGdGyyFJyAEncmbTQ0/gYgDkBUnGKm20aLpdwCpPNLzvapZm8v5tx4S6qAWg==.
info : Package 'npoi' is compatible with all the specified frameworks in project 'D:\src\test\npoitest\npoitest.csproj'.info : PackageReference for package 'npoi' version '2.6.0' added to file 'D:\src\test\npoitest\npoitest.csproj'.
info : Writing assets file to disk. Path: D:\src\test\npoitest\obj\project.assets.json
log  : Restored D:\src\test\npoitest\npoitest.csproj (in 12.38 sec).

By any chance are you using a custom nuget feed, with nuget.org removed from your nuget.config? It sounds to me like the sixlabors.fonts package hasn't been mirrored to your custom feed.

[tonyqus]

@zivkan No, I don't use any custom nuget feed. It's just nuget.org. The difference is that I don't use dotnet command in this case. I use Visual Studio - Add nuget reference. You can reproduce it easily if your project uses .NET framework 4.7.2. I tried both VS2019 and VS2022.

Your console project looks to be .NET core by default instead of .NET framework 4.7.2. And My project is using packages.config

I see ClosedXML provides some workaround. This looks to be a problem with packages.config instead of .NET version.

[zivkan]

Indeed, PackageReference still works, even with the legacy csproj. I confirm that it failed with packages.config, but this thread is about packing, not installing packages. I can't find a duplicate issue from a quick search, so I suggest filing a new issue for that to be investigated. The topic of this issue has been resolved, and I believe this issue is correctly closed.

Since before 2016 NuGet wouldn't allow semver stables packages to depend on prerelease packages at all, this wasn't a scenario that was possible for the first 5 years that NuGet was around. Looks like it wasn't taken into account when https://github.com/NuGet/NuGet.Client/pull/1073 was completed.

[tonyqus]

@zivkan Thank you for the clarification.

[tonyqus]

I created a new issue #12259 as you suggested. @zivkan