Conflicting dependencies across nuget packages causes infinite re-installation of packages

[sonicbhoc]

I have pinned Fable.React to version 8 specifically to avoid taking a dependency on Fable 4 and React 18. However, React 18 is the version that is resolved for Fable.React version 8.

Feliz v1.68 requires React gte 17 lt 18, and Fable.React requires React gte 18 lt 19. This is the output from femto --validate :

[12:56:08 INF] Analyzing project C:\Users\cchristie\source\repos\qe\src\Client\Client.fsproj
[12:56:08 INF] Running dotnet restore against the project
[12:56:14 INF] Using npm for package management
[12:56:43 INF] Ensuring project can be analyzed
[12:56:43 INF] Feliz.React.Msal requires npm package @azure/msal-browser
[12:56:43 INF]   | -- Required range >= 2.32.1
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 2.32.2 that satisfies the required range
[12:56:43 INF] Feliz.React.Msal requires npm package @azure/msal-react
[12:56:43 INF]   | -- Required range >= 1.5.1
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 1.5.2 that satisfies the required range
[12:56:43 INF] Fable.React requires npm package react
[12:56:43 INF]   | -- Required range >= 18.0.0 < 19.0.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 18.2.0 that satisfies the required range
[12:56:43 INF] Fable.React requires npm package react-dom
[12:56:43 INF]   | -- Required range >= 18.0.0 < 19.0.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 18.2.0 that satisfies the required range
[12:56:43 INF] Feliz requires npm package react
[12:56:43 INF]   | -- Required range >= 17.0.1 < 18.0.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 17.0.2 that satisfies the required range
[12:56:43 INF] Feliz requires npm package react-dom
[12:56:43 INF]   | -- Required range >= 17.0.1 < 18.0.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 17.0.2 that satisfies the required range
[12:56:43 INF] Feliz.Bulma requires npm package bulma
[12:56:43 INF]   | -- Required range >= 0.9.0 < 0.10.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 0.9.4 that satisfies the required range
[12:56:43 INF] Feliz.Bulma.Timeline requires npm package bulma-timeline
[12:56:43 INF]   | -- Required range >= 3.0.4 < 4.0.0
[12:56:43 INF]   | -- Resolution strategy 'Max'
[12:56:43 INF]   | -- ✔ Found version 3.0.5 that satisfies the required range
[12:56:43 INF] Fulma requires npm package bulma
[12:56:43 INF]   | -- Required range >= 0.9.3
[12:56:43 INF]   | -- Resolution strategy 'Min'
[12:56:43 INF]   | -- ✔ Found version 0.9.3 that satisfies the required range
[12:56:43 INF] Validation result: Success

And every time I run femto --resolve, it flip-flops between version 17 and 18 of react, uninstalling one version then reinstalling the other, instead of seeing the validation result as having a conflict:

[13:15:54 INF] Analyzing project C:\Users\cchristie\source\repos\qe\src\Client\Client.fsproj
[13:15:54 INF] Running dotnet restore against the project
[13:16:03 INF] Using npm for package management
[13:16:33 INF] Found package.json in C:\Users\cchristie\source\repos\qe
[13:16:33 INF] Executing required actions for package resolution
[13:16:33 INF] Uninstalling [react, react-dom]
[13:16:38 INF] Installing dependencies [react@17.0.2, react-dom@17.0.2]
[13:16:43 INF] ✔ Package resolution complete

[13:16:57 INF] Analyzing project C:\Users\cchristie\source\repos\qe\src\Client\Client.fsproj
[13:16:57 INF] Running dotnet restore against the project
[13:17:03 INF] Using npm for package management
[13:17:30 INF] Found package.json in C:\Users\cchristie\source\repos\qe
[13:17:31 INF] Executing required actions for package resolution
[13:17:31 INF] Uninstalling [react, react-dom]
[13:17:36 INF] Installing dependencies [react@18.2.0, react-dom@18.2.0]
[13:17:40 INF] ✔ Package resolution complete

This seems like a bug to me. The package resolution absolutely should be failing if conflicting versions of the same packages are required.

[sonicbhoc]

Also, it's worth noting that calling dotnet femto with no arguments does actually fail, but doesn't mention anything about a conflict:

[13:23:34 INF] Analyzing project C:\Users\cchristie\source\repos\qe\src\Client\Client.fsproj
[13:23:34 INF] Running dotnet restore against the project
[13:23:40 INF] Using npm for package management
[13:24:09 INF] Found package.json in C:\Users\cchristie\source\repos\qe
[13:24:09 INF] Feliz.React.Msal requires npm package @azure/msal-browser
[13:24:09 INF]   | -- Required range >= 2.32.1 found in project file
[13:24:09 INF]   | -- Used range ^2.32.2 for the package
[13:24:09 INF]   | -- ✔ Installed version 2.32.2 satisfies required range >= 2.32.1
[13:24:09 INF] Feliz.React.Msal requires npm package @azure/msal-react
[13:24:09 INF]   | -- Required range >= 1.5.1 found in project file
[13:24:09 INF]   | -- Used range ^1.5.2 for the package
[13:24:09 INF]   | -- ✔ Installed version 1.5.2 satisfies required range >= 1.5.1
[13:24:09 INF] Fable.React requires npm package react
[13:24:09 INF]   | -- Required range >= 18.0.0 < 19.0.0 found in project file
[13:24:09 INF]   | -- Used range ^18.2.0 for the package
[13:24:09 INF]   | -- ✔ Installed version 18.2.0 satisfies required range >= 18.0.0 < 19.0.0
[13:24:09 INF] Fable.React requires npm package react-dom
[13:24:09 INF]   | -- Required range >= 18.0.0 < 19.0.0 found in project file
[13:24:09 INF]   | -- Used range ^18.2.0 for the package
[13:24:09 INF]   | -- ✔ Installed version 18.2.0 satisfies required range >= 18.0.0 < 19.0.0
[13:24:09 INF] Feliz.Bulma requires npm package bulma
[13:24:09 INF]   | -- Required range >= 0.9.0 < 0.10.0 found in project file
[13:24:09 INF]   | -- Used range ^0.9.4 for the package
[13:24:09 INF]   | -- ✔ Installed version 0.9.4 satisfies required range >= 0.9.0 < 0.10.0
[13:24:09 INF] Feliz.Bulma.Timeline requires npm package bulma-timeline
[13:24:09 INF]   | -- Required range >= 3.0.4 < 4.0.0 found in project file
[13:24:09 INF]   | -- Used range ^3.0.5 for the package
[13:24:09 INF]   | -- ✔ Installed version 3.0.5 satisfies required range >= 3.0.4 < 4.0.0
[13:24:09 INF] Fulma requires npm package bulma
[13:24:09 INF]   | -- Required range >= 0.9.3 found in project file
[13:24:09 INF]   | -- Used range ^0.9.4 for the package
[13:24:09 INF]   | -- ✔ Installed version 0.9.4 satisfies required range >= 0.9.3
[13:24:09 INF] Feliz requires npm package react
[13:24:09 INF]   | -- Required range >= 17.0.1 < 18.0.0 found in project file
[13:24:09 INF]   | -- Used range ^18.2.0
[13:24:09 INF]   | -- Found installed version 18.2.0
[13:24:09 ERR]   | -- Installed version 18.2.0 does not satisfy [>= 17.0.1 < 18.0.0]
[13:24:09 INF]   | -- Resolve manually using 'npm uninstall react' then 'npm install react@17.0.2 --save'
[13:24:09 INF] Feliz requires npm package react-dom
[13:24:09 INF]   | -- Required range >= 17.0.1 < 18.0.0 found in project file
[13:24:09 INF]   | -- Used range ^18.2.0
[13:24:09 INF]   | -- Found installed version 18.2.0
[13:24:09 ERR]   | -- Installed version 18.2.0 does not satisfy [>= 17.0.1 < 18.0.0]
[13:24:09 INF]   | -- Resolve manually using 'npm uninstall react-dom' then 'npm install react-dom@17.0.2 --save'

[Zaid-Ajaj]

Hi @sonicbhoc thanks for filing the issue! What is the femto --version you are using? Also is it possible to create a repro example for me to test with? that would be great!

[Zaid-Ajaj]

@sonicbhoc The issue might be the newer dotnet SDK that is used when resolving the nuget packages. Can you please try pinning your dotnet SDK to v6.x as well using a global.json file?

{
    "sdk": {
        "version": "6.0.400"
    }
}

When I do this, then run dotnet femto I get a proper resolution conflict:

zaid@Zaids-MBP src % dotnet femto          
[11:43:03 INF] Analyzing project /Users/zaid/projects/femtotest/src/App.fsproj
[11:43:04 INF] Running dotnet restore against the project
[11:43:05 INF] Using npm for package management
[11:43:07 INF] Found package.json in /Users/zaid/projects/femtotest
[11:43:07 INF] Fable.DateFunctions requires npm package date-fns
[11:43:07 INF]   | -- Required range >= 2.16.1 < 3.0 found in project file
[11:43:07 INF]   | -- Used range ^2.16.1 for the package
[11:43:07 INF]   | -- ✔ Installed version 2.16.1 satisfies required range >= 2.16.1 < 3.0
[11:43:07 INF] Feliz requires npm package react
[11:43:07 INF]   | -- Required range >= 17.0.1 < 18.0.0 found in project file
[11:43:07 ERR]   | -- Missing package react
[11:43:07 INF] Feliz requires npm package react-dom
[11:43:07 INF]   | -- Required range >= 17.0.1 < 18.0.0 found in project file
[11:43:07 ERR]   | -- Missing package react-dom
[11:43:07 INF] Fable.React requires npm package react
[11:43:07 INF]   | -- Required range >= 18.0.0 < 19.0.0 found in project file
[11:43:07 INF]   | -- Missing package react
[11:43:07 ERR]   | -- Could not find a version that satisfies the ranges [>= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0]
[11:43:07 INF] Fable.React requires npm package react-dom
[11:43:07 INF]   | -- Required range >= 18.0.0 < 19.0.0 found in project file
[11:43:07 INF]   | -- Missing package react-dom
[11:43:07 ERR]   | -- Could not find a version that satisfies the ranges [>= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0]

As for femto --resolve this is what I get

zaid@Zaids-MBP src % dotnet femto --resolve
[11:43:42 INF] Analyzing project /Users/zaid/projects/femtotest/src/App.fsproj
[11:43:42 INF] Running dotnet restore against the project
[11:43:43 INF] Using npm for package management
[11:43:45 INF] Found package.json in /Users/zaid/projects/femtotest
[11:43:45 INF] Executing required actions for package resolution
[11:43:45 ERR] Fable.React -> Unable to resolve react >= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0
[11:43:45 ERR] Could not find a version that satisfies the ranges [>= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0]
[11:43:45 ERR] Fable.React -> Unable to resolve react-dom >= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0
[11:43:45 ERR] Could not find a version that satisfies the ranges [>= 18.0.0 < 19.0.0, >= 17.0.1 < 18.0.0]
[11:43:45 INF] ✔ Package resolution complete

[sonicbhoc]

I'm using femto 0.15.0, installed as a local tool. Oddly enough, when I run dotnet tool update femto, it claims I have version 0.16.0 installed.

> dotnet tool update femto
Tool 'femto' is up to date (version '0.16.0' manifest file C:\Users\cchristie\source\repos\qe\.config\dotnet-tools.json) .

>dotnet femto --version
0.15.0

As for SDK version, my global.json reads as follows:

{
    "sdk": {
        "version": "6.0.400",
        "rollForward": "latestMinor"
    }
}

[Zaid-Ajaj]

I'm using femto 0.15.0, installed as a local tool. Oddly enough, when I run dotnet tool update femto, it claims I have version 0.16.0 installed

That's another issue in the source code where Version is hardcoded as 0.15.0 😓 probably forgot to update it when published v0.16.

The main issue still stands: I cannot reproduce the issue given these inputs. If possible, a repro example would be great! 🙏

[sonicbhoc]

I wish I could give you access to my repo, but I doubt my employers would be too enthusiastic about it.

I'll try to repro this in a different repo soon.

[sonicbhoc]

Are you ready for some weirdness? I started running femto using FAKE through the VS Developer PowerShell instead of my regular PowerShell instance, and everything works as expected, except dotnet femto --resolve failing, but still returning Package resolution complete and FAKE thinks the tool succeeded.

I'm pretty confident that the issue is more with something in my dev environment and not your tool. Although resolve failing should definitely return a non-zero error code.

Thanks!