Microsoft.AspNetCore.App is not specifying version ranges for 3rd party dependencies

aspnet / MetaPackages

[Archived] NuGet meta packages. Project moved to https://github.com/aspnet/AspNetCore

Apache License 2.0

211 stars 109 forks source link

Microsoft.AspNetCore.App is not specifying version ranges for 3rd party dependencies #259

Closed DamianEdwards closed 6 years ago

DamianEdwards commented 6 years ago

It seems that Microsoft.AspNetCore.App is not currently setting version ranges for the 3rd party dependencies in the transitive graph, e.g. Newtonsoft.Json.

Do folks think we should instead be locking these versions to the known good version, given the intent is to ensure folks can't be lifted out of the supported state without a warning (direct reference) or error (transitive lifting)? My gut is saying we should be limiting these too.

Thoughts @davidfowl @JunTaoLuo @Eilon ?

JunTaoLuo commented 6 years ago

Yes we should, I thought I filed a bug for this in preview2 since we were running out of time for preview1 but I can no longer find it. I'll move this issue to Universe.

JunTaoLuo commented 6 years ago

This issue was moved to aspnet/Universe#920