search

dotnet / sdk

Core functionality needed to create .NET Core projects, that is shared between Visual Studio and CLI
https://dot.net/core
MIT License
2.66k stars 1.06k forks source link

AutoGenerateBindingRedirects excludes transient dependencies #40803

Open ArvindGundimajalu opened 4 months ago

ArvindGundimajalu commented 4 months ago

Describe the bug

While trying to build the project using dotnet 6 cli and having the AutoGenerateBindingRedirects set to true, the assembly redirect config generated contains the redirects for the nugets that have been directly mentioned in the project but excludes the range for transient dependencies. This causes a problem when different 3rd party binaries are using different version of the transient binary.

To Reproduce

Create Project A that depends on version x of a 3rd party binary. Publish as Nuget Create Project B that depends on version x+ of the same 3rd party binary. Publish as Nuget.

Create app C and consume nugets for A and B. C.config has assembly redirect for A and B but is missing 3rd party binary. Project fails to load B as its unable to find the x+ version of the 3rd party binary.

KalleOlaviNiemitalo commented 4 months ago

Do the NuGet packages for A and B include reference assemblies? If so, do the reference assemblies depend on the third-party binary?

Project fails to load B as its unable to find the x+ version of the 3rd party binary.

That's surprising. I'd expect NuGet restore to choose the higher version x+ of the third-party binary, and B would then load OK, but A (which references the lower version x) would fail to load on .NET Framework without assembly redirects.

ArvindGundimajalu commented 4 months ago

There are no reference assemblies other than System, System.Core. Irrespective of which version 3rd party is copied over the application fails to start as its entirely missing the assembly redirects in the app.config file. One thing that I forgot mentioning - I am using central package management for managing the packages across projects. So my question is why isn't dotnet with Central Package management resolving all the transient assemblies and enlisting them in the app.config? is this because CPM won't allow nuget version range? Is this being restricted by the rules governing cousin-dependencies?