fix(deps): Reduce FSharp.Core dependency back to 5.0.0

fsprojects / FsHttp

A lightweight F# HTTP library by @SchlenkR and @dawedawe

https://fsprojects.github.io/FsHttp/

Apache License 2.0

424 stars 42 forks source link

fix(deps): Reduce FSharp.Core dependency back to 5.0.0 #184

Closed bartelink closed 4 months ago

bartelink commented 4 months ago

FsHttp package versions 13-14.4.0 omitted to state their dependency on FSharp.Core

This means that anyone who is using a FSharp.Core prior to 8.0.100 (which v 14.4.1 correctly declares its dependence on) winds up (if they use a tool that depends on nuspec dependency declarations (such as paket, but also Rider etc):

getting 14.4.0 (technically correct, not a paket bug)

(on a machine that is running a net6.0 runtime) getting surprised at runtime with a:

System.IO.FileLoadException: Could not load file or assembly 'FSharp.Core, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'.
The located assembly's manifest definition does not match the assembly reference. (0x80131040)
File name: 'FSharp.Core, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'

This PR rolls all the way back to only demanding V5, like the older versions did

resolves #183

dawedawe commented 4 months ago

Mmh, I'm not sure about this one. If I remember correctly we made the move to FSharp.Core 8 because @SchlenkR had other build issues with the dependency on 5. But you're right, the 14.0 release was bad because of the implicit dependency. That was my fuckup.

bartelink commented 4 months ago

But... it builds fine?

This scheme/policy is used in lots of places, e.g. Argu, github/jet

Ultimately, apps will typically have an implicit ref to the latest FSharp.Core, and are in a position to control that, and aside from not inducing risk by depending on a known broken/blacklisted thing like e.g. Newtonsoft < 13.0.3, it's just not something that a library should be dictating

Right now, people in the same boat as was (actually, a colleague) can fall victim to this. The remedies (aside from hoping they hit this via google) are one of:

go this road
unlist all the broken nugets (v12.1.0-v14.0.0)

SchlenkR commented 4 months ago

@bartelink I only had a look at the issue; not at your PR. You basically did the work I finished right now. Please excuse me for not merging your PR; I would have done it if I had seen it before.

Thank you so much for your PR and all the information. This is so valuable, since such topics usually cost nerves and energy. Great stuff - 🙏❤️

bartelink commented 4 months ago

Thanks @SchlenkR

One straggler piece is that the comments don't align with the PackageRef now, will make a PR

https://github.com/fsprojects/FsHttp/pull/184/files#diff-2c1498892796bdfa6445f171ee3c2c11cae3b082c3c6896cdb2d4e275bbda3ffR41-R48

This is not critical - you've already done all the important stuff, and it's much appreciated...