Build error NU1605 "Detected package downgrade" while adding a netstandart13 library

[evil-shrike]

Given a project which targets netcoreapp2.0. And a package which targets netstandard13 - Devart.Data.PostgreSql (ado.net provider for Postgres).

Installing in VS

The package cannot be installed in VS2017.3. It silently fails.

Installing via cli

dotnet add package Devart.Data.PostgreSql

installs the package, but build fails (it's only a excerpt from full output):

D:\Work\Learn\dotnet\devart_pgsql>dotnet build
D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.csproj : error NU1605: Detected package downgrade: System.Net.Primitives from 4.3.0 to 4.0.11. Reference the package directly from the project to select a different version. \r [D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.sln]
D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.csproj : error NU1605:  devart_pgsql (>= 1.0.0) -> Devart.Data.PostgreSql (>= 7.9.958) -> NETStandard.Library (>= 1.6.1) -> System.Net.Primitives (>= 4.3.0) \r [D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.sln]
D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.csproj : error NU1605:  devart_pgsql (>= 1.0.0) -> Devart.Data.PostgreSql (>= 7.9.958) -> System.Net.Primitives (>= 4.0.11) [D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.sln]
D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.csproj : error NU1605: Detected package downgrade: System.Reflection from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. \r [D:\Work\Learn\dotnet\devart_pgsql\devart_pgsql.sln]

Here's the dependencies of the package:

    <dependencies>
      <group targetFramework=".NETStandard1.3">
        <dependency id="Microsoft.Extensions.PlatformAbstractions" version="1.0.0" />
        <dependency id="Microsoft.NETCore.Portable.Compatibility" version="1.0.1" />
        <dependency id="Microsoft.Win32.Registry" version="4.0.0" />
        <dependency id="NETStandard.Library" version="1.6.1" />
        <dependency id="System.ComponentModel" version="4.3.0" />
        <dependency id="System.ComponentModel.Annotations" version="4.1.0" />
        <dependency id="System.ComponentModel.Primitives" version="4.1.0" />
        <dependency id="System.ComponentModel.TypeConverter" version="4.1.0" />
        <dependency id="System.Diagnostics.FileVersionInfo" version="4.0.0" />
        <dependency id="System.Net.NameResolution" version="4.0.0" />
        <dependency id="System.Net.Primitives" version="4.0.11" />
        <dependency id="System.Net.Requests" version="4.0.11" />
        <dependency id="System.Reflection" version="4.1.0" />
        <dependency id="System.Runtime.InteropServices.RuntimeInformation" version="4.0.0" />
        <dependency id="System.Security.Cryptography.Algorithms" version="4.2.0" />
        <dependency id="System.Security.Cryptography.Csp" version="4.0.0" />
        <dependency id="System.Threading.ThreadPool" version="4.0.10" />
        <dependency id="System.Xml.XmlDocument" version="4.0.1" />
        <dependency id="Devart.Data" version="5.0.1750" />
      </group>
    </dependencies>

I managed to workaround the issue by adding the following package references into csproj:

    <PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
    <PackageReference Include="System.Net.NameResolution" Version="4.3.0" />
    <PackageReference Include="System.Net.Primitives" Version="4.3.0" />
    <PackageReference Include="System.Reflection" Version="4.3.0" />
    <PackageReference Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
    <PackageReference Include="System.Security.Cryptography.Algorithms" Version="4.3.0" />
    <PackageReference Include="System.Security.Cryptography.Csp" Version="4.3.0" />

After that the project builds and runs successfully. But only for netcoreapp2.0.
If I build and run it for net462:

    <TargetFrameworks>netcoreapp2.0;net462</TargetFrameworks>

it fails:

Error Message:
 System.IO.FileNotFoundException : Could not load file or assembly 'System.Security.Principal.Windows, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.

So for net462 I added:

  <ItemGroup Condition="'$(TargetFramework)' == 'net462'">
    <PackageReference Include="System.Security.Principal.Windows" Version="4.3.0" />
  </ItemGroup>

After that it builds and runs on net462 too.

But I think it's too cumbersome. Also it requires manual csproj editing and does not work via VS Package Manager out of the box. So I believe it's not a normal situation.

P.S. I really have no idea where such an issue should be reported, so please feel free to move it to an appropriate repo.

[Petermarcu]

@ericstj can you give any guidance here?

[ericstj]

Firstly, It seems NuGet made a breaking change around downgrades warnings in the latest release see NuGet/Home#5594. @emgarten

Secondly, Devart.Data.PostgreSql does downgrade that package so NU1605 is correct. To get rid of that by default the package owner needs to remove the downgrade. I'd recommend an issue in that owning package's repository to get this fixed.

Your workaround of directly referencing the higher versions is appropriate to undo the downgrade.

Now finally, the missing dependency. If I examine the dependencies of the library you installed I see the following:

Devart.Data.PostgreSql, 7.9.958.0
        Missing: System.Security.Principal.Windows, 4.0.0.0
        Missing: System.Security.Claims, 4.0.1.0

Just to be certain those weren't previously coming from packages, I ran the test both with the downgrade workaround and with <NoWarn>$(NoWarn);NU1605</NoWarn>. In both cases these were missing.

So it would seem that Devart.Data.PostgreSql built against these two assemblies (via packages) but didn't include them in their nuspec as dependencies. Again for this one I'd file an issue on DevArt.PostgreSql.

[emgarten]

You can also work around this by clearing WarningsAsErrors in your project. By default netcoreapp2.0 projects have <WarningsAsErrors>NU1605</WarningsAsErrors>.

[Petermarcu]

Sounds like this one is "resolved" in that there is a workaround and the issue is in an external project. Closing.

[KshitizGIT]

@emgarten - How do we clear the
<WarningsAsErrors>NU1605</WarningsAsErrors>.

???

[emgarten]

@KshitizGIT try <NoWarn>NU1605</NoWarn>

[loop-evgeny]

I've also been getting errors like this since upgrading MathNet.Numerics.FSharp from 4.0.0-beta2 to 4.1.0:

9>FSharpModules.fsproj : warning NU1605: Detected package downgrade: FSharp.Core from 4.3.3 to 4.2.3. Reference the package directly from the project to select a different version.
9>FSharpModules.fsproj : warning NU1605: FSharpModules -> MathNet.Numerics.FSharp 4.1.0 -> FSharp.Core (>= 4.3.3)
9>FSharpModules.fsproj : warning NU1605: FSharpModules -> FSharp.Core (>= 4.2.0)

The really bizarre thing was that my project referenced neither of the mentioned versions. It had

<PackageReference Include="FSharp.Core" Version="4.3.4" />

The fix was to add

<FSharpCoreImplicitPackageVersion>4.3.*</FSharpCoreImplicitPackageVersion>

to all F# projects in my solution.

It works now, but how ON EARTH is the user supposed to know they need to add that?! 2 developers wasted at least 4 hours on this.

[ericstj]

@KevinRansom looks like the FSharp targets need something like @dsplaisted added to dotnet SDK around honoring the project over the implicit package. https://github.com/dotnet/sdk/blob/a0ba16704bb83054dc7cdda2fc0f7628a1c0935f/src/Tasks/Microsoft.NET.Build.Tasks/build/Microsoft.NET.Sdk.DefaultItems.targets#L192-L210. @loop-evgeny you may want to file this over in https://github.com/Microsoft/visualfsharp if you think there isn't an existing issue covering it.