Nuget package dependencies. Does it work the way i

2019-08-02 17:14发布

问题:

RavenDb latest version is installed as a nuget package. It references Newtonsoft.Json 4.0.2. I'm trying to install TweetSharp. I get this log:

M> Install-Package TweetSharp
Attempting to resolve dependency 'Hammock (≥ 1.2.3)'.
Attempting to resolve dependency 'Newtonsoft.Json (≥ 4.0.1)'.
Successfully installed 'Hammock 1.2.6'.
Successfully installed 'Newtonsoft.Json 4.0.3'.
Successfully installed 'TweetSharp 2.0.8'.
Install failed. Rolling back...
Install-Package : Updating 'Newtonsoft.Json 4.0.2' to 'Newtonsoft.Json 4.0.3'
   failed. Unable to find a version of 'RavenDB-Embedded' that is compatible with
   'Newtonsoft.Json 4.0.3'.

As you can see, even if TweetSharp just needs 'Newtonsoft.Json (≥ 4.0.1)', nuget wants to install version 4.0.3 which can not work with RavenDb.

I tried to install previous versions of TweetSharp but it does not change anything.

Any way to circumvent this?

回答1:

Sounds like a possible bug in NuGet. Please log an issue in the NuGet bug tracker: http://nuget.codeplex.com/workitem/list/basic

If TweetSharp is fine with NewtonSoft.Json 4.0.2, then the install should not have failed. In your bug, can you post the exact versions that caused this problem. For example:

List of installed packages with exact version installed. List of dependencies for each package and the specific version range they specify. And the exact version of TweetSharp you're trying to install. That'll help us look at the issue more quickly. Thanks!

My guess is we have some default logic that tries to upgrade packages to the latest bug fix release. In this case, we tried that, but it causes another dependency to fail. In that case, we should have known that and not tried to upgrade.



回答2:

This is down to the semantic versioning that NuGet has had since (I think) 1.6. It's explained in more detail here but the basic idea is that if your dependency hasn't updated either the major or the minor revision number then they'll assume that it's a bugfix and not a breaking change.

So in this case the decision to install 4.0.3 instead of 4.0.1 was made.

You can run install-package with -ignoredependencies I would have thought that if you'd had 4.0.2 installed it wouldn't try to update you (because 4.0.2 satisfies the dependency).