Aspnetcore: Version conflict with Microsoft.AspNet.WebApi.Client referenced in separate project

[jamieide]

Steps to reproduce:

• Create an empty solution
• Add an ASP.NET Core 2.1 MVC Project called WebApplication1
• Add a .NET Standard 2.0 class library called ApiClient
• Reference ApiClient from WebApplication1
• Install NuGet package Microsoft.AspNet.WebApi.Client in the ApiClient project
• Build and get error "NU1107 Version conflict detected for Microsoft.AspNet.WebApi.Client. Reference the package directly from the project to resolve this issue."
  WebApplication1 -> ApiClient -> Microsoft.AspNet.WebApi.Client (>= 5.2.6)
  Microsoft.AspNetCore.App 2.1.0 -> Microsoft.AspNet.WebApi.Client (= 5.2.4)

I'm able to work around this by downgrading WebApi.Client to 5.2.4 but that's not a good solution. It's not clear to me why WebApplication1 needs that reference at all or why it requires a specific version. To be honest I don't fully understand how the metadata packages work but my impression was that one of the benefits of the change from .All to .App was to reduce issues with dependencies on specific library versions.

[davidfowl]

/cc @DamianEdwards @natemcmaster

[davidfowl]

We're relaxing the version constraints in the next version of the .App package. The reason they exist today is 2 fold:

• To break the application when version are used outside of what the shared framework shipped with.
• To avoid hoisting pieces of your dependency graph that represent things that are in the shared framework. This leads to deploying more binaries with your application and upgrading out of the shared framework.

The negative is that you can't use newer versions of dependencies that may exist. This is usually mitigated by the fact that we ship a new metapackage when the things within in rev, but for some reason we have a newer version of Microsoft.AspNet.WebApi.Client on nuget than in our meta package.

[natemcmaster]

Thanks for reporting @jamieide. This is something we expect will be fixed soon when we release 2.1.1. We relaxed the version constraints in https://github.com/aspnet/Universe/pull/1186 and also updated the metapackage to Microsoft.AspNet.WebApi.Client 5.2.6 in https://github.com/aspnet/Universe/pull/1176. In the meantime, there isn't a really a good workaround except to suppress NU1707 errors manually by using NoWarn in your project.

[pbarranis]

For anyone reading this and needing to fix it in their project, I believe @natemcmaster had a typo in that last comment; I think it's not NU1707, it's NU1107. Please correct me if I'm wrong.

That said, I can't get the fix to work. I tried putting the NU1107 in the standard NoWarn area, like so:

<NoWarn>NU1107</NoWarn>

That didn't work. With lots of googling I found some indirect mentions that you can also put NoWarn right on the PackageReference (is this even documented?), like so:

<PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="2.1.0" NoWarn="NU1707" />

That didn't work. All of that said, this issue only occurs on the build server; I can't figure out how to repro it on my machine, even after doing dotnet nuget locals global-packages --clear and then letting VS restore all the packages again. The error I'm seeing is different from the OP but very similar, so I thought it was the same root issue:

The nuget command failed with exit code(1) and error(NU1107: Version conflict detected for Microsoft.AspNetCore.Antiforgery. Reference the package directly from the project to resolve this issue. Ahrma.Claims.Web -> Microsoft.AspNetCore.SpaServices.Extensions 2.1.0 -> Microsoft.AspNetCore.SpaServices 2.1.0 -> Microsoft.AspNetCore.Mvc.ViewFeatures 2.1.0 -> Microsoft.AspNetCore.Antiforgery (>= 2.1.0) Ahrma.Claims.Web -> Microsoft.AspNetCore.App 2.1.0-rc1-final -> Microsoft.AspNetCore.Antiforgery (= 2.1.0-rc1-final). Errors in D:\a\1\s\Source\Web\Web.csproj NU1107: Version conflict detected for Microsoft.AspNetCore.Antiforgery. Reference the package directly from the project to resolve this issue. Ahrma.Claims.Web -> Microsoft.AspNetCore.SpaServices.Extensions 2.1.0 -> Microsoft.AspNetCore.SpaServices 2.1.0 -> Microsoft.AspNetCore.Mvc.ViewFeatures 2.1.0 -> Microsoft.AspNetCore.Antiforgery (>= 2.1.0) Ahrma.Claims.Web -> Microsoft.AspNetCore.App 2.1.0-rc1-final -> Microsoft.AspNetCore.Antiforgery (= 2.1.0-rc1-final).)

Am I totally off-base thinking this is related? Can anyone point me in a helpful direction? Thank you.

[natemcmaster]

@pbarranis yes, it was a typo. The warning is code NU1107.

It looks like you're hitting this issue because you are using the 2.1.300 RC1 SDK. I recommend updating to the 2.1.300 SDK (https://aka.ms/DotNetCore21). This should resolve your issues with using Microsoft.AspNetCore.SpaServices.Extensions 2.1.0.

[pbarranis]

@natemcmaster You had me off on a wild goose chase for about 15 mins before it suddenly clicked... this issue is only occurring on the build server. I should have said this is on VSTS, not some on-prem build server. My builds run on the "Hosted VS2017" queue. If I'm reading this right, then they haven't installed the 2.1 runtime on their build agents yet: https://github.com/Microsoft/vsts-image-generation/blob/master/images/win/Vs2017-Server2016-Readme.md

Is there a workaround until those folks update their build agents? Go darken some doorways and glower at those lazy VSTS folks, would ya? 🤣 I guess my build will just have to be broken; hopefully not for long.

[natemcmaster]

@pbarranis try using the .NET Core Installer task. See https://docs.microsoft.com/en-us/vsts/pipelines/tasks/tool/dotnet-core-tool-installer?view=vsts. See also https://github.com/Microsoft/vsts-image-generation/issues/153#issuecomment-394197883. They plan to update in 2-3 days.

[pbarranis]

Wow, you're good! You even went back in time and got that done yesterday. The force is strong with this one 😉

[rksampath]

wow really it's working thank u so much @natemcmaster ..........

[meywd]

At last, I finally found this thread, after installing every dependency that throws an error and the restore task continuing to throw more errors, why do they not install the latest SDK/runtime on the hosted agents is beyond reason

[deanveggy]

thanks folks, solutions above helped. what worked for me was:

1. install .NET Core 2.1 SDK from https://www.microsoft.com/net/download
2. Using Visual Studio/Nuget manager, install
   a. Microsoft.AspNet.WebApi.Client
   then
   b. The Nuget package that previously would not install. (for me Swashbuckle).

[zhikoka]

Severity Code Description Project Path File Line Source Suppression State
Error Version conflict detected for Microsoft.AspNetCore.Antiforgery. Install/
reference Microsoft.AspNetCore.Antiforgery 2.1.1 directly to project to resolve this issue.
-> Microsoft.AspNetCore.SpaServices.Extensions 2.1.1 ->
Microsoft.AspNetCore.SpaServices 2.1.1 -> Microsoft.AspNetCore.Mvc.ViewFeatures 2.1.1 ->
Microsoft.AspNetCore.Antiforgery (>= 2.1.1)
-> Microsoft.AspNetCore.App 2.1.0 -> Microsoft.AspNetCore.Antiforgery (= 2.1.0).