Bug: Azure DevOps Artifact Feed set wrong Package Dependencies

Question

We use our private Artifacts Feed on Azure DevOps Server 2020.1 (on-prem). I get a feed MyFeed and a feed MyFeedTest. I use the MyFeedTest for Staging our NuGet Packages. When they are stable, they get pushed to MyFeed. If a NuGet package in the feed has a dependency on another NuGet package in the feed, I use the following line:

<PackageReference Include="ext.lib.MyPackage" Version="*" />

The issue here is that the Azure DevOps Server determines the dependency by itself, and it takes the Versions from the staging package in MyFeedTest for the packages in MyFeed even when the package MyFeedTest get unlist, even when the whole feed MyFeedTest get deleted.

The Azure DevOps Artifact should not determine the dependencies to another package by itself, and it should not ignore the defined dependency setting inside the package project file (Version="*").

In the end, my collogues get the following error in Visual Studio:

The Dependencies of the Package ext.lib.MyPackage on Azure DevOps Server looks like:

But to remember, the package ext.lib.DevExpress in Version 13.1.5.3 do not exist after deleting the whole feed MyTestFeed.

So how can I solve that? Is it possible to configure the Azure DevOps Server to not behave like this? We can't use staging with that mechanism.

The Dependencies of the package is determined by the package reference. Azure Artifacts does not automatically add or remove dependencies. If you don't need ext.lib.DevExpress as dependencies any more, you need to remove this package reference in your ext.lib.MyPackage and publish again. — Walter
@WalterQian-MSFT thanks for your reply. We never defined a dependency to the version 13.1.5.3. We defined Include="ext.lib.DevExpress" Version="*" which is what we want. The Azure Artifacts set the dependency to ext.lib.DevExpress (≥ 13.1.5.3) for the ext.lib.MyPackage package by it self, what we don't want. Even after deleting the feed, where ext.lib.DevExpress 14.1.5.3 was located, the Azure Artifacts keep the wrong dependency to ext.lib.DevExpress (≥ 13.1.5.3), what we realy don't want. Artifacts convert * to explicit versions, which is not correct and should be fixed. — Mar Tin

Walter Walter · Accepted Answer · 2021-01-25T08:02:56

The issue here is that the Azure DevOps Server determines the dependency by itself

This is not determined by Azure DevOps Server, but resolved by NuGet. Version="*" means the highest stable version. Here is the document about Floating version resolutions. I used dotnet CLI to create NuGet package. Here is my sample:

1.Add package reference in the "*.csproj" file.

<ItemGroup>
  <PackageReference Include="ext.lib.MyPackage" Version="*" />
</ItemGroup>

2.Use dotnet pack command to build a NuGet package. This will generate a "*.nupkg" file. Change the suffix of this file to zip and extract files.

3.We can find a "*.nuspec" file. Open this file with Notepad, we can find the following content:

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
  <metadata>
    <id>ext.lib.DevExpress</id>
    <version>3.2.1</version>
    <authors>ext.lib.DevExpress</authors>
    <requireLicenseAcceptance>false</requireLicenseAcceptance>
    <description>Package Description</description>
    <dependencies>
      <group targetFramework="net5.0">
        <dependency id="ext.lib.MyPackage" version="1.2.3" exclude="Build,Analyzers" />
      </group>
    </dependencies>
  </metadata>
</package>

So we can find that before this package is pushed to Azure DevOps, the dependencies of the package have been resolved to explicit versions and this is the expected behavior.

If you don't need ext.lib.DevExpress as dependencies any more, you need to remove this package reference in your ext.lib.MyPackage and push your package again.

Bug: Azure DevOps Artifact Feed set wrong Package Dependencies

1 Answers