Service Fabric NuGet package references use exact version matching

[alexmg]

The Service Fabric NuGet packages such as Microsoft.ServiceFabric.Actors and Microsoft.ServiceFabric.Services are pinned to exact versions which is causing some headaches for consumers of the Autofac.ServiceFabric package as can be seen in issue autofac/Autofac.ServiceFabric/issues/18.

Autofac.ServiceFabric contains references to the following packages:

• Microsoft.ServiceFabric
• Microsoft.ServiceFabric.Actors
• Microsoft.ServiceFabric.Data
• Microsoft.ServiceFabric.Services

Due to the exact versions being specified in your packages the NU1608 warning and NU1107 error occur when attempting to upgrade a Service Fabric project to a version newer than the one the Autofac.ServiceFabric package was built against.

warning NU1608: Detected package version outside of dependency constraint: Microsoft.ServiceFabric.Services.Remoting 3.0.456 requires Microsoft.ServiceFabric.Services (= 3.0.456) but version Microsoft.ServiceFabric.Services 3.2.162 was resolved.
warning NU1608: Detected package version outside of dependency constraint: Microsoft.ServiceFabric.FabricTransport.Internal 3.0.456 requires Microsoft.ServiceFabric (= 6.1.456) but version Microsoft.ServiceFabric 6.3.162 was resolved.
error NU1107: Version conflict detected for Microsoft.ServiceFabric.Diagnostics.Internal. Reference the package directly from the project to resolve this issue. 
error NU1107:  Stateless1 -> Microsoft.ServiceFabric.Services 3.2.162 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.2.162) 
error NU1107:  Stateless1 -> Autofac.ServiceFabric 2.0.0 -> Microsoft.ServiceFabric.Actors 3.0.456 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.0.456).

It doesn't matter if a version range such as [3.1.274,4.0) is specified in the package references in Autofac.ServiceFabric. The only way to resolve the issue is to add all the packages to the Service Fabric project. For example, in a stateless service project you still need to add the Microsoft.ServiceFabric.Actors package even though it isn't required directly.

Is it possible to remove the exact version match in the Service Fabric packages? It seems like it was a conscious decision to pin the versions so I suspect there is likely a good reason for it. If the need no longer exists or could be worked around it would make working with your NuGet packages much easier.

[amanbha]

@alexmg SF team only support exact version match because of compatibility issues between different versions, In this case If a user is using Autofac, all the dependencies should come through Autofac as transitive dependencies. If they are also added explicitly as dependencies then nuget is showing this error, but nuget should not show this error because your package is specifying dependency as >=. I believe this only happens with new VS project system and not with the older project system. This seems like extra strict validation on part of nuget, could you please open an issue with https://github.com/NuGet/Home/issues

[ifle]

The Microsoft.ServiceFabric.Services (3.2.162) package
---- use Microsoft.ServiceFabric.Diagnostics.Internal (3.2.162)
Microsoft.ApplicationInsights.ServiceFabric.Native( 2.1.1)
---- use Microsoft.ServiceFabric.Services.Remoting (3.0.467)
---- ---- use Microsoft.ServiceFabric.Diagnostics.Internal (3.0.467)

How to resolve this issue?

[amanbha]

@ifle Are you using the new VS project system? Do you see it with older VS project system as well? It seems like a nuget behavior change.

[ifle]

Related to microsoft/ApplicationInsights-ServiceFabric#79

[Adebeer]

I find this quite annoying too. I can't use VS tooling to install/config app insights as Nuget fails to restore packages due to conflicts - which causes the tooling to abort the setup. As such, I basically have to resort to manually editing csproj and config files.

In my case, I've just created a brand new SF Core 2.1 stateless service in VS2017 15.8.8, Microsoft Azure Service Fabric Tools for VS 2.3 - so using latest tooling as far as I can tell.

C:\AlsSource\ANGen\Core\Src\Apps\ANGen.Core.Auth\Bootstrapper\Bootstrapper.csproj : warning NU1608: Detected package version outside of dependency constraint: Microsoft.ServiceFabric.Services.Remoting 3.2.162 requires Microsoft.ServiceFabric.Services (= 3.2.162) but version Microsoft.ServiceFabric.Services 3.2.187 was resolved.
C:\AlsSource\ANGen\Core\Src\Apps\ANGen.Core.Auth\Bootstrapper\Bootstrapper.csproj : warning NU1608: Detected package version outside of dependency constraint: Microsoft.ServiceFabric.Services.Remoting 3.2.162 requires Microsoft.ServiceFabric.Diagnostics.Internal (= 3.2.162) but version Microsoft.ServiceFabric.Diagnostics.Internal 3.2.187 was resolved.
C:\AlsSource\ANGen\Core\Src\Apps\ANGen.Core.Auth\Bootstrapper\Bootstrapper.csproj : warning NU1608: Detected package version outside of dependency constraint: Microsoft.ServiceFabric.FabricTransport.Internal 3.2.162 requires Microsoft.ServiceFabric (= 6.3.162) but version Microsoft.ServiceFabric 6.3.187 was resolved.
Bootstrapper -> C:\AlsSource\ANGen\Core\Src\Apps\ANGen.Core.Auth\Bootstrapper\bin\Debug\netcoreapp2.1\win7-x64\Bootstrapper.dll

These are my nuget packages I'm referencing:

<PackageReference Include="Microsoft.ApplicationInsights" Version="2.8.1" />
<PackageReference Include="Microsoft.ServiceFabric.Services" Version="3.2.187" />
<PackageReference Include="Microsoft.ServiceFabric.Diagnostics.Internal" Version="3.2.187" />
<PackageReference Include="Microsoft.ApplicationInsights.ServiceFabric.Native" Version="2.2.0" />

[DOliana]

Are there any news on this? The same applies when using Microsoft.ApplicationInsights.ServiceFabric.Native 2.2.2 in a SF Core 2.1 stateful service:

MyService -> Microsoft.ServiceFabric.Services 3.3.624 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.3.624) 
MyService -> Microsoft.ApplicationInsights.ServiceFabric.Native 2.2.2 -> Microsoft.ServiceFabric.Services.Remoting 3.2.162 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.2.162).

[kasturisameer]

Severity Code Description Project File Line Suppression State
Error NU1107 Version conflict detected for Microsoft.ServiceFabric.Diagnostics.Internal. Install/reference Microsoft.ServiceFabric.Diagnostics.Internal 3.3.638 directly to project Ecomm.Product to resolve this issue.
Ecomm.Product -> Microsoft.ServiceFabric.Services.Remoting 3.3.638 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.3.638)
Ecomm.Product -> Microsoft.ServiceFabric.Services 3.2.176 -> Microsoft.ServiceFabric.Diagnostics.Internal (= 3.2.176).

How to resolve this?

[esbenbach]

This is still a rather annoying issue, both when using AutoFac.ServiceFabric and Microsoft.ApplicationInsights.ServiceFabric.Native - it would seem reasonable to define at least "major" version boundary something like [4.0.0,5.0.0) or in case you introduce breaking changes in between, then at least do it for the refresh releases [4.1.0,4.2.0)

The refresh release variety should be the minimum while the major release variety would be preferable (and I get why you don't want to have it as a lower boundary only).