New version posted breaks dependent packages

Jun 26, 2011 at 4:28 PM
Edited Jun 26, 2011 at 4:49 PM

JsonFx has been up on NuGet gallery for a few months now: http://nuget.org/List/Packages/JsonFx

Yesterday, I posted a bug fix build, rev'd the version (v2.0 => v2.0.1106.2515), posted multiple framework targets (.NET 2/3.5/4, SL 3.5/4, WP7), and posted strongly signed assemblies (rather than a standard release assembly).

Today, people who were using NuGet to get v2.0 say that "it's failing cause of version number" and that they "had to update all [their] packages to [mine]" because "at runtime it was trying to bind to JsonFx v2.0 as opposed to the version included."

 

What did I do wrong? If it really is just the version number, that seems quite silly as the whole point is to avoid having to hunt for updates.

Jun 26, 2011 at 4:36 PM

What do you mean by 'people who were using NuGet to get v2.0':

  1. Users who installed it in their app using NuGet or
  2. Package authors who took a dependency on it

Can you give a specific example of a scenario that became broken?

Jun 26, 2011 at 4:42 PM

I believe this package needed to be updated: http://nuget.org/List/Packages/EasyHttp

As for the other, that was my assumption but waiting on a response to confirm.

Jun 26, 2011 at 5:08 PM

Normally, this issue is taken care of by the binding redirects that NuGet generates. However, it sounds like you went from v2.0 that was not signed at all, to v2.0.1106.2515 that was signed. If so, binding redirects can't be used, as they're essentially unrelated assemblies from the CLR stand point.

So the mistake here was to only give a build/revision bump to the package version for what is essentially a complete breaking change. If the new version had been say 2.1.xxx, that other package would not have been broken as its dependency would not have been automatically moved up to it (it would have kept using the old one that it was built against).

Jun 26, 2011 at 5:14 PM

Just to clarify, this is a signed vs. unsigned issue? Since the original uploaded accidentally wasn't the signed version, it couldn't auto-resolve? In theory, if I post a v2.0.1106.2610, it should all work?

I'm more or less following http://semver.org rules and this was a bug fix patch not an API breaking change so the version didn't justify a v2.1.xxxx.xxxx.

Jun 26, 2011 at 5:23 PM

Yes, I think it's a signed/unsigned issue. Posting a v2.0.1106.2610 should all work, although NuGet will generate Binding Redirects for it (which is fine).

Jun 26, 2011 at 5:26 PM

Okay, I think I'll test it out just to make sure I understand version implications.

If that doesn't work, sounds like the only choice would be to rev the minor version number (which is semantically incorrect) and require manual update of all dependencies in order to see change.

Jun 26, 2011 at 6:04 PM

It was my packages (namely EasyHttp and consequently YouTrackSharp which depends on EasyHttp). I was getting runtime binding mismatch. If it's the signed vs unsigned issued I'll update again and check.

Jun 27, 2011 at 1:54 AM

Ok, please let us know once you confirm that was the issue.

Jun 28, 2011 at 8:18 PM

David, not sure if this was meant to add automatic redirecting to the app.config, but I can confirm it does not. All you get is a warning:

 

------ Rebuild All started: Project: yt, Configuration: Debug x86 ------
  Consider app.config remapping of assembly "JsonFx, Culture=neutral, PublicKeyToken=315052dd637f8a52" from Version "2.0.1106.2515" [] to Version "2.0.1106.2610" JsonFx.dll to solve conflict and get rid of warning.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets(1360,9): warning MSB3247: Found conflicts between different versions of the same dependent assembly.

========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========

Jun 28, 2011 at 8:30 PM

We've solved this currently by supplying the full version number in my EasyHttp package that depends on JsonFx. Curious though what will happen on the next update.

Jun 28, 2011 at 10:42 PM

Looking at that warning message, it implies that next time we will have the same issues. That warning is about remapping from 2.0.1106.2515 to 2.0.1106.2610 which are both strongly signed assemblies.

David, is this a potential bug in NuGet's Binding Redirects? Or is this NuGet's Binding Redirect working but just leaving a warning that it did so?

Jun 28, 2011 at 11:21 PM

I'm not sure I'm understanding exactly what scenario you guys are trying here. The nuget feature is that at the time you install a package into a web app, nuget should be adding binding redirects if if finds that it is necessary. If you give me concrete repro steps that lead to a broken situation, we will investigate it. e.g.

  • Install some package
  • Install some other package
  • Run the app and find that it is broken, in a case where a binding redirect could have made it worked.
Jun 29, 2011 at 3:14 AM

David,

EasyHttp uses JsonFx.

YouTrackSharp uses EasyHttp.

Create a console app. Install-Package YouTrackSharp. Warning message appears. The bindings are not added automatically to app.config. You mention web app, not sure if that's just an example or that this scenario of adding binding redirects only works for web apps.

Jun 29, 2011 at 3:58 AM

Hmmm, I'm not seeing this. When I install YouTrackSharp, I end up with these packages:

  •   <package id="JsonFx" version="2.0.1106.2610" />
  •   <package id="structuremap" version="2.6.2" />
  •   <package id="EasyHttp" version="1.0.6" />
  •   <package id="YouTrackSharp" version="1.0.8" />

Both YouTrackSharp and EasyHttp are built against JSonFX 2.0.1106.2610, so there is no need for any binding redirects since that's what got installed.

Am I missing something here?

Jun 29, 2011 at 4:08 AM
Edited Jun 29, 2011 at 4:09 AM

There shouldn't be now since I had to update all packages, so it should all work. However, prior to that, it would cause an issue. Last night I updated the packages. Sorry I should have pointed out in the previous message that this wouldn't now be reproducible. I was more specifying the issue that was happening.


What both Stephen and I wonder is, when he makes a new update, will this happen again (and whether this issue is limited to signed assemblies)

Jun 29, 2011 at 4:11 AM

Can you please give me the exact version of the packages I should be installing in order to repro this? Or did you remove them from nuget.org?

Jun 29, 2011 at 4:17 AM

I just reproduced it with version 1.0.5 of YouTrackSharp. This is with a console app.

Jun 29, 2011 at 4:31 AM

When I do this in a Console app, the binding redirect successfully gets added to app.config:

  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="JsonFx" publicKeyToken="315052dd637f8a52" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.0.1106.2610" newVersion="2.0.1106.2610" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

In your case, app.config doesn't get modified? Are you running nuget 1.4?

Jun 29, 2011 at 4:35 AM
Edited Jun 29, 2011 at 4:40 AM

Also, try explicitly calling Add-BindingRedirect, which should display this:

 

PM> Add-BindingRedirect

Name                                     OldVersion                                                                                                   NewVersion 
----                                     ----------                                                                                                   ---------- 
JsonFx                                   0.0.0.0-2.0.1106.2610                                                                                        2.0.1106.2610 
Jun 29, 2011 at 4:55 AM
davidebbo wrote:

When I do this in a Console app, the binding redirect successfully gets added to app.config:

 

  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="JsonFx" publicKeyToken="315052dd637f8a52" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.0.1106.2610" newVersion="2.0.1106.2610" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

In your case, app.config doesn't get modified? Are you running nuget 1.4?

 

Running NuGet Version: 1.4.20615.182. I don't get that happening though.

Jun 29, 2011 at 4:59 AM
Edited Jun 29, 2011 at 5:00 AM
davidebbo wrote:

Also, try explicitly calling Add-BindingRedirect, which should display this:

 

PM> Add-BindingRedirect

Name                                     OldVersion                                                                                                   NewVersion 
----                                     ----------                                                                                                   ---------- 
JsonFx                                   0.0.0.0-2.0.1106.2610                                                                                        2.0.1106.2610 

 

Doesn't do anything when I run that. Also, I've just noticed another issue. If I uninstall the package, the dependencies are not removed.

Developer
Jun 29, 2011 at 5:00 AM

That's by design, you need to use the -RemoveDependencies flag to remove dependencies.

Jun 29, 2011 at 5:02 AM
dfowler wrote:

That's by design, you need to use the -RemoveDependencies flag to remove dependencies.

Really? Why is that? In case other packages are using the same dependencies? Couldn't that somehow be detected? Just strange that when you uninstall, you undo all changes (including transformations), yet dependencies remain.

Jun 29, 2011 at 5:04 AM

I suggest we keep the focus on the binding redirect issue to avoid confusing this thread in an unrelated direction :)

Are you trying this from a fresh clean console app? How are you installing the package? I'm using "Install-Package YouTrackSharp -Version 1.0.5"

Jun 29, 2011 at 5:06 AM
davidebbo wrote:

I suggest we keep the focus on the binding redirect issue to avoid confusing this thread in an unrelated direction :)

Are you trying this from a fresh clean console app? How are you installing the package? I'm using "Install-Package YouTrackSharp -Version 1.0.5"

+1 on focus, although I'll search or start another thread cause that's also interesting :)


Yes. New Console App. And using that exact command. Are you adding an App.config file manually? I've tried either way. No luck.

Jun 29, 2011 at 5:14 AM

No, the app.config gets added by NuGet.

I have to say I'm out of ideas here. Can some other folks try this as well to see what you get?

  • Launch VS
  • Create new Console app
  • In nuget console, run "Install-Package YouTrackSharp -Version 1.0.5"
  • Check whether an app.config got created with binding redirects

One last random guess: are you running any extensions that might somehow affect this? If so, can you try disabling them just to test if it makes a difference? #tryingtoblameresharper! ;)

Developer
Jun 29, 2011 at 5:24 AM

I just tried it and got this in my app.config:

 

<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="JsonFx" publicKeyToken="315052dd637f8a52" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.0.1106.2610" newVersion="2.0.1106.2610" />
      </dependentAssembly>
    </assemblyBinding>

Jun 29, 2011 at 5:24 AM
davidebbo wrote:

No, the app.config gets added by NuGet.

I have to say I'm out of ideas here. Can some other folks try this as well to see what you get?

  • Launch VS
  • Create new Console app
  • In nuget console, run "Install-Package YouTrackSharp -Version 1.0.5"
  • Check whether an app.config got created with binding redirects

One last random guess: are you running any extensions that might somehow affect this? If so, can you try disabling them just to test if it makes a difference? #tryingtoblameresharper! ;)

Sure, when all else fails, let's blame ReSharper :). Which btw, you should be running..... :).

I'll disable it just for S&G and see.... but highly doubt it. Other than R#, I have no extensions.

Jun 29, 2011 at 5:30 AM

Nope. No difference. Btw, I just ran it again (before disabling R# and also after), and the App.Config file is not even created. Creating it manually doesn't solve the issue of adding the redirects either.

Jun 29, 2011 at 5:36 AM

Well, that's mighty puzzling. :) I'm running VS Ultimate SP1 in case it matters, but it really shouldn't.

Let's see what others are seeing just to get more data points.

Jun 29, 2011 at 5:37 AM

OK I guess my system is screwed up then. Other than re-install, if you have any suggestions or ideas of how to solve it, let me know.

 

Thanks.

Jun 29, 2011 at 5:41 AM

It's hard to imagine how it could be screwed up in a way that installing packages generally works fine but that only the binding redirect behavior is busted.

Can you email me your zipped console app, just in case there is some tricky difference there? david.ebbo AT ms.

Jun 29, 2011 at 11:44 AM

The steps David posted work as expected for me.

PM> Install-Package YouTrackSharp -Version 1.0.5
Attempting to resolve dependency 'EasyHttp (≥ 1.0.5)'.
Attempting to resolve dependency 'JsonFx (≥ 2.0.1106.2610)'.
Attempting to resolve dependency 'StructureMap (≥ 2.6.2)'.
You are downloading JsonFx from Stephen McKamey, the license agreement to which is available at https://raw.github.com/jsonfx/jsonfx/master/LICENSE.txt. Check the package for additional dependencies, which may come with their own license agreement(s). Your use of the package and dependencies constitutes your acceptance of their license agreements. If you do not accept the license agreement(s), then delete the relevant components from your device.
Successfully installed 'JsonFx 2.0.1106.2610'.
Successfully installed 'structuremap 2.6.2'.
You are downloading EasyHttp from Hadi Hariri, the license agreement to which is available at https://github.com/hhariri/EasyHttp/blob/master/LICENSE.TXT. Check the package for additional dependencies, which may come with their own license agreement(s). Your use of the package and dependencies constitutes your acceptance of their license agreements. If you do not accept the license agreement(s), then delete the relevant components from your device.
Successfully installed 'EasyHttp 1.0.6'.
You are downloading YouTrackSharp from Hadi Hariri, the license agreement to which is available at https://github.com/hhariri/YouTrackSharp/blob/master/LICENSE.TXT. Check the package for additional dependencies, which may come with their own license agreement(s). Your use of the package and dependencies constitutes your acceptance of their license agreements. If you do not accept the license agreement(s), then delete the relevant components from your device.
Successfully installed 'YouTrackSharp 1.0.5'.
Successfully added 'JsonFx 2.0.1106.2610' to ConsoleApplication3.
Successfully added 'structuremap 2.6.2' to ConsoleApplication3.
Successfully added 'EasyHttp 1.0.6' to ConsoleApplication3.
Successfully added 'YouTrackSharp 1.0.5' to ConsoleApplication3.
 
PM> 

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="JsonFx" publicKeyToken="315052dd637f8a52" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.0.1106.2610" newVersion="2.0.1106.2610" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>
Jun 29, 2011 at 3:21 PM

@jsneholland is reporting a similar issue on twitter. In his case, installing the structuremap, and then SolrNet.StructureMap does not add redirects, while for me it does:

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="StructureMap" publicKeyToken="e60ad81abae3c223" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.6.2.0" newVersion="2.6.2.0" />
      </dependentAssembly>
    </assemblyBinding>

Clearly there is a bug somewhere that causes it to not work for some. Some debugging might be needed :)

Jun 29, 2011 at 4:46 PM

Following those exact steps worked for me as .NET 2.0 and .NET 4.0. What is interesting though, is that it automatically updated to EasyHttp.1.0.6. What are the chances that the exact bug we're talking about isn't showing because v1.0.6 references the latest JsonFx?

Perhaps there are differences in the various editions of VS2010? I've noticed over the years that when devs on a team have slightly different versions that reported version numbers will oscillate in generated code. Perhaps trying to find a pattern with those who work/don't work by full version number of Visual Studio?

From the about dialog, my edition is reporting VS2010 Ultimate v10.0.300319.1 RTMRel, and NuGet 1.4.20615.9020.

In the csproj source I see: <ProductVersion>8.0.30703</ProductVersion>. I was expecting to see a v10.0.xxxx here.

Jun 29, 2011 at 5:10 PM

@mckamey:

  • it's normal that it moves up to EasyHttp 1.0.6 (see this post).
  • The fact that the ProductVersion is 8.* is strange, but apparently it's a known issue, and most likely harmless
  • Only 'bad' thing is that you should now be running SP1 instead of RTM. Install it from here
Jun 29, 2011 at 5:13 PM

@davidebbo agreed, but this is just a single data point of a working example. Now you know it works without SP1. :) The question is what is the difference in the configurations that aren't working.

Jun 29, 2011 at 5:15 PM

@mckamey: definitely, it's good to have eliminated RTM vs SP1 as a possible cause.