Microsoft.AspNetCore.App - Versioning / Should it be referenced in non ASP.NET class libraries?

Question

I'm trying to work out the correct way of using the Microsoft.AspNetCore.App meta package.

Visual Studio on building reports that I shouldn't specify a version for the Microsoft.AspNetCore.App meta package.

<PackageReference Include="Microsoft.AspNetCore.App" Version="2.2.1" />

So I replace the above with:

<PackageReference Include="Microsoft.AspNetCore.App" />

The next issue is that any class library projects or packages that my project depends on that contain versioned references to packages that are also included in the Microsoft.AspNetCore.App metapackage break the build because there is a version conflict.

<PackageReference Include="Microsoft.Extensions.Configuration" Version="2.2.0" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1.1" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="2.1.1" />

So I remove the versions on these references too:

<PackageReference Include="Microsoft.Extensions.Configuration" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json"  />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />

Now when I run dotnet restore, I see a warning:

<Project> does not provide an inclusive lower bound for dependency 
Microsoft.Extensions.Configuration. An approximate best match of 
Microsoft.Extensions.Configuration 1.0.0 was resolved.

So now the app builds, but an old and possibly out of date package version is being resolved.

It seems like a bit of an overhead to maintain lower bound versions for all of these packages.

The path of least resistance seems like it might be to just reference the Microsoft.AspNetCore.App package (unversioned) in place of any packages that are contained within the meta package. But then I'm implicitly referencing a lot of unnecessary stuff (150 packages at present). I might want to reuse the class library in a project that is not web facing and so all of the referenced packages seem like inefficient bloat. Also, am I right in thinking that newer versions of Microsoft.AspNetCore.App could break my app when I build in the future?

Answer 1

I think you might want to observe the NuGet Version ranges and wildcards notation.

When referring to package dependencies, NuGet supports using interval notation for specifying version ranges, summarized as follows:

+-----------+---------------+-------------------------------------------------------+
| Notation  | Applied rule  |                      Description                      |
+-----------+---------------+-------------------------------------------------------+
| 1.0       | x ≥ 1.0       | Minimum version, inclusive                            |
| (1.0,)    | x > 1.0       | Minimum version, exclusive                            |
| [1.0]     | x == 1.0      | Exact version match                                   |
| (,1.0]    | x ≤ 1.0       | Maximum version, inclusive                            |
| (,1.0)    | x < 1.0       | Maximum version, exclusive                            |
| [1.0,2.0] | 1.0 ≤ x ≤ 2.0 | Exact range, inclusive                                |
| (1.0,2.0) | 1.0 < x < 2.0 | Exact range, exclusive                                |
| [1.0,2.0) | 1.0 ≤ x < 2.0 | Mixed inclusive minimum and exclusive maximum version |
| (1.0)     | invalid       | invalid                                               |
+-----------+---------------+-------------------------------------------------------+

So instead of removing the Version property altogether use a range or wildcard, eg:

Minimum version, inclusive

<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1" />

Ref: How to correct dotnet restore warning NU1604, does not contain an inclusive lower bound?

It takes some configuring and I hope Microsoft sort all this out in RTM 3.0 with a wizard to update the dependency tree... Here's a project from 6 months ago it contains a reference to Microsoft.AspNetCORE.Mvc:

Here's a project I'm working on and I had to explicitly reference certain packages (to get ActionResults I had to add 2 specific references.):

Using the NuGet notation allows finely grained libraries when you need it, or future-proof modularity with range/wildcard API updates or you can reference the full kit and caboodle.