What is Microsoft.DependencyValidation.Analyser and why does Visual Studio 2017 force install the package?

Question

I just installed Visual Studio 2017 (on a fresh Windows 10 VM) in preparation for an upgrade path form 2015. Our existing project uses .Net 4.5.2. (ASP.NET classic/not Core)

VS 2017 seems to insist upon adding Microsoft.DependencyValidation.Analyser package dependency to every project in my current solution.

What is this dependency? Why is is forced into the projects? Undo checkout doesn't help it just goes right back and adds it again. If I check in the package.config files with the change will it break VS2015 assuming team members have not done any updates?

Answer 1

Well, turns out Visual Studio's dark UI patterns have jumped the shark.

The following is a highly dramatized version of how Microsoft.DependencyValidation.Analyzer gets installed magically... well nearly magically. (Also has answers to my questions above).

On a fresh virtual machine you have just downloaded your solution from source control and fired it up for the first time, you expect Nuget to warn you that dependencies will need to be reloaded. So you speed read through the messages that come up on VS 2017, hey you have been using it for 20 years you expect them to keep improving right, they've got your back? Well from the corner of your eyes you see the word 'Dependency' and 'updated' highlighted in yellow on top of solution manager.

What do you do? Click Update (thinking your Nuget packages are getting downloaded... sucker!!!) BOOM!

After 30 minutes all your 63 projects have been checked out and they seem to have the same package.config change.

You go WUT. Try to undo checkout... sorry mate VS has got you(r back)... it reverts code, reloads project and adds the dependency back again).

You first don't realize what's going on. You rage, you rant you redo the same things for an hour and finally you throw your laptop out of the window in the middle of the night and sob bitterly.

After a while you slowly get up and bring the laptop back and through the cracked screen you decide to close visual studio, reopen it, and try another branch of your code.

This time you read the little yellow label more carefully and get suspicious so you don't click the Update button. You click on the link that takes you to a generic page where you have to use Bing err Ctrl+F to lookup the topic which is simply a generic blog post. Still, everything builds fine. And then it dawns what happened. Shivering, thanks to the cold draft from the broken window, but ecstatic that you have 'fixed' it, you toss everything up in the air and call it a night.

Next day morning, you start Visual Studio again. You don't load any of the solutions. You open Source Control Explorer instead, undo checkout everything and hurray, everything is reverted, no more nagging changes to your solution.

Happy and crying (joy of success or grief of the cracked screen and guts spilling out of the laptop) you open your solution and WHAM! That freaky little yellow warning is back again... You stand there bewildered... you are screaming... in your head... why-o-why? I have a 3 member dev team, I can literally walk up to someone and tell them matey you shouldn't add that reference because it breaks an esoteric pattern. But no... I have paid gazillion pounds for MSDN license hence my 'Enterprise' software will insist on doing something that's going to

• break everything for everyone else in the team (VS2017 Dependency voodoo is different from VS2015 version)
• slow down your VM to a crawl (it literally ran out of memory and crashed twice, just trying to build).
• and give me more error message than I care for. I actually don't look at the error panel anymore because I can't tell if Visual Studio is being serious about an error or just yanking my chains because the app seems to work (Yay Razor syntax checking!!!)

At this point you are just weeping... and you don't know why...

RANT END

If anyone from Visual Studio has read till here, this is what I want from Visual Studio (20 years on)

1. Fast load (yes I have 63 projects in my solution and I want them loading fast, NO I will not split them up into different solutions)
2. Fast compile (C# and Typescript is what I use, but you get it) I have a gazillion GBs of memory, use it!
3. Consistent Intellisense (auto complete, maybe take a leaf out of VSCode?) Anything else that takes a fraction of second extra is ruining my productivity and I DO NOT want it turned on, so please get out of my way!

It's been 20 years right, I guess I shouldn't be holding my breath!

P.S. I did manage to track down a setting to disable that warning, but I think the folks who implemented the property forgot to tell the folks in the other building doing the solution Explorer, so it doesn't work.

Answer 2

If you have a data access project which is supposed to be totally agnostic of data persistence frameworks such as Entity Framework, or ADO.NET or other technologies out there, how do you make sure not even a single line of code has been written which depends on those dependencies? You can write interfaces so it is totally agnostic but how do you stop a developer from adding a reference to ADO.NET?

That is what Microsoft.DependencyValidation.Analyser will do for you. When you build it will analyse all the projects and ensure it does not depend on assemblies that were prescribed by you.

This ensures your architecture is not just a pretty diagram but your developers actually follow it. This is not limited to ADO.NET and other major assemblies but even assemblies that you build yourself.

You can tell Visual Studio to either give a warning when the architecture is broken or to fail compilation.

This is nothing new and has been out there but I guess VS 2017 is making it easier to enforce such rules. Whether this is a good idea or not, depends on the project. If I am writing a quick one-off application or POC then I would turn it off. But for a project which will require months of development and months to years of maintenance, it can be very useful. However, some may disagree with me. The important take away is that it is there as a tool if we need it.

More info here