Skip to content

Fix warnings about Microsoft.CodeAnalysis.Workspaces.Common and Microsoft.CodeAnalysis.Common versions#2295

Merged
jeremydmiller merged 5 commits intoJasperFx:mainfrom
dmytro-pryvedeniuk:fix-some-build-warnings
Mar 12, 2026
Merged

Fix warnings about Microsoft.CodeAnalysis.Workspaces.Common and Microsoft.CodeAnalysis.Common versions#2295
jeremydmiller merged 5 commits intoJasperFx:mainfrom
dmytro-pryvedeniuk:fix-some-build-warnings

Conversation

@dmytro-pryvedeniuk
Copy link
Contributor

This PR fixes warnings about version conflict produced by dotnet restore partially shown below. It's interesting that Wolverine is mentioned in this issue dotnet/efcore#35143.

warning NU1608: Detected package version outside of dependency constraint: Microsoft.CodeAnalysis.Workspaces.MSBuild 4.8.0 requires Microsoft.CodeAnalysis.Common (= 4.8.0) but version Microsoft.CodeAnalysis.Common 4.14.0 was resolved.
warning NU1608: Detected package version outside of dependency constraint: Microsoft.CodeAnalysis.Workspaces.MSBuild 4.8.0 requires Microsoft.CodeAnalysis.Workspaces.Common (= 4.8.0) but version Microsoft.CodeAnalysis.Workspaces.Common 4.14.0 was resolved.
warning NU1608: Detected package version outside of dependency constraint: Microsoft.CodeAnalysis.Workspaces.MSBuild 4.14.0 requires Microsoft.CodeAnalysis.Workspaces.Common (= 4.14.0) but version Microsoft.CodeAnalysis.Workspaces.Common 5.0.0 was resolved.

These warnings are caused by dependencies of Microsoft.EntityFrameworkCore.Design and JasperFx.RuntimeCompiler (see below, note using of the pinned versions for Microsoft.CodeAnalysis.* packages.

Wolverine.EntityFrameworkCore.csproj:
	- net10:
	Microsoft.EntityFrameworkCore.Design 10.0.0
		Microsoft.CodeAnalysis.Workspaces.MSBuild (>= 4.14.0)
			Microsoft.CodeAnalysis.Workspaces.Common (= 4.14.0)
				Microsoft.CodeAnalysis.Common (= 4.14.0) 
	- net8 and net9:
	Microsoft.EntityFrameworkCore.Design 9.0.5
		Microsoft.CodeAnalysis.Workspaces.MSBuild (>= 4.8.0)
			Microsoft.CodeAnalysis.Workspaces.Common (= 4.8.0)
				Microsoft.CodeAnalysis.Common (= 4.8.0)

Wolverine.csproj:
	JasperFx.RuntimeCompiler (>= 4.4.0)
	- net10:
		Microsoft.CodeAnalysis.CSharp (>= 5.0.0)			
			Microsoft.CodeAnalysis.Common (= 5.0.0)
	- net8 and net9:
		Microsoft.CodeAnalysis.CSharp (>= 4.14.0 && < 6.0.0)
			Microsoft.CodeAnalysis.Common (= 4.14.0)

For net10 the issue is fixed in Microsoft.EntityFrameworkCore.Design 10.0.2.
For net9 and net8 it helps to update Microsoft.CodeAnalysis.Workspaces.MSBuild to 4.14.0 to align expectations of JasperFx.RuntimeCompiler and Microsoft.EntityFrameworkCore.Design.

  • Microsoft.CodeAnalysis.Workspaces.MSBuild 4.14.0 brings Microsoft.Build.Tasks.Core 17.7.2 which has a known vulnerability. It emits warning NU1903: Package 'Microsoft.Build.Tasks.Core' 17.7.2 has a known high severity vulnerability, GHSA-h4j7-5rxr-p4wc. To fix it the version is updated to 17.13.26.

Additionally, the following warnings are fixed as advised:
..\src\Wolverine\Wolverine.csproj : warning NU1510: PackageReference System.ComponentModel will not be pruned. Consider removing this package from your dependencies, as it is likely unnecessary.
..\src\Wolverine\Wolverine.csproj : warning NU1510: PackageReference System.Net.NameResolution will not be pruned. Consider removing this package from your dependencies, as it is likely unnecessary.
...\src\Http\OpenApiDemonstrator\OpenApiDemonstrator.csproj : warning NU1510: PackageReference Microsoft.AspNetCore.SignalR will not be pruned. Consider removing this package from your dependencies, as it is likely unnecessary.

@jeremydmiller
Copy link
Member

@dmytro-pryvedeniuk You're on fire man!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants