Skip to content

Remove NuGet.Core package dependency#15037

Merged
brettfo merged 3 commits into
mainfrom
dev/brettfo/nuget-old-package
May 20, 2026
Merged

Remove NuGet.Core package dependency#15037
brettfo merged 3 commits into
mainfrom
dev/brettfo/nuget-old-package

Conversation

@brettfo
Copy link
Copy Markdown
Contributor

@brettfo brettfo commented May 15, 2026

This PR will allow dependabot to update dependabot again :)

Replace all usages of the NuGet.Core (v2) package with local implementations. That package is a transitive dependency of the NuGet.Client submodule and the assembly targets net40-Client which is technically incompatible with the target framework used by dependabot. Because of that, <NoWarn>NU1701</NoWarn> was present telling NuGet to ignore target framework compatibility checks. This was a very specific case where the few types necessary from that assembly were compatible with .NET Core, but by having that suppression, it made it so that dependabot couldn't update dependabot because when determining package compatibility, we do not take into consideration NU1701 because we have no way of knowing what packages that was for or in what circumstances it would be considered OK so we have to consider any target framework incompatibility as fatal.

Various documents were updated to help future maintainers and bots understand the limitations.

@github-actions github-actions Bot added the L: dotnet:nuget NuGet packages via nuget or dotnet label May 15, 2026
@brettfo brettfo force-pushed the dev/brettfo/nuget-old-package branch from cd3d51c to 3c6ff8f Compare May 15, 2026 23:13
@brettfo brettfo marked this pull request as ready for review May 15, 2026 23:29
Copilot AI review requested due to automatic review settings May 15, 2026 23:29
@brettfo brettfo requested review from a team as code owners May 15, 2026 23:29
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes the legacy NuGet.Core (v2) package dependency from the NuGet helper projects by replacing the few required types/usages with local implementations and by vendoring/stubbing upstream NuGet.CommandLine sources that previously depended on extern alias CoreV2. It also documents the NU1701 suppression limitation to clarify why Dependabot treats target framework incompatibilities as fatal.

Changes:

  • Removed NuGet.Core package references and the NU1701 suppression from NuGetUpdater build configuration.
  • Introduced local equivalents for NuGet runtime binding-redirect types (IAssembly, AssemblyBinding) and updated redirect logic to use them.
  • Added/updated documentation and maintainer guidance for vendored NuGetProjects/ sources and NU1701 behavior.
Show a summary per file
File Description
nuget/README.md Documents NU1701 suppression as a known limitation for Dependabot NuGet updates.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/IAssembly.cs Adds local IAssembly abstraction to replace NuGet.Core runtime interface usage.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/AssemblyBinding.cs Adds local AssemblyBinding implementation for binding redirect parsing/serialization.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectResolver.cs Removes NuGet.Core alias usage and returns local AssemblyBinding instances.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs Switches redirect management from NuGet.Core runtime types to local AssemblyBinding.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/NuGetUpdater.Core.csproj Drops the NuGet.Core package dependency.
nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/StreamExtensions.cs Adds a small test helper for reading streams to byte arrays.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/README.md Adds maintenance rules for the vendored NuGetProjects code (incl. removing NuGet.Core).
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/NuGet.CommandLine.csproj Removes NuGet.Core dependency and excludes upstream files that relied on CoreV2.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Program.cs Adds a local replacement for upstream NuGet.CommandLine program entrypoint without CoreV2.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/SettingsCredentialProvider.cs Adds a local replacement provider (removing legacy dependencies).
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Commands/Command.cs Adds a local replacement for upstream command base without CoreV2 usage.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Commands/ProjectFactory.cs Adds a local replacement for upstream project factory without CoreV2 usage.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Commands/UpdateCommand.cs Adds a local replacement for upstream update command without CoreV2 usage.
nuget/helpers/lib/NuGetUpdater/NuGetProjects/Directory.Build.props Removes NU1701 suppression in the vendored projects build.
nuget/helpers/lib/NuGetUpdater/Directory.Packages.props Removes centralized NuGet.Core package version entry.
nuget/helpers/lib/NuGetUpdater/Directory.Build.props Removes global NU1701 suppression for NuGetUpdater projects.
.github/instructions/nuget-projects.instructions.md Adds GitHub instructions/checklist for maintaining NuGetProjects/ after submodule updates.

Copilot's findings

  • Files reviewed: 18/18 changed files
  • Comments generated: 2

Copy link
Copy Markdown
Contributor

@sebasgomez238 sebasgomez238 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of the copilot suggestions seem reasonable, feel free to ping for approval once addressed or ignored

@brettfo brettfo force-pushed the dev/brettfo/nuget-old-package branch from 1ea3b00 to 2c933e2 Compare May 19, 2026 14:18
brettfo and others added 3 commits May 20, 2026 11:55
Replace all usages of the NuGet.Core (v2) package with local
implementations:

- Remove NuGet.Core from Directory.Packages.props, NuGet.CommandLine.csproj,
  and NuGetUpdater.Core.csproj
- Add local AssemblyBinding and IAssembly types in NuGetUpdater.Core/Updater/
- Exclude 8 CoreV2-dependent files from NuGet.CommandLine and provide
  replacement stubs (Program.cs, Command.cs, UpdateCommand.cs,
  ProjectFactory.cs, SettingsCredentialProvider.cs)
- Remove NU1701 warning suppression (no longer needed)
- Add maintenance instructions for NuGetProjects directory
- Add StreamExtensions.cs for pre-existing test gap

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: brettfo <926281+brettfo@users.noreply.github.com>
Co-authored-by: brettfo <926281+brettfo@users.noreply.github.com>
@brettfo brettfo force-pushed the dev/brettfo/nuget-old-package branch from 2c933e2 to 82d1ee2 Compare May 20, 2026 17:55
@brettfo brettfo merged commit 44c5468 into main May 20, 2026
125 of 126 checks passed
@brettfo brettfo deleted the dev/brettfo/nuget-old-package branch May 20, 2026 18:59
Copy link
Copy Markdown

@albertoblue87-netizen albertoblue87-netizen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

L: dotnet:nuget NuGet packages via nuget or dotnet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants