Use upper-bound version ranges for sibling package dependencies (#4337)

paulmedynski · web-flow · commit fd8cb4b8242a · 2026-06-10T12:05:37.000-07:00
* Use upper-bound version ranges for sibling package dependencies

Compute [floor, ceiling) ranges for sibling packages so NuGet cannot
resolve an incompatible newer minor/major version at restore time.

- Directory.Packages.props: derive *VersionCeiling from *PackageVersion;
  apply ranges to sibling PackageVersion items; add SniVersionRange
- SqlClient csproj: compute version range properties for nuspec expansion
- SqlClient nuspec: replace bare version tokens with range tokens

* CI: Pass ReferenceType and dependency versions to pack jobs

The CI/PR pack jobs for Abstractions and Azure extensions were not
passing ReferenceType=Package to dotnet pack, causing the projects to
use ProjectReference mode for sibling dependencies. NuGet converts
ProjectReferences to bare version dependencies (no ranges), which
defeats the upper-bound version ranges defined in Directory.Packages.props.

Fix:
- pack-abstractions-package-ci-job: Add referenceType, loggingArtifactsName,
  and loggingPackageVersion parameters. When referenceType=Package, download
  Logging artifacts and pass ReferenceType + LoggingPackageVersion to dotnet
  pack buildProperties.
- pack-azure-package-ci-job: Add loggingPackageVersion parameter. When
  referenceType=Package, pass ReferenceType + dependency versions to dotnet
  pack buildProperties.
- Wire the new parameters through build-abstractions-package-ci-stage.yml
  and dotnet-sqlclient-ci-core.yml.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -40,29 +40,54 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
+  <!--
+    Compute version ceilings for sibling packages. The ceiling is the next major version
+    (prerelease suffix stripped) derived from the *floor* (XxxPackageVersion), giving a range
+    like [1.1.0-preview1-ci123, 2.0.0).  This prevents NuGet from resolving an incompatible
+    newer major version while allowing minor/patch updates within the same major.
+
+    Because the ceiling is derived from the floor, no separate NextVersion lookup is needed
+    here — the range is self-contained regardless of what pipeline or developer scenario
+    computed the floor.
+  -->
+  <PropertyGroup>
+    <!-- SNI version (external package, version declared once here) -->
+    <SniVersion>6.0.2</SniVersion>
+    <SniVersionRange>[$(SniVersion), $([MSBuild]::Add($(SniVersion.Split('.')[0]), 1)).0.0)</SniVersionRange>
+  </PropertyGroup>
+
+  <PropertyGroup Condition="'$(ReferenceType)' == 'Package'">
+    <SqlServerVersionCeiling>$([MSBuild]::Add($(SqlServerPackageVersion.Trim().Split('.')[0]), 1)).0.0</SqlServerVersionCeiling>
+    <LoggingVersionCeiling>$([MSBuild]::Add($(LoggingPackageVersion.Trim().Split('.')[0]), 1)).0.0</LoggingVersionCeiling>
+    <AbstractionsVersionCeiling>$([MSBuild]::Add($(AbstractionsPackageVersion.Trim().Split('.')[0]), 1)).0.0</AbstractionsVersionCeiling>
+    <SqlClientVersionCeiling>$([MSBuild]::Add($(SqlClientPackageVersion.Trim().Split('.')[0]), 1)).0.0</SqlClientVersionCeiling>
+    <AzureVersionCeiling>$([MSBuild]::Add($(AzurePackageVersion.Trim().Split('.')[0]), 1)).0.0</AzureVersionCeiling>
+    <AkvProviderVersionCeiling>$([MSBuild]::Add($(AkvProviderPackageVersion.Trim().Split('.')[0]), 1)).0.0</AkvProviderVersionCeiling>
+  </PropertyGroup>
+
   <!-- ===================================================================== -->
   <!-- Driver Packages -->
 
   <!-- The driver packages need version numbers when we build via Package references. -->
   <ItemGroup Condition="'$(ReferenceType)' == 'Package'">
     <PackageVersion
       Include="Microsoft.SqlServer.Server"
-      Version="$(SqlServerPackageVersion)" />
+      Version="[$(SqlServerPackageVersion), $(SqlServerVersionCeiling))" />
     <PackageVersion
       Include="Microsoft.Data.SqlClient.Internal.Logging"
-      Version="$(LoggingPackageVersion)" />
+      Version="[$(LoggingPackageVersion), $(LoggingVersionCeiling))" />
     <PackageVersion
       Include="Microsoft.Data.SqlClient.Extensions.Abstractions"
-      Version="$(AbstractionsPackageVersion)" />
+      Version="[$(AbstractionsPackageVersion), $(AbstractionsVersionCeiling))" />
     <PackageVersion
       Include="Microsoft.Data.SqlClient"
-      Version="$(SqlClientPackageVersion)" />
+      Version="[$(SqlClientPackageVersion), $(SqlClientVersionCeiling))" />
     <PackageVersion
       Include="Microsoft.Data.SqlClient.Extensions.Azure"
-      Version="$(AzurePackageVersion)" />
+      Version="[$(AzurePackageVersion), $(AzureVersionCeiling))" />
     <PackageVersion
       Include="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider"
-      Version="$(AkvProviderPackageVersion)" />
+      Version="[$(AkvProviderPackageVersion), $(AkvProviderVersionCeiling))" />
   </ItemGroup>
 
   <!-- ===================================================================== -->
@@ -108,8 +133,8 @@
   <!-- SqlClient Dependencies -->
 
   <ItemGroup>
-    <PackageVersion Include="Microsoft.Data.SqlClient.SNI" Version="6.0.2" />
-    <PackageVersion Include="Microsoft.Data.SqlClient.SNI.runtime" Version="6.0.2" />
+    <PackageVersion Include="Microsoft.Data.SqlClient.SNI" Version="$(SniVersionRange)" />
+    <PackageVersion Include="Microsoft.Data.SqlClient.SNI.runtime" Version="$(SniVersionRange)" />
     <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.16.0" />
     <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.16.0" />
     <PackageVersion Include="System.Buffers" Version="4.6.1" />
diff --git a/eng/pipelines/dotnet-sqlclient-ci-core.yml b/eng/pipelines/dotnet-sqlclient-ci-core.yml
@@ -164,6 +164,9 @@ stages:
       buildConfiguration: ${{ parameters.buildConfiguration }}
       debug: ${{ parameters.debug }}
       dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+      loggingArtifactsName: $(loggingArtifactsName)
+      loggingPackageVersion: $(loggingPackageVersion)
+      referenceType: ${{ parameters.referenceType }}
       # When building Abstractions via packages, we must depend on the Logging
       # package.
       ${{ if eq(parameters.referenceType, 'Package') }}:
diff --git a/eng/pipelines/jobs/pack-abstractions-package-ci-job.yml b/eng/pipelines/jobs/pack-abstractions-package-ci-job.yml
@@ -53,6 +53,30 @@ parameters:
     - detailed
     - diagnostic
 
+  # The name of the Logging pipeline artifacts to download.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingArtifactsName
+    type: string
+    default: Logging.Artifacts
+
+  # The Logging package version to depend on.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingPackageVersion
+    type: string
+    default: ''
+
+  # The C# project reference type to use when building and packing the packages.
+  - name: referenceType
+    type: string
+    default: Project
+    values:
+      # Reference sibling packages as NuGet packages.
+      - Package
+      # Reference sibling packages as C# projects.
+      - Project
+
 jobs:
 
   - job: pack_abstractions_package_job
@@ -102,21 +126,46 @@ jobs:
         - pwsh: 'Get-ChildItem Env: | Sort-Object Name'
           displayName: '[Debug] Print Environment Variables'
 
+      # For Package reference builds, we must first download the dependency
+      # package artifacts.
+      - ${{ if eq(parameters.referenceType, 'Package') }}:
+        - task: DownloadPipelineArtifact@2
+          displayName: Download Logging Package Artifacts
+          inputs:
+            artifactName: ${{ parameters.loggingArtifactsName }}
+            targetPath: $(Build.SourcesDirectory)/packages
+
       # Install the .NET SDK.
       - template: /eng/pipelines/common/steps/install-dotnet.yml@self
         parameters:
           debug: ${{ parameters.debug }}
 
       # Create the NuGet packages.
-      - task: DotNetCoreCLI@2
-        displayName: Create NuGet Package
-        inputs:
-          command: pack
-          packagesToPack: $(project)
-          configurationToPack: ${{ parameters.buildConfiguration }}
-          packDirectory: $(dotnetPackagesDir)
-          verbosityToPack: ${{ parameters.dotnetVerbosity }}
-          buildProperties: AbstractionsPackageVersion=${{ parameters.abstractionsPackageVersion }};AbstractionsAssemblyFileVersion=${{ parameters.abstractionsAssemblyFileVersion }}
+      #
+      # When referenceType is Package, we must pass ReferenceType and the
+      # dependency version so that Directory.Packages.props applies version
+      # ranges to sibling package dependencies.
+      - ${{ if eq(parameters.referenceType, 'Package') }}:
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            buildProperties: AbstractionsPackageVersion=${{ parameters.abstractionsPackageVersion }};AbstractionsAssemblyFileVersion=${{ parameters.abstractionsAssemblyFileVersion }};ReferenceType=Package;LoggingPackageVersion=${{ parameters.loggingPackageVersion }}
+
+      - ${{ else }}:
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            buildProperties: AbstractionsPackageVersion=${{ parameters.abstractionsPackageVersion }};AbstractionsAssemblyFileVersion=${{ parameters.abstractionsAssemblyFileVersion }}
 
       # Publish the NuGet packages as a named pipeline artifact.
       - task: PublishPipelineArtifact@1
diff --git a/eng/pipelines/jobs/pack-azure-package-ci-job.yml b/eng/pipelines/jobs/pack-azure-package-ci-job.yml
@@ -26,12 +26,19 @@ parameters:
     type: string
     default: Logging.Artifacts
 
-  # The Abstractions package verion to depend on.
+  # The Abstractions package version to depend on.
   #
   # This is used when the referenceType is 'Package'.
   - name: abstractionsPackageVersion
     type: string
 
+  # The Logging package version to depend on.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingPackageVersion
+    type: string
+    default: ''
+
   # The name of the pipeline artifacts to publish.
   - name: azureArtifactsName
     type: string
@@ -151,15 +158,31 @@ jobs:
           debug: ${{ parameters.debug }}
 
       # Create the NuGet packages.
-      - task: DotNetCoreCLI@2
-        displayName: Create NuGet Package
-        inputs:
-          command: pack
-          packagesToPack: $(project)
-          configurationToPack: ${{ parameters.buildConfiguration }}
-          packDirectory: $(dotnetPackagesDir)
-          verbosityToPack: ${{ parameters.dotnetVerbosity }}
-          buildProperties: AzurePackageVersion=${{ parameters.azurePackageVersion }};AzureAssemblyFileVersion=${{ parameters.azureAssemblyFileVersion }}
+      #
+      # When referenceType is Package, we must pass ReferenceType and the
+      # dependency versions so that Directory.Packages.props applies version
+      # ranges to sibling package dependencies.
+      - ${{ if eq(parameters.referenceType, 'Package') }}:
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            buildProperties: AzurePackageVersion=${{ parameters.azurePackageVersion }};AzureAssemblyFileVersion=${{ parameters.azureAssemblyFileVersion }};ReferenceType=Package;LoggingPackageVersion=${{ parameters.loggingPackageVersion }};AbstractionsPackageVersion=${{ parameters.abstractionsPackageVersion }}
+
+      - ${{ else }}:
+        - task: DotNetCoreCLI@2
+          displayName: Create NuGet Package
+          inputs:
+            command: pack
+            packagesToPack: $(project)
+            configurationToPack: ${{ parameters.buildConfiguration }}
+            packDirectory: $(dotnetPackagesDir)
+            verbosityToPack: ${{ parameters.dotnetVerbosity }}
+            buildProperties: AzurePackageVersion=${{ parameters.azurePackageVersion }};AzureAssemblyFileVersion=${{ parameters.azureAssemblyFileVersion }}
 
       # Publish the NuGet packages as a named pipeline artifact.
       - task: PublishPipelineArtifact@1
diff --git a/eng/pipelines/stages/build-abstractions-package-ci-stage.yml b/eng/pipelines/stages/build-abstractions-package-ci-stage.yml
@@ -67,6 +67,30 @@ parameters:
     - detailed
     - diagnostic
 
+  # The name of the Logging pipeline artifacts to download.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingArtifactsName
+    type: string
+    default: Logging.Artifacts
+
+  # The Logging package version to depend on.
+  #
+  # This is used when the referenceType is 'Package'.
+  - name: loggingPackageVersion
+    type: string
+    default: ''
+
+  # The C# project reference type to use when building and packing the packages.
+  - name: referenceType
+    type: string
+    default: Project
+    values:
+      # Reference sibling packages as NuGet packages.
+      - Package
+      # Reference sibling packages as C# projects.
+      - Project
+
 stages:
 
   - stage: build_abstractions_package_stage
@@ -141,3 +165,6 @@ stages:
             - test_abstractions_package_job_windows
             - test_abstractions_package_job_macos
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+          loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
+          loggingPackageVersion: ${{ parameters.loggingPackageVersion }}
+          referenceType: ${{ parameters.referenceType }}
diff --git a/eng/pipelines/stages/build-azure-package-ci-stage.yml b/eng/pipelines/stages/build-azure-package-ci-stage.yml
@@ -331,4 +331,6 @@ stages:
             - test_azure_package_job_windows_integration
             - test_azure_package_job_macos
           dotnetVerbosity: ${{ parameters.dotnetVerbosity }}
+          loggingArtifactsName: ${{ parameters.loggingArtifactsName }}
+          loggingPackageVersion: ${{ parameters.loggingPackageVersion }}
           referenceType: ${{ parameters.referenceType }}
diff --git a/src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.csproj b/src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.csproj
@@ -207,9 +207,16 @@
     <Error Condition="'$(_SqlServerPackageVersionTrimmed)' == ''"
       Text="SqlServerPackageVersion is required for SqlClient packaging. When packing via build.proj, set -p:PackageVersionSqlServer=&lt;version&gt;; when packing the project directly, set -p:SqlServerPackageVersion=&lt;version&gt;; otherwise ensure the SqlServer Versions.props import can resolve a value." />
 
-    <!-- Expand the SqlClientPackNuspec template with the computed package versions. -->
+    <!-- Expand the SqlClientPackNuspec template with computed version ranges. -->
     <PropertyGroup>
-      <_SqlClientPackNuspecExpandedText>$([System.IO.File]::ReadAllText('$(SqlClientPackNuspecTemplatePath)').Replace('$AbstractionsPackageVersion$','$(AbstractionsPackageVersion)').Replace('$LoggingPackageVersion$','$(LoggingPackageVersion)').Replace('$SqlServerPackageVersion$','$(SqlServerPackageVersion)'))</_SqlClientPackNuspecExpandedText>
+      <!-- Compute version ranges: [floor, (floor.Major+1).0.0) — ceiling derived from floor.
+           Use trimmed values to guard against whitespace passed via -p: arguments. -->
+      <_AbstractionsVersionRange>[$(_AbstractionsPackageVersionTrimmed), $([MSBuild]::Add($(_AbstractionsPackageVersionTrimmed.Split('.')[0]), 1)).0.0)</_AbstractionsVersionRange>
+      <_LoggingVersionRange>[$(_LoggingPackageVersionTrimmed), $([MSBuild]::Add($(_LoggingPackageVersionTrimmed.Split('.')[0]), 1)).0.0)</_LoggingVersionRange>
+      <_SqlServerVersionRange>[$(_SqlServerPackageVersionTrimmed), $([MSBuild]::Add($(_SqlServerPackageVersionTrimmed.Split('.')[0]), 1)).0.0)</_SqlServerVersionRange>
+    </PropertyGroup>
+    <PropertyGroup>
+      <_SqlClientPackNuspecExpandedText>$([System.IO.File]::ReadAllText('$(SqlClientPackNuspecTemplatePath)').Replace('$AbstractionsVersionRange$','$(_AbstractionsVersionRange)').Replace('$LoggingVersionRange$','$(_LoggingVersionRange)').Replace('$SqlServerVersionRange$','$(_SqlServerVersionRange)').Replace('$SniVersionRange$','$(SniVersionRange)'))</_SqlClientPackNuspecExpandedText>
     </PropertyGroup>
     <WriteLinesToFile File="$(SqlClientPackNuspecGeneratedPath)"
                       Lines="$(_SqlClientPackNuspecExpandedText)"
diff --git a/src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.nuspec b/src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.nuspec
@@ -38,9 +38,9 @@
       <group targetFramework="net462">
         <dependency id="Microsoft.Bcl.Cryptography" version="8.0.0" />
         <dependency id="Microsoft.Bcl.TimeProvider" version="8.0.1" />
-        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.SNI" version="6.0.2" />
+        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.SNI" version="$SniVersionRange$" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="8.0.1" exclude="Compile" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="8.16.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="8.16.0" />
@@ -56,38 +56,38 @@
       </group>
       <group targetFramework="net8.0">
         <dependency id="Microsoft.Bcl.Cryptography" version="8.0.0" />
-        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.2" exclude="Compile" />
+        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="$SniVersionRange$" exclude="Compile" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="8.0.1" exclude="Compile" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="8.16.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="8.16.0" />
-        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerPackageVersion$" />
+        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerVersionRange$" />
         <dependency id="System.Configuration.ConfigurationManager" version="8.0.1" exclude="Compile" />
         <dependency id="System.Security.Cryptography.Pkcs" version="8.0.1" />
       </group>
       <group targetFramework="net9.0">
         <dependency id="Microsoft.Bcl.Cryptography" version="9.0.13" />
-        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.2" exclude="Compile" />
+        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="$SniVersionRange$" exclude="Compile" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="9.0.13" exclude="Compile" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="8.16.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="8.16.0" />
-        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerPackageVersion$" />
+        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerVersionRange$" />
         <dependency id="System.Configuration.ConfigurationManager" version="9.0.13" exclude="Compile" />
         <dependency id="System.Security.Cryptography.Pkcs" version="9.0.13" />
       </group>
       <group targetFramework="netstandard2.0">
         <dependency id="Microsoft.Bcl.Cryptography" version="8.0.0" />
         <dependency id="Microsoft.Bcl.TimeProvider" version="8.0.1" />
-        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingPackageVersion$" />
-        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.2" exclude="Compile" />
+        <dependency id="Microsoft.Data.SqlClient.Extensions.Abstractions" version="$AbstractionsVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.Internal.Logging" version="$LoggingVersionRange$" />
+        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="$SniVersionRange$" exclude="Compile" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="8.0.1" exclude="Compile" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="8.16.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="8.16.0" />
-        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerPackageVersion$" />
+        <dependency id="Microsoft.SqlServer.Server" version="$SqlServerVersionRange$" />
         <dependency id="System.Configuration.ConfigurationManager" version="8.0.1" exclude="Compile" />
         <dependency id="System.Security.Cryptography.Pkcs" version="8.0.1" />
         <dependency id="System.Text.Json" version="10.0.3" />
