wcf icon indicating copy to clipboard operation
wcf copied to clipboard

dotnet-svcutil adds package references with floating version

Open mus65 opened this issue 2 years ago • 0 comments

Describe the bug Wenn adding a service to a project that doesn't have a dependency on the System.ServiceModel packages, these are automatically added with a floating version number (4.10.*). Please use a fixed version instead (4.10.0). Floating versions break build reproducibility and even patch versions can break stuff which leads to hard to diagnose problems.

I realize that NuGet package lock files would kind of fix this, but I don't want to deal with those because of a single dependency using floating versions. And most people wouldn't even realize the problem in the first place.

  <ItemGroup>
    <PackageReference Include="System.ServiceModel.Duplex" Version="4.10.*" />
    <PackageReference Include="System.ServiceModel.Http" Version="4.10.*" />
    <PackageReference Include="System.ServiceModel.NetTcp" Version="4.10.*" />
    <PackageReference Include="System.ServiceModel.Security" Version="4.10.*" />
    <PackageReference Include="System.ServiceModel.Federation" Version="4.10.*" />
  </ItemGroup>

To Reproduce Add a service to a project that does not have references to the System.ServiceModel packages.

Expected behavior Use a fixed version (4.10.0 instead of 4.10.*)

  <ItemGroup>
    <PackageReference Include="System.ServiceModel.Duplex" Version="4.10.0" />
    <PackageReference Include="System.ServiceModel.Http" Version="4.10.0" />
    <PackageReference Include="System.ServiceModel.NetTcp" Version="4.10.0" />
    <PackageReference Include="System.ServiceModel.Security" Version="4.10.0" />
    <PackageReference Include="System.ServiceModel.Federation" Version="4.10.0" />
  </ItemGroup>

mus65 avatar Nov 28 '22 11:11 mus65