I would like to install protobuf-net using NutGet and Visual Studio 2012.
However, if I try to install it, I got the following error message from NuGet :
'protobuf-net' already has a dependency defined for
'NETStandard.Library'.
I have tried to install NETStandard.Library but there is an error :
The 'NETStandard.Library 1.6.0' package requires NuGet client version
'2.12' or above, but the current NuGet version is '2.8.60318.667'.
I also tried to update NuGet (by uninstalling it then re-install), but it seems with Visual Studio 2012 it is stuck to 2.8 version.
I don't have Visual Studio 2012 to test, but I wonder if this is due to the way Nuget now works with the .Net Core dependencies. It should work if you install an older version of protobuf-net. You can see that the older version doesn't mention .NETStandard as a dependency. To do this, from the package manager console, type this:
Install-Package protobuf-net -Version 2.0.0.668
I found that this protobuf-portable-net works on .NET 4.5 for VS 2013 and has the same version number as above: 2.0.0.668. It's the same author and might be a better approach than intentionally installing an old version of a newer package.
Related
I added WhiteSource Bolt to my Azure DevOps pipeline and noticed that it was reporting CVE-2017-0247, CVE-2017-0248, CVE-2017-0249 vulnerabilities after I upgraded the Microsoft.CodeDom.Providers.DotNetCompilerPlatform nuget package from version 2.0.0 to 2.0.1
The issue is being caused by an old version of System.Net.Http (4.6.24705.1) being included in the bin\roslyn folder.
To keep it simple I have created a new empty web project which just has the Microsoft.CodeDom.Providers.DotNetCompilerPlatform nuget package. I started using version 2.0.0 of the package. When building using this package the roslyn folder has version 2.8.2.62916 of the C# compiler which doesn't have the dependency on System.Net.Http. When using this version all files in this folder have a date modified of 24/05/2018
I then updated the Microsoft.CodeDom.Providers.DotNetCompilerPlatform nuget package to version 2.0.1. After building the solution the roslyn folder had version 2.9.0.63208 of the C# compuler which has a dependency on System.Net.Http. The files in the roslyn folder have a variety of dates from 2018, 2017 and 2016.
Whitesource is detecting the old version of System.Net.Http and flagging it up since it is effected by the above mentioned CVEs.
I have uploaded my code to https://github.com/rubenmamo/CVE-2017-0248-Test
Unfortunately I don't really understand how roslyn is used in Asp.Net projects and am not sure whether it is safe to use the 2.0.1 version of the Microsoft.CodeDom.Providers.DotNetCompilerPlatform nuget package. It looks odd that Microsoft would have released a package in September 2017 with such an issue without fixing it.
I'm not sure I'm missing something :|
Solution consists of 2 dll libraries, 1 console app and 1 web app. Only the last project, the web one, uses Microsoft.Net.Compilers NuGet package. Package has been updated to version 2.3.0 now, what means C# 7.1 and VB 15.3.
source: Roslyn NuGet packages
As 3 other projects do not have Microsoft.Net.Compilers NuGet package installed, what Roslyn compiler and C# version do they use?
I use VS.Net 2017 15.2 with .NET Framework 4.7, so I would guess it shall C#7.0, but still Microsoft.Net.Compilers in version 2.2 should be installed there, but is not.
The Microsoft.Net.Compilers package overrides (by setting properties in your project file) the default version of Roslyn included with MSBuild / Visual Studio.
Regular class libraries that don't reference it are compiled using the Roslyn build included with your version of Visual Studio & MSBuild.
Visual Studio 2017 (15.x) supports C# 7, but what about Visual Studio 2015 (14.x)?
How can I use C# 7 with it?
You can replace the compiler shipped with Visual Studio for a C# 7-enabled version by installing the Nuget package Microsoft.Net.Compilers:
Referencing this package will cause the project to be built using the
specific version of the C# and Visual Basic compilers contained in the
package, as opposed to any system installed version.
There is no indication that I can see on the package page as to whether this is officially supported in Visual Studio 2015. My not-thorough tests so far indicate that it works but not painlessly - C# 7 code compiles, but is underlined with the red squiggly line which indicates a syntax error:
Note that you will also need to install the Nuget package System.ValueTuple to use the new C# 7 value tuples features.
In my case, installing just Microsoft.Net.Compilers didn't work. Instead, I had to do the following:
Install Microsoft.CodeDom.Providers.DotNetCompilerPlatform for the project (Tools => NuGet Package Manager => Manage Nuget Packages for Solution...) and install Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Install the latest Microsoft.Net.Compilers for the project
Install any other NuGet package for the latest C# feature you want to use. In my case, my goal was to use Tuples, so I installed System.ValueTuple and worked fine.
But still note that C# codes which are not known by Visual Studio 2015 default compiler will still have red squiggles underneath.
I have problems since I have updated "Microsoft.CodeAnalysis.CSharp.Scripting" to 1.3.2.
Steps to reproduce:
Create a VS add-in with EditorMargin class.
Change .NET to 4.6
Install Microsoft.CodeAnalysis.CSharp.Scripting and Microsoft.CodeAnalysis.CSharp.
Put somewhere in ctor the following code:
var t = new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary)
After running the add-in it will throw a
Missing method exception
It cannot find a constructor of CSharpCompilationOptions. I noticed that when I don't install "Microsoft.CodeAnalysis.CSharp.Scripting" (which is not necessary in the above case), everything works. I guess one of dependencies of Microsoft.CodeAnalysis.CSharp.Scripting installs some packages.
I tried to run "Fuslogvw" to see if there are any binding errors but I could not find anything useful.
Any ideas?
Update
- I use Visual Studio 2015 update 3
Update 2
I downgraded "System.Collections.Immutable" from 1.2.0 to 1.1.37 and it works again.
Update 3
I found the reported bug:
https://github.com/dotnet/roslyn/issues/12247
The problem is I need to use 1.2.0 because Roslyn scripting API uses that version.
The current workaround for me is to downgrade Microsoft.CodeAnalysis.Csharp.Scripting to the version which works with "System.Collections.Immutable 1.1.37"
If you're targeting package version 1.3.2, that means you're targeting Visual Studio 2015 Update 3, but I'm guessing you don't have that installed. Either downgrade to an older version (i.e. 1.2 if you're targeting Update 2, 1.1 if targeting Update 1), or upgrade your VS to a newer version.
I was able to resolve this problem installing Visual Studio 2017. VS 2017 requires System.Collection.Immutable 1.2.1.0, which does not conflict with other Roslyn versions
I am using VS 2013 and .Net 4.5/4.6. I am not getting this error message:
The 'System.Collections 4.0.10' package requires NuGet client version '3.0' or above, but the current NuGet version is '2.8.60723.765'.
My understanding is that this is due to a ddl that use a higher version of .Net. Just curious is there a way to fix this (e.g. determine the responsibel dll[s])?
Those packages are primarily designed for .NET Core ecosystem,
https://www.nuget.org/packages/System.Collections/4.0.10
That means it should not be used for .NET 4.5 and Visual Studio 2013. I guess that's probably why Microsoft only releases NuGet 3.* for Visual Studio 2015. It makes sense to avoid polluting Visual Studio 2013 users with the brand new bits.
A workaround is to specify a version of a NuGet your client is actually compatible with.
i.e.
System.Collections Version=x.x.x picking of course a slightly older version than the latest one.
You need to update your nuget package manager.
You can download the latest version over here:
https://visualstudiogallery.msdn.microsoft.com/4ec1526c-4a8c-4a84-b702-b21a8f5293ca