Installing a package with a dependent version that also has a less restrictive dependency on the same package fails when Dependency Version Behavior Highest

[ferventcoder]

Attention: I have not yet verified this with NuGet v3 (working on that unless someone beats me to it).

Update: This works properly in v3 and so it has been closed as already fixed.

Original Request

NuGet doesn't seem to be able to handle the scenario where a package has a dependency constraint on a package version and another dependency has a similar, but looser constraint on a package version.

Given a top level package that has two exact version dependencies at [1.0.0]. One of the child packages also depends on the same other package, but this time the dependency is a little looser (but still valid) at [1.0.0, 3). This is valid for both dependencies as both contain inclusive versions.

Nothing is installed, so it is expected that NuGet would resolve version 1.0.0 of that package because that's where the resolution between the two version constraints for that package would land. It doesn't appear to.

It fails with the well-known Already referencing a newer version of 'x'.

Reproduction

Here is your complete reproduction.

1. Download this zip - repro.zip
2. Unzip to a local folder.
3. In Visual Studio NuGet Package Manager Settings, add that local folder as a source.
4. In the Visual Studio Package Manager Console, select that source.
5. In the Visual Studio Package Manager Console, run install-package toplevelhasexactversiondependency -DependencyVersion Highest.
6. Watch the output.

Expected Results

It should work properly and version 1.0.0 of three packages should be installed.

Actual Results

It fails in VS2013 which looks like it includes up to 2.8.7 in the latest available extension. I'm curious if it also fails in VS2015 (which includes 3.x).

If it fails in the latest version, it feels like a bug considering that the dependency walker should resolve this automatically.

Details

The zip contains four packages. You can recreate these yourself if you need to.

toplevelhasexactversiondependency.nuspec:

<?xml version="1.0"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
  <metadata>
    <id>toplevelhasexactversiondependency</id>
    <version>1.0.0</version>
    <authors>__REPLACE_AUTHORS_OF_SOFTWARE__</authors>
    <owners>__REPLACE_YOUR_NAME__</owners>
    <description>__REPLACE__</description>
    <dependencies>
      <dependency id="childdependencywithlooserversiondependency" version="[1.0.0]" />
      <dependency id="isexactversiondependency" version="[1.0.0]" />
    </dependencies>
  </metadata>
</package>

childdependencywithlooserversiondependency.nuspec:

<?xml version="1.0"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
  <metadata>
    <id>childdependencywithlooserversiondependency</id>
    <version>1.0.0</version>
    <authors>__REPLACE_AUTHORS_OF_SOFTWARE__</authors>
    <owners>__REPLACE_YOUR_NAME__</owners>
    <description>__REPLACE__</description>
    <dependencies>
      <dependency id="isexactversiondependency" version="[1.0.0, 3)" />
    </dependencies>
  </metadata>
</package>

isexactversiondependency.nuspec:

Note: add a file in the tools folder so it will build.

v1.0.0

<?xml version="1.0"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
  <metadata>
    <id>isexactversiondependency</id>
    <version>1.0.0</version>
    <authors>__REPLACE_AUTHORS_OF_SOFTWARE__</authors>
    <owners>__REPLACE_YOUR_NAME__</owners>
    <description>__REPLACE__</description>
  </metadata>
  <files>
    <file src="tools\**" target="tools" />
  </files>
</package>

v1.1.0

<?xml version="1.0"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
  <metadata>
    <id>isexactversiondependency</id>
    <version>1.1.0</version>
    <authors>__REPLACE_AUTHORS_OF_SOFTWARE__</authors>
    <owners>__REPLACE_YOUR_NAME__</owners>
    <description>__REPLACE__</description>
  </metadata>
  <files>
    <file src="tools\**" target="tools" />
  </files>
</package>

[ferventcoder]

There is a bit longer discussion of this at chocolatey/choco#507

[ferventcoder]

Short and long of this is that I tried to get NuGet.exe to respect the dependency behavior attribute in NuGet.config and it doesn't (unless it changed to a different name). It didn't in any of the older versions and it still doesn't in v3.3.0. chocolatey/choco#507 (comment)

[ferventcoder]

Actually it looks like this is resolved in NuGet v3.x -

Thanks @gep13!