System.Text.Json does not work with Roslyn analyzers

[kolkinn]

Version Used:
Microsoft (R) Visual C# Compiler version 3.4.1-beta4-19614-01 (1650460)

Steps to Reproduce:

1. Install System.Text.Json as a dependency in your analyzer package
2. Use System.Text.Json in your analyzer
3. Run your analyzer

I have made a simple reproduction branch, using the MakeConst sample in from dotnet/samples:
https://github.com/mikaelkolkinn/samples/tree/roslyn-json-repro
Do the following to reproduce the issue using the provided repository:

1. Open the MakeConst solution
2. Start the MakeConst.Vsix project
3. Open a solution with the instance of Visual Studio that was spawned
4. Create a variable somewhere in your code, like this var couldBeConst = "hello world";
5. Observe that there is no diagnostics saying the variable could be made a constant

Expected Behavior:
System.Text.Json works and lets you deserialize JSON.

Actual Behavior:
Analyzer does not run.
Logs show this error:

Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information. Could not load file or assembly 'System.Runtime, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified. Could not load file or assembly 'System.Text.Json, Version=4.0.1.1, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' or one of its dependencies. The system cannot find the file specified.

[sharwell]

📝 It's currently very difficult for analyzers to have any dependencies. All of the analyzer projects I've worked on that had dependencies eventually removed them (either by embedding or replacement with equivalent standard functionality) due to inconsistent behaviors observed across the many environments where analyzers run.

StyleCop Analyzers needed JSON functionality and ended up embedding a modified LightJson implementation:
https://github.com/DotNetAnalyzers/StyleCopAnalyzers/tree/master/StyleCop.Analyzers/StyleCop.Analyzers/LightJson

[kolkinn]

📝 It's currently very difficult for analyzers to have any dependencies. All of the analyzer projects I've worked on that had dependencies eventually removed them (either by embedding or replacement with equivalent standard functionality) due to inconsistent behaviors observed across the many environments where analyzers run.

StyleCop Analyzers needed JSON functionality and ended up embedding a modified LightJson implementation:
https://github.com/DotNetAnalyzers/StyleCopAnalyzers/tree/master/StyleCop.Analyzers/StyleCop.Analyzers/LightJson

Very interesting @sharwell, I will take a look at LightJson.
I was hoping to use System.Text.Json to decrease the need for memory allocations, but LightJson might cut it.

[jmarolf]

I would move this to the Roslyn-sdk repo. we should at least have a system that allows dependencies to be packed correctly into your analyzer nuget package.

@mikaelkolkinn I agree with @sharwell though. Even if we made dependency deployment work, json is a problem. Almost every host that is going to load you is going to have some version of a json serializer (likely the exact same package but a different version) and reasoning about how to resolve those conflicts across both .NET Framework analyzer hosts and .NET Core Analyzer hosts is very hard.

💭: should we just provide a utility json serializer to analyzer authors since 90% of the time the reason they are going to add dependencies to their analyzer project it is going to be for json serialization?

[tmat]

We should focus on switching VBCSCompiler and Roslyn ServiceHub hosts, which are the main analyzer hosts, to run on .NET Core. Once we do that analyzer dependencies are not gonna be a problem since we can isolate each analyzer in a separate AssemblyLoadContext.

[mavasani]

@genlu @tmat I believe Gen's changes to move OOP to core host should have taken care of #41785 (comment). Is there anything else to be done here?

[genlu]

Enabling .Net 6 host would address this in IDE, but I don't think the compiler shipped in VS today run on .Net 6 yet.

[benrobot]

I'm working on an analyzer and started having issues when I began depending on System.Text.Json. It sounds like I should forget about depending on any external libraries. Is that correct?

[genlu]

@benrobot That depends, your analyzer with external dependencies would work fine when building with SDK (e.g. dotnet build) as long as the dependencies are packaged properly in your analyzer nuget package. But in VS, it will take us a little longer to completely move both the IDE analyzer host and vbcscompiler to the ALC based version.

[benrobot]

@benrobot That depends, your analyzer with external dependencies would work fine when building with SDK (e.g. dotnet build) as long as the dependencies are packaged properly in your analyzer nuget package. But in VS, it will take us a little longer to completely move both the IDE analyzer host and vbcscompiler to the ALC based version.

@genlu About 14 months ago you said it will take a little longer for VS to catch up. Is there any update on this?

[genlu]

But in VS, it will take us a little longer to completely move both the IDE analyzer host and vbcscompiler to the ALC based version.

Roslyn language service is now default to run on .NET 8 in VS. I'm not sure about vbcscompiler though. Tag @jaredpar for the compiler server part.

[jaredpar]

The VBCSCompiler process, and by extension msbuild style invocations, don't have a timeframe for moving to AssemblyLoadContext. That would necessitate that the compiler be able to run on .NET Core and that isn't an option in the msbuild install today.

[benrobot]

Thank you for the update @genlu and @jaredpar . I'm going to try to summarize the current state, in my own terminology. Please correct me if I said something incorrect.

Summary

If I write an analyzer that depends on NuGet packages then it will fail within Visual Studio. My options are to either:

1. Include source code of my dependencies within my analyzer project
2. Only target users that don't use Visual Studio or any other msbuild based IDE

There's no timeframe for resolving this issue at this time.

[jaredpar]

If I write an analyzer that depends on NuGet packages then it will fail within Visual Studio

The core scenarios for analyzers are Visual Studio, VS Code, msbuild and dotnet build. The vast majority of dependencies used via NuPkg work just fine in these scenarios. There are plenty of customers who are leveraging significant dependency chains in these scenarios successfully.

Every host listed above has some control over how dependencies are loaded. For example Visual Studio requires that their version of dependencies be loaded. That means if your analyzer and Visual Studio share a dependency, like System.Text.Json, then the version Visual Studio ships will win at execution time. That is a policy decision of the host and analyzers need to be aware of that when building their solutions.