When I run dotnet restore on a specific project, I get this error:

Failed to download package 'System.Text.Json.7.0.3'

This is because it is vulnerable and hence not available on our Nuget server, so I added an explicit include of a higher version in the .csproj file:

<PackageReference Include="System.Text.Json" Version="9.0.3" />

But dotnet restore still tries to get the older version. How can I make sure that the higher version always should be used?

Or how can I identify which package holds a transient reference to the vulnerable version?

Utklipp från en av csproj-filerna nedan

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>

  </PropertyGroup>
  <ItemGroup>
    <ProjectReference Include="..\Common\Common.csproj" />
    <ProjectReference Include="..\Core\Core.csproj" />
    <ProjectReference Include="..\Model\Model.csproj" />
  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="AutoMapper" Version="13.0.1" />
    <PackageReference Include="EntityCloner.Microsoft.EntityFrameworkCore" Version="8.0.0" />
    <PackageReference Include="log4net" Version="2.0.14" />
    <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.1" />
    <PackageReference Include="SonarAnalyzer.CSharp" Version="8.0.0.9566" />
    <PackageReference Include="System.ComponentModel.Annotations" Version="5.0.0" />
    <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
    <PackageReference Include="system.private.uri" Version="4.3.2" />
    <PackageReference Include="system.text.json" Version="9.0.3" />
    <PackageReference Include="System.IO.Packaging" Version="9.0.2" />
    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="9.0.2" />
    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="9.0.2" />
  </ItemGroup>
</Project>

When I run dotnet restore on a specific project, I get this error:

Failed to download package 'System.Text.Json.7.0.3'

This is because it is vulnerable and hence not available on our Nuget server, so I added an explicit include of a higher version in the .csproj file:

<PackageReference Include="System.Text.Json" Version="9.0.3" />

But dotnet restore still tries to get the older version. How can I make sure that the higher version always should be used?

Or how can I identify which package holds a transient reference to the vulnerable version?

Utklipp från en av csproj-filerna nedan

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>

  </PropertyGroup>
  <ItemGroup>
    <ProjectReference Include="..\Common\Common.csproj" />
    <ProjectReference Include="..\Core\Core.csproj" />
    <ProjectReference Include="..\Model\Model.csproj" />
  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="AutoMapper" Version="13.0.1" />
    <PackageReference Include="EntityCloner.Microsoft.EntityFrameworkCore" Version="8.0.0" />
    <PackageReference Include="log4net" Version="2.0.14" />
    <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.1" />
    <PackageReference Include="SonarAnalyzer.CSharp" Version="8.0.0.9566" />
    <PackageReference Include="System.ComponentModel.Annotations" Version="5.0.0" />
    <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
    <PackageReference Include="system.private.uri" Version="4.3.2" />
    <PackageReference Include="system.text.json" Version="9.0.3" />
    <PackageReference Include="System.IO.Packaging" Version="9.0.2" />
    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="9.0.2" />
    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="9.0.2" />
  </ItemGroup>
</Project>

• c#
• nuget
• -8.0

• 1 Showing what your csproj looks like will help a lot. – tia Commented Mar 13 at 14:20
• 1 .NET wouldn't try to install such an old version unless the project itself required it. .NET 7 is out of support. The oldest supported .NET version is 8. Does the project target .NET 7 perhaps? – Panagiotis Kanavos Commented Mar 13 at 15:26
• 1 NuGet uses the lowest required version of a dependency in its resolution process. So if you have another library that depends on v7.0.3 (directly or indirectly), it will stick to that version. Check the dependencies of all your other packages. See stackoverflow/q/46486983/120955 and learn.microsoft/en-us/nuget/concepts/…. – StriplingWarrior Commented Mar 13 at 15:32
• @StriplingWarrior was very close. Even when your project directly references a package, as part of NuGet's dependency resolution algorithm, it might download other package's dependencies, even if another part of the graph causes the package version to be higher. So, it's very likely that one of the packages in your graph depend on version 7.0.0, and it's only later in the resolution algorithm that is chooses 9.0.2 instead – zivkan Commented Mar 14 at 0:14

1 Answer 1

Thanks all for contributing to my understanding the rules of how dotnet restore works

I found out that I could find the dependencies to specific versions of packages by examining the Project.assets.json file and doing so in a json editor it became clear what was causing the issue.

• Microsoft.EntityFrameworkCore.Design - Version="9.0.3"
  has a dependency to

  • Microsoft.CodeAnalysis.Workspaces.MSBuild - Version="4.8.0"
    that has a dependency to

    • System.text.json  - Version="7.0.3"
      that has a vulnerability