3

I have a project that uses ServiceStack; we're running the old 3.9.x codebase rather than upgrading to 4.x, since ServiceStack 4 requires a commercial license.

My own API client has a dependency defined in the .nuspec file as follows:

<dependencies>
  <dependency id="DotNetOpenAuth.OAuth2.Client" version="[4.3,5)" />
  <dependency id="log4net" version="[2.0,2.1)" />
  <dependency id="ServiceStack" version="[3.9.71,4)" />
</dependencies>

Problem is - the ServiceStack package depends on various other bits of the ServiceStack framework, and installing ServiceStack 3.9.71 is installing ServiceStack.Text v4.0.24 into my project. It does pop up the dialog requiring license acceptance, which is what alerted me that something weird was going on - but short of manually defining my own dependencies for the other required ServiceStack components, how can I make sure I'm not going to end up with unlicensed bits of ServiceStack 4.x in my project?

Dylan Beattie
  • 53,688
  • 35
  • 128
  • 197

2 Answers2

7

Make the ServiceStack.Text dependency explicit in your .nuspec and put it before the ServiceStack dependency.

<dependencies>
  <dependency id="DotNetOpenAuth.OAuth2.Client" version="[4.3,5)" />
  <dependency id="log4net" version="[2.0,2.1)" />
  <dependency id="ServiceStack.Text" version="[3.9.71,4)" />
  <dependency id="ServiceStack" version="[3.9.71,4)" />
</dependencies>

This will force NuGet to resolve ServiceStack.Text using the constraint.

The problem with just installing ServiceStack using the version range [3.9.71,4) is that NuGet resolves the ServiceStack.Common dependency to the lowest compatible version of ServiceStack.Common which it determines is version 3.9.11. ServiceStack.Common 3.9.11 does not specify a dependency range for ServiceStack.Text so NuGet installs a 4.0 version. Later versions of ServiceStack.Common do have a range for the ServiceStack.Text package but the older versions do not. So without making the dependency explicit or having the ServiceStack.Text NuGet package changed so it puts in a range, there is not much you can do when installing your NuGet package.

The only other thing you can do is put a constraint in your packages.config file to prevent the newer version of ServiceStack being installed.

<packages>
    <package id="ServiceStack.Text" version="3.9.71" allowedVersions="[3.9.71,4)" />
</packages>
Matt Ward
  • 47,057
  • 5
  • 93
  • 94
0

I made my own "wrapper" package for this containing no extra files but only dependencies - like this:

<dependencies>
  <dependency id="ServiceStack.Text" version="[3.9.71]" />
  <dependency id="ServiceStack.Common" version="[3.9.71]" />
  <dependency id="ServiceStack.Redis" version="[3.9.71]" />
  <dependency id="ServiceStack.OrmLite.SqlServer" version="[3.9.71]" />
  <dependency id="ServiceStack" version="[3.9.71]" />
</dependencies>
Jesper Niedermann
  • 765
  • 7
  • 17