Central Package Management - Transitive pinning with nuget 6.2.0 supported

[HeikeHofmann]

Prerequisites

• I have written a descriptive issue title
• I have searched issues to ensure it has not already been reported

Cake runner

Cake .NET Tool

Cake version

2.2.0

Operating system

Windows

Operating system architecture

64-Bit

CI Server

Azure DevOps Server 2017/2020

What are you seeing?

Cake.Tool 2.2.0 is using NuGet 6.1.0 at the moment. This version is not capable of interpreting transitive dependency correct.

There are new tool versions released, which supports this new feature:
Visual Studio 2022 17.2 and later
.NET SDK 6.0.300 and later
.NET SDK 7.0.0-preview.4 and later
nuget.exe 6.2.0 and later

See https://devblogs.microsoft.com/nuget/introducing-central-package-management/

Is it possible to update to nuget 6.2.0 with the upcoming new Cake Version 2.3.0 ?

What is expected?

Cake.Tool should use NuGet 6.2.0, not 6.1.0

Steps to Reproduce

N/A

Output log

No response

[devlead]

You should be able to use any newer .NET 6 SDK with Cake, do you have an example of what you're trying to do with Cake that doesn't work.

[HeikeHofmann]

There is a known NuGet issue NuGet/Home#6764, which was solved with NuGet 6.2. This version will used by newer .NET6 SDK's and VisualStudio. For a clean build environment and to prevent strange version conflicts, Cake.Tool should be use https://www.nuget.org/packages/NuGet.Versioning/6.2.0

Without this new version, Central Package Management is not working correct for transitive Packages. That means, all companies, which want to use the official release CPM, must update complete tool chain to the new NuGet packages and new NuGet.exe.

Cake.Tool is loading NuGet.Versioning 6.1.0 at the moment. This will collide with own Cake Company Plugins, where we plan to update to the new NuGet.Versioning 6.2.0 to use CPM.

[devlead]

In develop Cake already uses NuGet client libraries 6.2.1, so that will come out with the next release. Those client libraries are only used internally by Cake to install addins and tools, it doesn't affect the tools orchestrated by Cake.
The develop version is available on our Azure Artifacts Feed
https://dev.azure.com/cake-build/Cake/_packaging?_a=package&feed=cake&package=Cake.Tool&protocolType=NuGet

That said using newer versions of NuGet.exe or .NET CLI is already supported for projects you restore/build/package using Cake.

You can pin the version of NuGet.exe using the tool directive

#tool nuget:?package=NuGet.CommandLine&version=6.2.1

You can use Cake.Tool 2.2 with i.e. .NET SDK 6.0.302, best practice is to have a global.json in your repo to pin the .NET SDK version used, it can look something like

{
    "sdk": {
        "version": "6.0.302",
        "rollForward": "latestFeature"
    }
}

In a clean CI environment like GitHub actions you can ensure the right SDK version is used by using the setup dotnet task, which by default uses global.json to resolve .NET SDK version to install if missing

      - name: Install .NET Core SDK (global.json)
        uses: actions/setup-dotnet@v1

same yaml for i.e. Azure Pipelines would look something like this

- task: UseDotNet@2
  displayName: 'Use .NET Core SDK global.json'
  inputs:
    packageType: sdk
    useGlobalJson: true

Another option is to use the obtain scripts provided by the .NET Team which also supports installing a .NET SDK
https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script
The scripts have a json file option where you can specify the path to the global json used fetch version to install.

[HeikeHofmann]

We have switched to internal NuGet usage with Update to Cake.Tool 2.2.0.
If we use the nuget restore plugin, we need to check, if it is working with the new version 6.2.0 then.
(Last time we had problems, when Cake.Tool 2.1.0 was using NuGet 6.0.0 and we had already 6.1.0 in usage. This combination was not working, reason why i ask, if the new Cake.Tool 2.3.0 will updated to NuGet 6.2.0 to prevent same situation)

We working in a medical environment, where tools must be stable and validated. That means, every tool chain is installed or will be downloaded as nuget package. Task with install .NET SDK at runtime is not allowed.

We will test the new tool chain in the next weeks. At the moment, we validate with cake 2.2.0 and .NET 6 SDK V6.0.103.

But i started this issue here, because i dont want to run into a surprise situation (which we had with Cake.Tool 2.1.0 and wrong NuGet version), where we need to wait months, if something is not working correct.