Nuget pack handles nuspec files containing wildcards wrong

[fredricadell]

Details about Problem

We are using msbuild to paclk and publish a nuget from a nuspec file. In the nuspec file there is a dependency to another nuget-package whith a specified version as 1.0.* (included below). When we run the pack-step on the nuspec-file with nuget.exe, the nuspec-file that gets inserted in the package has changed the version on the dependant nuget-package to 1.0.0, which means that the dependent package dont get updated to the latest published version when we run Install-Package.

We use the new packageReference style instead of having a packages.config file.

Tool versions

NuGet product used (NuGet.exe | VS UI | Package Manager Console | dotnet.exe):
Msbuild.exe version : Toolsversion 15.0

NuGet version (4.9.2.5706):

dotnet.exe --version (if appropriate):

OS version (i.e. win10 v1607 (14393.321)):
Win10 v
Worked before? If so, with which NuGet version:

Detailed repro steps so we can see the same problem

1. Run nuget pack on nuspec file with a dependeny on another nuget-package whith a verison specified as 1.0.*

2. Check the created nuspec file included in the package created

Original nuspecfile

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
  <metadata>
    <id>Alecta.VO.GRV.ZOSUtil</id>
<version>1.0.14</version> 
    <title>GRV ZOSUtil</title>
    <authors>S86522</authors>
    <owners>Alecta Pensionsforsakring, Omsesidigt</owners>
    <requireLicenseAcceptance>false</requireLicenseAcceptance>
    <description>Komponenter for kommunikation mellan .net och CAGentjanster</description>
    <releaseNotes></releaseNotes>
    <copyright>Copyright Alecta 2018</copyright>
    <dependencies>
      <dependency id="Alecta.VO.GRV.Common" version="1.0.*" />
    </dependencies>
  </metadata>
  <files>
    <file src="..\Release\Alecta.VO.GRV.Common.ZOSUtil.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.csu.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.exits.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.odc.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.vwrt.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.odc.tcpip.dll" target="lib\net451" />
    <file src="..\Release\CA.Gen.odc.msgcfb.dll" target="lib\net451" />
    <file src="..\Release\Pgafs003.interfaces.dll" target="lib\net451" />
    <file src="..\Release\Pgafs003.proxy.dll" target="lib\net451" />
  </files>
</package>

nuspec file after running nuget.exe pack

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
  <metadata>
    <id>Alecta.VO.GRV.ZOSUtil</id>
    <version>1.0.14</version>
    <title>GRV ZOSUtil</title>
    <authors>S86522</authors>
     <owners>Alecta Pensionsforsakring, Omsesidigt</owners>
    <requireLicenseAcceptance>false</requireLicenseAcceptance>
   <description>Komponenter for kommunikation mellan .net och CAGentjanster</description>
    <releaseNotes></releaseNotes>
    <copyright>Copyright Alecta 2018</copyright>
    <dependencies>
      <dependency id="Alecta.VO.GRV.Common" version="1.0.0" />
    </dependencies>
  </metadata>
</package>

Verbose Logs

Project "BuildGRV.proj" (Nuget_Pack target(s)):
Exec: C:\Net\9860\App\Win\A9996ALRAMUtil\bin\Debug\BuildScripts\Util\NuGet.exe pack C:\Temp\Net\Build\s86522\9860\VO\GRV\Misc\ZOSUtil.nuspec -Verbosity detailed -BasePath C:\Temp\Net\Build\s86522\9860\VO\GRV\Misc
Exec: NuGet Version: 4.9.2.5706
Exec: Attempting to build package from 'ZOSUtil.nuspec'.
Exec:
Exec: Id: Alecta.VO.GRV.ZOSUtil
Exec: Version: 1.0.14
Exec: Authors: S86522
Exec: Description: Komponenter ommunikation mellan .net och CAGentter
Exec: Dependencies: Alecta.VO.GRV.Common [1.0.*, )
Exec:
Exec: Added file '[Content_Types].xml'.
Exec: Added file '_rels/.rels'.
Exec: Added file 'Alecta.VO.GRV.ZOSUtil.nuspec'.
Exec: Added file 'lib/net451/Alecta.VO.GRV.Common.ZOSUtil.dll'.
Exec: Added file 'lib/net451/CA.Gen.csu.dll'.
Exec: Added file 'lib/net451/CA.Gen.exits.dll'.
Exec: Added file 'lib/net451/CA.Gen.odc.dll'.
Exec: Added file 'lib/net451/CA.Gen.odc.msgcfb.dll'.
Exec: Added file 'lib/net451/CA.Gen.odc.tcpip.dll'.
Exec: Added file 'lib/net451/CA.Gen.vwrt.dll'.
Exec: Added file 'lib/net451/Pgafs003.interfaces.dll'.
Exec: Added file 'lib/net451/Pgafs003.proxy.dll'.
Exec: Added file 'package/services/metadata/core-properties/c4d68c82744e428bbf65ef7c9b54aabf.psmdcp'.
Exec:
Exec: Successfully created package 'C:\Temp\Net\Build\s86522\9860\VO\GRV\Nuget\Alecta.VO.GRV.ZOSUtil.1.0.14.nupkg'.

[nkolev92]

@fredricadell

Floating versions are not valid in the nuspec.
Only version ranges are valid in the nuspec.

https://docs.microsoft.com/en-us/nuget/reference/nuspec#dependencies-element
https://docs.microsoft.com/en-us/nuget/reference/package-versioning#version-ranges-and-wildcards

Through years of learning, NuGet basically says that the lowest version is the one that can help us get the best resolution graph.
Furthermore that should be a user, rather than author decision.

Related
#1192
#5553

[nkolev92]

Closing per the above comment.

[jameskeith]

@nkolev92 - "Floating versions are not valid in the nuspec."
If that's the case, can we at least take the Floating point example off the documentation that you have linked to:
https://docs.microsoft.com/en-us/nuget/reference/package-versioning#version-ranges-and-wildcards

The following is under the "References in .nuspec files" near the bottom.

<!-- Accepts any 6.x.y version. -->
<dependency id="ExamplePackage" version="6.*" />

I'd like to add my vote that this behaviour of taking the oldest available package version is about as clear as mud - I've not found any documentation that suggests that a .nuspec doesn't support the Wildcard notation.

[nkolev92]

@jameskeith

I have created a PR NuGet/docs.microsoft.com-nuget#1317 fixing the bad example.
The nuspec never supported floating versions.

I have also created a follow up issue to clearly call out that this is the case. https://github.com/NuGet/docs.microsoft.com-nuget/issues/1318

Regarding the dependency resolution, you can read more about it here; https://docs.microsoft.com/en-us/nuget/consume-packages/dependency-resolution

[fredricadell]

@nkolev92 @jameskeith

It would be great if the docs gets updated and more clear!

Regarding the lowest version on dependency resolution. Our solution ended up that we wrote our own component that analyze the dependency in the nuspec-file and updated it accordingly with the highest (safe) version, its a step in our buildprocess. That works for our internal components were we own the versioning pattern(semver). The 3:rd party components gets updated manually in the developement cycle so that we dont risk getting the wrong version when the buildcycle runs.

[jameskeith]

Thanks @nkolev92 - I'm fairly new to NuGet, so have spent quite a while looking through the documentation. It's great to hear that there will now be updates to clarify them for others.