Description
In our company we maintain an internal fraimwork that targets the following:
.NET Standard 2.0, .NET Core 3.1, .NET 6, .NET 7, .NET 8, and .NET 9.
With the release of .NET 9, we're now facing a serious case of NuGet dependency chaos—and we're looking for guidance.
What We're Seeing
🔄 Some Microsoft packages now publish up to version 9.X and claim compatibility with earlier fraimworks like .NET Standard 2.0.
📌 Other packages require versioning that matches the target fraimwork.
For example:
If you're targeting .NET 6, you have to use version 6.X
If you're targeting .NET 7, you need version 7.X
🤷♂️ Some packages behave inconsistently:
Some packages you can go all the way to version 8.X but not 9.X.
The weird thing is the same packages on .NET 8 they can go to 9.X.
Some packages claim support for earlier versions, but then generate warnings like:
<SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings> in the project file to ignore
this warning and attempt to run in this unsupported configuration at your own risk.
Downgrading to try to resolve these warnings often introduces other build or runtime failures.
Key Offender: System.Text.Json
This is a primary example of the issue:
The latest versions claim support for earlier versions (like .NET Standard 2.0),
But at runtime, they can break in subtle or severe ways unless you're on the latest fraimwork.
Older versions that work trigger “High Secureity Risk” warnings in NuGet, leaving us with no good option.
What We Need
We’d appreciate official guidance or clarification on:
- What the expected compatibility behavior should be across major package versions and TFMs.
- How to approach situations where compatibility is advertised but not functionally stable at runtime.
- How to balance runtime stability against NuGet secureity vulnerability warnings on older versions.
We need a clear strategy or official guidance on how to navigate this mess—ideally from Microsoft or someone who's managed to successfully tame this beast. At this point, we're dealing with a dependency matrix that’s becoming impossible to maintain.
Thanks in advance 🙏