NuGet Newtonsoft.Json dependency


The Logging Application Block has a reference on Newtonsoft.Json.dll, but the corresponding NuGet package (EnterpriseLibrary.Logging) does not have a dependency on it. This can result in a hard to spot bug, when used in a class library.

If the class library has added the EnterpriseLibrary.Logging package, but has not added the Newtonsoft.Json package, it will not get an explicit reference to Newtonsoft.Json. When compiling the project however, the Newtonsoft.Json assembly will be pulled in from the system, since EnterpriseLibrary.Logging has a reference to it. This will be an old version of Newtonsoft.Json.

Next, if you reference this class library from another project, and do have an explicit reference to Newtonsoft.Json (a newer version), the Newtonsoft.Json assembly will be overwritten by the old version from the class library.
    [nuget] EnterpriseLibrary.Logging 6.0.1304 (indirect reference: [system] Newtonsoft.Json

    [nuget] Newtonsoft.Json 7.0.1
The "Newtonsoft.Json 7.0.1" reference will be overwritten by the implicit "Newtonsoft.Json" reference in ClassLibrary1 when compiling. An unaware user will scratch his/her head and wonder where the file came from.

If you add a reference to "Newtonsoft.Json 7.0.1" in ClassLibrary1, everything works out fine. The correct version will end up in WpfApplication1.

To fix this, you could add a NuGet dependency on Newtonsoft.Json in the EnterpriseLibrary.Logging package, and this reference will get added automatically. The user will be able to see, and update, the reference to whatever version of Newtonsoft.Json s/he wants.

EnterpriseLibrary.SemanticLogging on the other hand, does have a dependency on Newtonsoft.Json.


jimmy_b wrote Aug 5, 2015 at 3:11 PM

+1 from me. This has also caused me a lost of lost time on our build server.

Ymris wrote Sep 10, 2015 at 1:45 PM

+1 for also spending a considerable amount of time on this issue.

sbattagl wrote Sep 10, 2015 at 5:43 PM

I, too have spent many hours over this issue. In my situation, however, it was pulling the old version from a Blend directory under the Visual Studio install directory. I ended up deleting this version and adding an assembly redirect to my machine.config and had all the developers on my team do the same. "All this could've been avoided if Woody went right to the police!"