format: Cannot `dotnet format` ASP.NET Core projects

Is there an eta for a fix on this? There are a lot of issues being opened and this seems like a blocking issue for many.

This will be fixed tin the 6.0.202 SDK release. I will leave this issue open until that release is downloadable.

The matters are being conflated - Generally the CI/CD process where dotnet format gets run and where an app is hosted are different environments. The patch addresses a DoS vulnerability in runtime/hosting environments which generally isn’t a vulnerability in CI/CD processes.

However, that same patch shouldn’t break shouldn’t break everyone’s CI/CD processes that run dotnet format.

What you describe in installing the dotnet-format global tool is a workaround, and it may be a valid, good workaround, but it doesn’t “Solve the problem”

The reason that myself and possibly others are here is because the dotnet format commands in my CI/CD pipelines are now broken because of this patch release and that needs to be addressed.

Install dotnet-format dotnet tool install --global dotnet-format and use dotnet-format, to solve the problem.

The .NET 6.0.202 SDK has been released. The SDK-provided dotnet format tool works again in my environment (both in docker and directly) 🚀

I started noticing this problem yesterday. We have a test automation framework based on .NET 6 that gets built in Azure DevOps. We have a pipeline that runs to build the framework and check formatting whenever someone submits a PR.

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
  - task: UseDotNet@2
    displayName: 'Use .NET 6 SDK'
    inputs:
      version: 6.0.x
      packageType: sdk
      includePreviewVersions: false

  - task: DotNetCoreCLI@2
    displayName: 'Restore Packages'
    inputs:
      command: 'restore'

  - task: DotNetCoreCLI@2
    displayName: 'Format Check'
    inputs:
      command: 'custom'
      custom: 'format'
      arguments: '--severity warn --verify-no-changes'

  - task: DotNetCoreCLI@2
    displayName: 'Build Test Framework'
    inputs:
      command:  'build'

As you can see, the pipeline uses whatever the most recent version of the SDK is. Since 6.0.200, the format task is generating this error:

File name: 'Microsoft.CodeAnalysis, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'
System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.CodeAnalysis, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'. The system cannot find the file specified.

I was able to replicate the same thing on my local machine once I upgraded to 6.0.200. The framework itself is a pretty simple solution with four projects using using Microsoft.NET.Sdk.

@lsaudon The dotnet format command is now part of the dotnet 6.0 sdk so installing the separate dotnet-format tool should not be required - and indeed this worked with the 6.0.102 release - breaking changes should not be introduced in patch releases.

I don’t see any actual release notes for 6.0.201, but if anyone was hopeful, this is still broken.

A workaround until new SDKs are released would be to install dotnet-format as a global tool and invoke it with dotnet-format (the hyphen is important).

If you are only using .NET 6 SDKs: dotnet tool install -g dotnet-format --version "6.*" --add-source https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet6/nuget/v3/index.json

If you are previewing .NET 7 SDKs: dotnet tool install -g dotnet-format --version "7.*" --add-source https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json

@lsaudon The dotnet format command is now part of the dotnet 6.0 sdk so installing the separate dotnet-format tool should not be required - and indeed this worked with the 6.0.102 release - breaking changes should not be introduced in patch releases.

I know dotnet format is a part of the dotnet 6.0, but what is more important security patch or format code ? I think is a simple solution for use latest version of dotnet and use format too.

Also seeing this issue since I upgrade my sdk to 6.0.200

Any updates?

as pointed out in #1521 docker images for 6.0.200 have been released, so the reproducer is now much simpler:

FROM mcr.microsoft.com/dotnet/sdk:6.0.200 AS my-test

WORKDIR /app
RUN dotnet new webapp
RUN dotnet format -v diag --verify-no-changes

(note that this is the full Dockerfile, not the second stage of the build)

This issue is the same as #1433. @JoeRobich has been active in that issue and you can track the updates there.

Servicing runs on a monthly cadence, so if it’s not in the next patch-Tuesday release, it’s likely going to be in the release after that.

I’m seeing this issue in repos without any ASP.NET Core projects. Hoping this can be fixed soon to unblock moving to newer SDK versions supporting Visual Studio 17.1.

Also seeing this issue.

What I found: It still works for class library/console projects with

<Project Sdk="Microsoft.NET.Sdk">

It does not work for

<Project Sdk="Microsoft.NET.Sdk.Web">

as @ranma42 already mentioned.

I’ve had to completely disable linting in my pipeline because this just keeps happening. Disappointing. I never had issues when the tool was separate.