sdk: NU1505: Duplicate 'PackageDownload' items warning is raised when the SDK uses PackageDownload to get packages.

It’d be nice if this error message actually pointed to the file/source locations of the project/props/target files that are including these references. I hit this issue with the new warnings in our project, but I’m just referencing the SDK and such, so no idea where the extra package reference is coming from. Changed the PackageReference from Include to Update for now to get around it… 🤷‍♂️

Hey folks, we have a good idea what happened and what the path forward is now.

Cause

NuGet in VS is independent of the NuGet shipped with the SDK. The NuGet in VS has gotten ahead of the SDK, and it includes the additional validation for duplicate PackageDownloads and PackageReferences. As a result, when the NuGet in VS interacts with a project that uses an SDK that contains the PackageDownload duplication bug, these errors appear for users.

Mitigation

All of these duplicate checks are guarded by an MSBuild condition. If you set DisableCheckingDuplicateNuGetItems to true in your project files, the error should go away. You can also set the error codes to NoWarn like so: <NoWarn>$(NoWarn);NU1505</NoWarn>. Note that since the SDK has had this bug lying latent for a while, simply moving to an older SDK version will not remove the issue. Theoretically you could also move to preview releases of either the 6.0.400 or 7.0.100 SDKs and the issue would resolve itself as well, since the SDK was fixed on both of those branches.

Resolution

The SDK will ship version 6.0.400 in VS 17.3, so it was just a matter of time until we did an insertion to that preview. We will accelerate our timeline and do the insertion early next week (after dotnet/installer#13827 merges). That will unblock the internal dogfood previews of 17.3 for internal Microsoft users. For the broader public, this will not be fixed until 17.3 Preview 2 is released, which should be roughly a month from now.

I’m not sure on the urgency for this, but for what it’s worth it cost me a lot of time today and for others that pinged me as well. A lot of builds have warnings as errors deeply embedded in there and we’re all hacking at this passing in overrides for the properties to get by the current issue locally but for tomorrow I think it’s easier for me to uninstall the preview completely. I haven’t had to revert from a preview build in over a year now so this one is pretty serious IMO. I hope it makes a new preview build quickly for others hitting the issue - I think it warrants faster than a normal cadence from the number of reports I’m seeing.

@julealgon

The NU1504, NU1505 and NU1506 warnings were added in Visual Studio 17.3, NuGet.exe 6.3 and .NET SDK 6.0.400. All those tooling versions contain the same NuGet bits.

It appears that the check is blindly looking at the presence of PackageReference elements, ignoring whether or not they are conditionally added.

That shouldn’t be the case as the check is running as part of a target that’s run for each framework, so the conditions will be evaluated.

I can’t really say why you’re seeing the intermittent behavior, but if you are seeing issues with things that aren’t coming from the SDK (such as the NU1505 warnings for packages that are added by the SDK), I’d recommend filling a new issue.

You can file issues with questions about NU1504 in the NuGet/Home repo.

Hello. Still having the problem for me using VS 2022 Pro 17.3.0 x64 Fr (up to date) : “Duplicate ‘PackageDownload’ items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate ‘PackageDownload’ items are: Microsoft.NETCore.App.Ref [5.0.0], Microsoft.NETCore.App.Ref [3.1.0], Microsoft.NETCore.App.Ref [3.0.0]; Microsoft.WindowsDesktop.App.Ref [5.0.0], Microsoft.WindowsDesktop.App.Ref [5.0.0], Microsoft.WindowsDesktop.App.Ref [5.0.0], Microsoft.WindowsDesktop.App.Ref [3.1.0], Microsoft.WindowsDesktop.App.Ref [3.1.0], Microsoft.WindowsDesktop.App.Ref [3.1.0], Microsoft.WindowsDesktop.App.Ref [3.0.0], Microsoft.WindowsDesktop.App.Ref [3.0.0], Microsoft.WindowsDesktop.App.Ref [3.0.0]; Microsoft.AspNetCore.App.Ref [5.0.0], Microsoft.AspNetCore.App.Ref [3.1.10], Microsoft.AspNetCore.App.Ref [3.0.1]. Nolme.Core6 C:\Users[…]\Nolme.Core6.csproj”

Installed applications :

• Microsoft .NET SDK 6.0.400 (x64) from Visual Studio
• Microsoft ASP.NET Core 6.0.8 - Shared Framework (both x86 & x64)
• Microsoft Windows Desktop Runtime - 6.0.8 (both x86 and x64

The project is attached. I found no mention of these packages 😦

Nolme.Core6.zip

@nkolev92 The repro project: Netcoreapp.zip

@baronfel I just hit what appears to be an invalid case for this warning. I have some packages conditionally added in my Directory.Build.props file, but those are now being detected as duplicates even though the condition for the inclusion is false in the offending project.

Here is an example: Directory.Build.props (slightly simplified version of my real one)

<Project>

  <PropertyGroup>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>

    <IsUnitTestProject>false</IsUnitTestProject>
    <IsUnitTestProject>$(MSBuildProjectName.EndsWith('.UnitTests'))</IsUnitTestProject>
  </PropertyGroup>

  <ItemGroup Condition="$(IsUnitTestProject)">
    <Using Include="FluentAssertions" />
    <Using Include="FluentAssertions.Execution" />
    <Using Include="NSubstitute" />
    <Using Include="Xunit" />

    <PackageReference Include="FluentAssertions" Version="6.7.0" />
    <PackageReference Include="FluentAssertions.Analyzers" Version="0.17.2">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.2.0" />
    <PackageReference Include="NSubstitute" Version="4.4.0" />
    <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.15">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="coverlet.collector" Version="3.1.2">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
    <PackageReference Include="xunit" Version="2.4.1" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
  </ItemGroup>

</Project>

MyProject.Which.Is.Not.A.UnitTest.Project.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>net6.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="FluentAssertions" Version="6.7.0" />
    <PackageReference Include="FluentAssertions.Analyzers" Version="0.17.2">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="MediatR" Version="10.0.1" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.2.0" />
    <PackageReference Include="NSubstitute" Version="4.4.0" />
    <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.15">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="xunit.core" Version="2.4.1" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
  </ItemGroup>

</Project>

Error:

Error NU1504 Duplicate ‘PackageReference’ items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate ‘PackageReference’ items are: FluentAssertions 6.7.0, FluentAssertions 6.7.0; FluentAssertions.Analyzers 0.17.2, FluentAssertions.Analyzers 0.17.2; Microsoft.NET.Test.Sdk 17.2.0, Microsoft.NET.Test.Sdk 17.2.0; xunit.runner.visualstudio 2.4.5, xunit.runner.visualstudio 2.4.5.

It appears that the check is blindly looking at the presence of PackageReference elements, ignoring whether or not they are conditionally added.

I added the above code to Directory.Build.props as a means to share common setup across dozens of unit testing projects, but I have a couple of “testing libraries” that are not considered “unit test projects”, but still rely on some of the same packages that unit test projects do.

This was working fine until I updated Visual Studio to latest versions (I’m using 17.3.1 right now). It is possible it was introduced in 17.3.0 but I actually don’t remember if I tried to build this project in between those 2 updates.

Note that my example here has nothing to do with SDK packages… its throwing for explicit libraries that I have in the projects.

I’ll add the ignore flag for now until this is fixed.

FAKE EDIT:

While I was posting this, I decided to try to create a “minimal repro” in a test solution here. Weirdly enough, it actually took a while to happen and I don’t know exactly what triggers it…

I had to keep adding new projects, fiddling with the variables in Directory.Build.props and suddenly it started throwing the warning. Then, I undid some of the stuff, built again, and it stopped raising the warning. When I got back to a previous version that was raising the warning before, it just kept working… I have no idea why it is intermittent like that.

Hi @lonix1 - it looks like your warning isn’t raised by the SDK’s use of PackageDownloads (which was the cause of this issue). Your issue seems to be because you’re using different PackageDownload elements with different versions, and that’s not how CentralPackageManagement works (at least as far as I’m aware). CPVM requires your Directory.Package.Props to have PackageVersion items, not PackageDownload, and your project files to have PackageReference items, not PackageDownload. Can you try making those changes and see if your problem is resolved?

@baronfel Thanks for the information! Will upgrade the SDK to net6 and try again.

For anyone who runs into the same issue – after upgrading the SDK version, the issue is resolved.

And if you are out there wondering where to put the <NOWARN> tag like I was

near the top of MyGreatApp.csproj

<PropertyGroup> <TargetFramework>net6.0</TargetFramework> <DockerDefaultTargetOS>Linux</DockerDefaultTargetOS> <NoWarn>NU1505</NoWarn>
</PropertyGroup>

great to find this page.

@NickCraver It’s not the ideal situation for sure! I’ll see what levers I can pull for a faster fix on the public release, though.