Build fails with CS9057 error due to analyzer version compiler conflict

[martincostello]

Describe the bug

We have an internal scaffolder template we use to create new .NET applications. This template regularly updates the versions of its dependencies it uses and when a new application is scaffolded it dynamically takes the latest AWS SDK patch versions from NuGet.

This morning as part of a dependabot update and subsequent test of the generator for .NET 6, the build now fails with the following error:

    CSC : error CS9057: The analyzer assembly '/home/runner/.nuget/packages/awssdk.securitytoken/3.7.103.17/analyzers/dotnet/cs/AWSSDK.SecurityToken.CodeAnalysis.dll' references version '4.6.0.0' of the compiler, which is newer than the currently running version '4.3.0.0'. [/tmp/984e20373103b72103fd4a0204e8acfd3d668ba2/src/MyApp/MyApp.csproj]
    CSC : error CS9057: The analyzer assembly '/home/runner/.nuget/packages/awssdk.simplesystemsmanagement/3.7.104.52/analyzers/dotnet/cs/AWSSDK.SimpleSystemsManagement.CodeAnalysis.dll' references version '4.6.0.0' of the compiler, which is newer than the currently running version '4.3.0.0'. [/tmp/984e20373103b72103fd4a0204e8acfd3d668ba2/src/MyApp/MyApp.csproj]

I've not seen this in applications targeting .NET 7 (or at least, not yet).

The last successful CI was 20 hours ago, suggesting the versions published overnight have introduced this issue.

Expected Behavior

The application compiles.

Current Behavior

The application does not compile.

Reproduction Steps

Compile an application targeting .NET 6 with the 6.0.411 SDK which references the AWSSDK.SecurityToken and AWSSDK.SimpleSystemsManagement NuGet packages.

Possible Solution

Downgrade the dependency used to build the .CodeAnalysis packages to be compatible with the C# compiler that ships with the .NET 6 SDK.

Additional Information/Context

No response

AWS .NET SDK and/or Package version used

• AWSSDK.SecurityToken 3.7.103.17
• AWSSDK.SimpleSystemsManagement 3.7.104.52

Targeted .NET Platform

.NET SDK 6.0.411 and net6.0

Operating System and version

Linux

[martincostello]

Confirmed not an issue with the following package versions:

• AWSSDK.SecurityToken 3.7.103.16
• AWSSDK.SimpleSystemsManagement 3.7.104.51

[KevinD-87]

Same issue here, our automatic minor/patch version updates for NuGet packages triggered the following error in our builds:
CSC : error CS9057: The analyzer assembly '/root/.nuget/packages/awssdk.sqs/3.7.103.6/analyzers/dotnet/cs/AWSSDK.SQS.CodeAnalysis.dll' references version '4.6.0.0' of the compiler, which is newer than the currently running version '4.4.0.0'

[pablogdnd]

Same error here in
AWSSDK.ApiGatewayManagementApi.CodeAnalysis.dll
AWSSDK.DynamoDBv2.CodeAnalysis.dll
AWSSDK.S3.CodeAnalysis.dll
AWSSDK.SecretsManager.CodeAnalysis.dll
AWSSDK.SimpleSystemsManagement.CodeAnalysis.dll
AWSSDK.SQS.CodeAnalysis.dll
AWSSDK.StepFunctions.CodeAnalysis.dll

[slang25]

I think the recent upgrade of Microsoft.CodeAnalysis is a bit too restrictive in terms of the versions of the compiler tooling that it supports. I think the maintainers will want to target a version as low as feasibly possible.

Here's a mapping of the versions to VS versions to give an idea of where best to target:
https://learn.microsoft.com/en-us/visualstudio/extensibility/roslyn-version-support?view=vs-2022

[dscpinheiro]

Last week I changed the code analysis projects to target netstandard2.0 (from net45 - the commit @slang25 referenced), but on my tests I only used a net7.0 application (in VS2022).

While we work on a fix (selecting the minimal version of Microsoft.CodeAnalysis that works with netstandard), the workaround is using SDK packages released before Jun 30.

[dscpinheiro]

Update: I have an internal PR downgrading the Microsoft.CodeAnalysis dependency to version 2.10.0. Here's my test on CodeBuild (using Ubuntu and .NET 6):

Before:

$ dotnet new console
$ dotnet add package AWSSDK.SageMaker --version 3.7.142
$ dotnet build
CSC : warning CS9057: The analyzer assembly '/root/.nuget/packages/awssdk.sagemaker/3.7.142/analyzers/dotnet/cs/AWSSDK.SageMaker.CodeAnalysis.dll' references version '4.6.0.0' of the compiler, which is newer than the currently running version '4.3.0.0'. [/codebuild/output/src4008071538/src/testbefore/testbefore.csproj]
    1 Warning(s)
    0 Error(s)
Time Elapsed 00:00:07.23

After (temppkg is a local source with the modified package - as it's not available on NuGet yet):

$ cd testafter
$ cat testafter.csproj
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <RestoreSources>$(RestoreSources);../temppkg;https://api.nuget.org/v3/index.json</RestoreSources>
  </PropertyGroup>
</Project>
$ dotnet add package AWSSDK.SageMaker --version 3.7.143
$ dotnet build
  Determining projects to restore...
  All projects are up-to-date for restore.
  testafter -> /codebuild/output/src4008071538/src/testafter/bin/Debug/net6.0/testafter.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:01.30

---

Most of our team was off today due to the 4th of July, I'll follow up in the morning so that we can get this released as soon as possible.

[oshea00]

Last week I changed the code analysis projects to target netstandard2.0 (from net45 - the commit @slang25 referenced), but on my tests I only used a net7.0 application (in VS2022).

While we work on a fix (selecting the minimal version of Microsoft.CodeAnalysis that works with netstandard), the workaround is using SDK packages released before Jun 30.

And these would be patch versions. These kinds of changes would indicate a new minor version. We've been impacted twice in the last week by AWSSDK changes released as prerelease/patch changes that should arguably have been minor versions. Worth keeping an eye on

[dscpinheiro]

@oshea00 That's a good call out, this change should've been at least mentioned in the changelog (which we are doing for the fix).

What were the other changes that impacted you?