Skip to content

Add guidance for .NET library dependency versions - #49958

Open
ericstj wants to merge 8 commits into
mainfrom
library-guidance-dependencies-net
Open

ericstj wants to merge 8 commits into
mainfrom
library-guidance-dependencies-net

Conversation

@ericstj

@ericstj ericstj commented Nov 18, 2025 •

Copy link
Copy Markdown
Member

This is first draft. I might be assuming too much familiarity with the problem space. Please provide feedback 🤝


Internal previews

File Preview link
docs/standard/library-guidance/dependencies-net.md Learn preview
docs/standard/library-guidance/toc.yml Learn preview

Build report

Added guidance for selecting .NET library dependency versions, including strategies, tradeoffs, and recommendations for library authors.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR introduces comprehensive guidance for .NET library authors on selecting dependency versions when targeting multiple .NET framework versions. The document outlines three primary strategies (latest supported versions, TFM-specific versions, and branching), their tradeoffs, and provides concrete recommendations with code examples.

Key changes:

  • New guidance document explaining dependency version selection strategies for .NET libraries.
  • Decision matrix comparing engineering, servicing, and update friction costs across strategies.
  • Code examples demonstrating each approach using System.Text.Json references.

Show contrast to framework overlapping package and not.
@ericstj

ericstj commented Nov 24, 2025

Copy link
Copy Markdown
Member Author

I've addressed all feedback, please have another pass at this. Thank you.

@BillWagner

Copy link
Copy Markdown
Member

@ericstj Do you want to address the remaining comments, or should I close this?

@ericstj

ericstj commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

Let me have a look, I'm working in a different space these days, but this doc needs to exist. Let me get it in.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 564e1515-0383-4989-8ea6-7271524e9539
@ericstj

ericstj commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

@BillWagner I addressed feedback, PTAL

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The example selects vulnerable System.Text.Json 8.0.0, which runtime servicing will not replace on net6.0/net7.0, and the support-lifetime guidance could lead to incorrect servicing plans.

2 open issues

Review effort: Balanced

</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.0" />
<PackageReference Include="System.Text.Json" Version="8.0.0" />

> [!NOTE]
>
> - The lifetime of the latest Standard Term Support (STS) release aligns with the latest Long Term Support (LTS) release, so choosing "latest" effectively means choosing the latest supported version regardless of STS or LTS designation. For current support dates, see the [.NET support policy](https://dotnet.microsoft.com/platform/support/policy/dotnet-core).
@ViktorHofer

Copy link
Copy Markdown
Member

@ericstj thanks for finishing the doc. Very much appreciated 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants