Libraries building against packages instead of ProjectReferences

[ericstj]

Description

First noted here: 809a06f#comments

After switching to PackageReference we are bringing in some transitive packages that are older than live-built assets. In this case, System.Runtime.CompilerServices.Unsafe.

We should audit all of our library builds to make sure we aren't doing this in additional places.

It may be possible for us to automatically do this, but it it could get a little tricky (and expensive) to do during source build, as we would need to check for every package referenced by src if we have a src project for it for the target configuration and its building live. Perhaps we can add coverage in package testing for this.

Regression?

Yes, regressed from Preview8

Tagging subscribers to this area: @safern, @ViktorHofer
See info in area-owners.md if you want to be subscribed.

[ViktorHofer]

@ericstj the link isn't resolving for me correctly. Where do you see a live build asset not be preferred over a packagereference?

[ericstj]

System.Text.Json -> It's getting a System.Runtime.CompilerServices.Unsafe reference transitively from packages rather than a project reference. I was looking at the net4* configuration.

[ericstj]

@ViktorHofer were you going to have a look at this one now that you're back?

[ViktorHofer]

Yeah will take a look

[ViktorHofer]

Moving to 6.0 as this will likely not meet the bar for 5.0.