Package registry fails to resolve NuGet dependencies correctly

Summary

When adding a new NuGet package into a project, the dependency resolution does not work correctly for some NuGet packages when using GitLab package registry. This seems to be due to different targets (e.g. .NET Framework and .NET Standard) having different dependencies and GitLab package registry just combining all of them to be the dependencies of the package.

Steps to reproduce

  1. Create a new .NET Framework 4.7.2 project in Visual Studio
  2. Add HtmlAgilityPack 1.6.5 NuGet package into a GitLab package registry
  3. Add the GitLab package registry from the previous step as a NuGet source in Visual Studio
  4. Try adding HtmlAgilityPack 1.6.5 to the project from GitLab package registry in Visual Studio
  5. While installing, the package tries to resolve dependencies, even though .NETFramework versions of the package have no dependencies. Adding package fails, because some dependencies of some other versions, which it tries to resolve, are not compatible with the project.
  6. Trying to add the package from nuget.org resolves dependencies correctly, and after adding the package into the project successfully, it can be re-fetched from GitLab package registry without problems.

What is the current bug behavior?

When adding a new package from GitLab package registry, it may fail to install, if different target frameworks have different dependencies. For an example if .NETFramework version has no dependencies and .NETStandard has some, it tries to add the .NETStandard version's dependencies into the project even if the project itself targets .NETFramework. Adding the package then fails due to incompability between some dependencies with the project. When viewing the NuGet package from Visual Studio before adding it into the project, it shows different info in the dependencies section when looking the package up from nuget.org 🆚 GitLab package registry.

What is the expected correct behavior?

When adding a NuGet package into a .NETFramework project, it should not try to resolve .NETStandard dependencies, but only resolve .NETFramework dependencies, if any. GitLab package registry should communicate with Visual Studio in a way that tells Visual Studio if some target of a package does not have any dependencies (= the same way nuget.org communicates this).

Relevant logs and/or screenshots

When trying to add HtmlAgilityPack to a new .NETFramework project directly from GitLab package registry, it tries to install all the following packages, even though .NETFramework version of the package should have no dependencies.

Microsoft.NETCore.Platforms.1.1.0
Microsoft.NETCore.Targets.1.1.0
Microsoft.Win32.Primitives.4.3.0
runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.native.System.4.3.0
runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
runtime.native.System.Security.Cryptography.OpenSsl.4.3.0
System.AppContext.4.3.0
System.Buffers.4.3.0
System.Collections.4.3.0
System.Diagnostics.Debug.4.3.0
System.Diagnostics.DiagnosticSource.4.3.0
System.Diagnostics.Tools.4.3.0
System.Diagnostics.Tracing.4.3.0
System.Globalization.4.3.0
System.Globalization.Calendars.4.3.0
System.IO.4.3.0
System.IO.Compression.4.3.0
System.Linq.4.3.0
System.Net.Primitives.4.3.0
System.Net.Sockets.4.3.0
System.ObjectModel.4.3.0
System.Reflection.4.3.0
System.Collections.Concurrent.4.3.0
System.Reflection.Emit.4.3.0
System.Linq.Expressions.4.3.0
System.Reflection.Extensions.4.3.0
System.Reflection.Primitives.4.3.0
System.Resources.ResourceManager.4.3.0
System.Runtime.4.3.0
System.IO.FileSystem.Primitives.4.3.0
System.IO.FileSystem.4.3.0
System.Runtime.Extensions.4.3.0
System.Runtime.Handles.4.3.0
System.Runtime.InteropServices.4.3.0
System.Runtime.InteropServices.RuntimeInformation.4.3.0
System.Runtime.Numerics.4.3.0
System.Text.Encoding.4.3.0
System.Console.4.3.0
System.IO.Compression.ZipFile.4.3.0
System.Text.Encoding.Extensions.4.3.0
System.Text.RegularExpressions.4.3.0
System.Threading.4.3.0
System.Threading.Tasks.4.3.0
System.Security.Cryptography.Primitives.4.3.0
System.Security.Cryptography.Encoding.4.3.0
System.Security.Cryptography.Algorithms.4.3.0
System.Security.Cryptography.X509Certificates.4.3.0
System.Net.Http.4.3.0
System.Threading.Timer.4.3.0
System.Xml.ReaderWriter.4.3.0
System.Xml.XDocument.4.3.0
NETStandard.Library.1.6.1
HtmlAgilityPack.1.6.5

When installing the package directly from nuget.org instead of the GitLab package registry, it only shows this as the list of packages to be installed instead of the list above.

HtmlAgilityPack.1.6.5

When browsing packages in Visual Studio, the nuget.org version lists out that the .NETFramework versions of the package have "No dependencies", but the versions in GitLab package registry do not show .NETFramework versions at all, even though the actual NuGet packages are identical. The GitLab package registry version of the package only shows dependencies for the targets that have dependencies, and does not show anything for the targets that do not have any, even though it should show "No dependencies" for them.

Contributing

I don't currently have time to contribute to fixing this issue myself, but will provide additional information if required.

Edited by 🤖 GitLab Bot 🤖