Nuget Dependencies and Updating

[Dan Diplo]

As Umbraco grows it is necessarily having more and more dependencies on 3rd party Nuget packages. But is there any policy on updating these dependencies? I ask, because often as a developer I might want to also reference the same package that Umbraco.Core is also referencing, but find that Umbraco had a dependency on an older version. As an example, last time I checked Umbraco was referencing Image Processor Web 3.3, but I would quite like to use the new 4.x version in the front-end of my site. Having Umbraco be dependent on older versions of packages can be quite restrictive. Other examples of old versions of packages that are referenced include JSON.net, Automapper, HtmlAgiltyPack and even things like Lucene.NET or Web API.

I appreciate that a cautious attitude to updating is needed in a project as large as Umbraco, as it can introduce breaking changes, but at the same time it can be restrictive to developers to "handicap" them with older versions. Currently if I look at an Umbraco 7.18 project in Nuget I'm told that 17 packages are able to be updated, so there are quite a lot. Is there some way around this (assembly redirects)? Or will Umbraco be looking at updating these in due course?

 

[Peter Josefson]

I know this is an old post but don't see any answers. We use imageprocessor for remote images and needed a newer version. We installed version 4.3.0.0 with NuGet and have no problems at all (with Umbraco 7.2.2).

The only thing that ever caused us problems was CookComputing.XmlRpcV2.dll - a payment provider we used in one case had a har dependency to a newer version, and Umbraco had a hard dependency to an old version. Fixed that with an assembly redirect in web.config (I didn't dare enforcing the same version by fiddling with the version numbers in assemblies, so landed on side-by-side execution).

In 7.2.2 I even managed to lift MVC and WebAPI to the latest versions (including some dependencies) without breaking anything (it seems). The NuGet packages did all that was needed (once I found all that were needed). It Just Worked(TM). I had a standalone WebAPI - written for WebAPI 5 (5.2.3) that I needed to port. Had a bitch with the routing, though, since I can't configure that the usual way. Worked around that in an ugly way (packed all GET parameters into an "id" from the client) - had not time to dig deeper. A separate post for that.

[Shannon Deminick]

Umbraco core is normally restricted to the current major versions for external dependencies, otherwise many things will generally break. For example, you cannot just put Lucene 3 in there because it's a major version change and there are huge breaking changes in it. For minor version updates, you should be able to update to the latest dependency package (i.e. Automapper 3.3.0) We restrict dependencies to the current major version in most cases because in most cases upgrading to the next major version would probably break Umbraco.

There's really not much you can do about this .... Unless you can predict the future and read minds.

For MVC and WebApi, we had to update our core to support the next major versions (after they were released of course). Luckily for us the changes weren't extreme but they did require hacks which is not something we'd like to keep doing for all major version dependency upgrades.

v8 will have all updates to all dependencies

[Peter Josefson]

Hi,

That's as it should be, of course.

However, I installed the CORS NuGET package - which in turn wanted a bunch of newer WebAPI stuff - on an Umbraco 7.2.2 and it works like a charm.

Given what you write, however, it was probably not a major version upgrade, or maybe the installer changed the version range in web.config - in either case, Umbraco has had no complaints so far.

(figuring out where to enable CORS support was a bit trycky, though, as there is no App_Start stuff in Umbraco - but I finally realized I could do it in an ApplicationEventHandler, in the ApplicationInitialized event)

/Peter

[Shannon Deminick]

That's because we've allowed for newer versions of WebApi and MVC as I mentioned - and yes it is a major version upgrade of WebApi. 

It's worth noting that 7.3 will be shipped with WebApi2 but will remain with MVC 4 because MVC 5 upgrade has far more changes that are required.

[Peter Josefson]

OK got it!

I'm very happy having CORS up and running, though, it's really simple to manage with that package. And it was a pleasant surprise that Umbraco didn't explode... :)

/Peter

[Dan Diplo]

On Thursday, 11 June 2015 13:19:39 UTC+1, Peter Josefson wrote:

I know this is an old post but don't see any answers. We use imageprocessor for remote images and needed a newer version. We installed version 4.3.0.0 with NuGet and have no problems at all (with Umbraco 7.2.2).

That's true now, as Umbraco has loosened the restriction, but at the time of posting this (back in November last year) Umbraco.Core was tied to version 3.x only, and NuGet wouldn't let you update.

I think the core team could try updating some of the dependencies to newer versions - at least see what happens. Things like Web API etc. do seem to work.