System.Text.Json defines netcoreapp3.0 with no dependencies

[BrennanConroy]

Users are hitting an issue with needing to add an explicit reference to System.Text.Encodings.Web when they have System.Text.Json 5.0.0 in a netcoreapp3.1 project. I'm not sure why there is even a netcoreapp3.0 target for this package, but that's not my concern.

Looks like the regression was added between preview8 and rc1 of the 5.0.0 package.

[BrennanConroy]

@ericstj Could someone look into this as a possible 5.0.2 fix?

[ericstj]

This is because the build of System.Text.Json for netcoreapp3.0 doesn't have a reference to the "live" built System.Text.Encoding.Web, instead it references the version from the shared framework. This creates a compatibility problem because the netstandard2.0 version references a higher version of the dependency than is inbox on netcoreapp3.0

I believe this was caused by 809a06f. Previously the ref path build process would ensure that all libraries built would build against the live version of live built dependencies.

This is similar to #40208.

cc @ViktorHofer

We should review all packages to see if there are other places where this change introduced such regressions.

Tagging subscribers to this area: @safern, @ViktorHofer
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Users are hitting an issue with needing to add an explicit reference to System.Text.Encodings.Web when they have System.Text.Json 5.0.0 in a netcoreapp3.1 project. I'm not sure why there is even a netcoreapp3.0 target for this package, but that's not my concern.

Looks like the regression was added between preview8 and rc1 of the 5.0.0 package.

Author:	BrennanConroy
Assignees:	-
Labels:	area-Infrastructure-libraries, untriaged
Milestone:	-

[ViktorHofer]

Ufff. @ericstj suggestions how to protect this locally/CI to avoid future regressions?

[ericstj]

We don't have a great place today to test consistency of dependencies between two different compatible TFMs. @Anipik perhaps we can capture this in our list of things to validate packages for?

[ViktorHofer]

Can you please elaborate on "consistency of dependencies between two different compatible TFMs."?

[ericstj]

Nothing compares the dependencies referenced by a package when that package is resolved for 2 different compatible TFMs. That's the sort of testing that would need to happen here to catch this bug.

The problem is that this package, when resolved for netstandard2.0 exposes a System.Text.Encodings.Web version 5.0.0.0 assembly, but when resolved for netcoreapp3.0 it only exposes a 4.0.4.0 assembly. To catch this type of problem we'd need to evaluate restoring the packages and examining all sets of assemblies in the closure for compatibility between two different TFMs. One shortcut for this might be two compare the packages referenced (eg find that STEW 5.0.0.0 was referenced for netstandard2.0 but not for netcoreapp3.0), however we often intentionally trim package references when the assembly referenced is also inbox and we have consumers (EG: SDK) who depend on us doing this.