Skip to content

[WIP] Upgrade Mediator.Net and Mediator.Net.Autofac to version 4.9.1

Placeholder Copilot requested to merge copilot/upgrade-mediator-net-packages into main
  • Identify all projects referencing Mediator.Net / Mediator.Net.Autofac 4.7.0
  • Upgrade Mediator.Net and Mediator.Net.Autofac to 4.9.1 in src/Squid.Message/Squid.Message.csproj
  • Upgrade Mediator.Net and Mediator.Net.Autofac to 4.9.1 in src/Squid.Core/Squid.Core.csproj
  • Verify no known vulnerabilities in Mediator.Net 4.9.1 / Mediator.Net.Autofac 4.9.1
  • Confirm no other project files reference Mediator.Net 4.7.0
Original prompt

Problem

The CI build (Build & Publish Linux Tentacle workflow) is failing during NuGet restore with multiple NU1605 package downgrade errors in Squid.Tentacle.csproj and Squid.Message.csproj.

Failing job: https://github.com/SolarifyDev/Squid/actions/runs/24377731399/job/71194614509

The root cause is Mediator.Net.Autofac 4.7.0 depending on Autofac 4.8.1, which transitively pulls in NETStandard.Library 1.6.0 with old System.* packages. Other packages in the graph need higher versions of these System.* packages, causing downgrade conflicts:

  • System.IO.FileSystem.Primitives (4.0.1 vs 4.3.0)
  • System.Text.Encoding.Extensions (4.0.11 vs 4.3.0)
  • System.Diagnostics.Tracing (4.1.0 vs 4.3.0)
  • Microsoft.Win32.Primitives (4.0.1 vs 4.3.0)
  • System.IO.FileSystem (4.0.1 vs 4.3.0)
  • System.Net.Primitives (4.0.11 vs 4.3.0)

Solution

Upgrade Mediator.Net and Mediator.Net.Autofac from 4.7.0 to 4.9.1 in ALL projects that reference them. Version 4.9.1 depends on Autofac >= 6.0.0, which targets netstandard2.1/net6.0+ and eliminates the legacy NETStandard.Library 1.6.0 transitive dependency chain entirely.

Files to update

  1. src/Squid.Message/Squid.Message.csproj — Change both Mediator.Net and Mediator.Net.Autofac from Version="4.7.0" to Version="4.9.1"

  2. src/Squid.Core/Squid.Core.csproj — Change both Mediator.Net and Mediator.Net.Autofac from Version="4.7.0" to Version="4.9.1"

That is: in each file, update these two lines:

<PackageReference Include="Mediator.Net" Version="4.7.0" />
<PackageReference Include="Mediator.Net.Autofac" Version="4.7.0" />

to:

<PackageReference Include="Mediator.Net" Version="4.9.1" />
<PackageReference Include="Mediator.Net.Autofac" Version="4.9.1" />

No other code changes should be required as the Mediator.Net API surface is backward-compatible between these versions.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant:

I'll start by fetching the job logs and the workflow definition to understand the failure.

Assistant: Let me examine the two failing project files to understand the current package references.

Assistant:

Failing Job Analysis

The build is failing during NuGet restore with multiple NU1605 (package downgrade) errors, all treated as errors due to the WarningsAsErrors default behavior. The root cause is the transitive dependency chain:

Squid.Message → Mediator.Net.Autofac 4.7.0 → Autofac 4.8.1 → NETStandard.Library 1.6.0

Autofac 4.8.1 is a very old version that pulls in NETStandard.Library 1.6.0, which has low-version System.* dependencies. Other packages in the graph require higher versions of those same System.* packages, causing downgrade conflicts for:

  • System.IO.FileSystem.Primitives (4.0.1 vs 4.3.0)
  • System.Text.Encoding.Extensions (4.0.11 vs 4.3.0)
  • System.Diagnostics.Tracing (4.1.0 vs 4.3.0)
  • Microsoft.Win32.Primitives (4.0.1 vs 4.3.0)
  • System.IO.FileSystem (4.0.1 vs 4.3.0)
  • System.Net.Primitives (4.0.11 vs 4.3.0)

Recommended Solution

Upgrade Mediator.Net.Autofac (and Mediator.Net) to a newer version that depends on a modern Autofac (v6+), which no longer pulls in NETStandard.Library 1.6.0. In src/Squid.Message/Squid.Message.csproj:

<ItemGroup>
    <PackageReference Include="Halibut" Version="8.1.1052" />
    <PackageReference Include="Mediator.Net" Version="4.9.1" />
    <PackageReference Include="Mediator.Net.Autofac" Version="4.9.1" />
</ItemGroup>

Mediator.Net.Autofac 4.9.1 depends on Autofac >= 6.0.0, which targets netstandard2.1 / net6.0+ and eliminates the legacy NETStandard.Library 1.6.0 dependency chain entirely.

If upgrading is not feasible right now, you can work around the issue by pinning the conflicting System.* packages to their higher versions directly in src/Squid.Message/Squid.Message.csproj:

<ItemGroup>
    <PackageReference Include="Halibut" Version="8.1.1052" />
    <PackageReference Include="Mediator.Net" Version="4.7.0" />
    <PackageReference Include="Mediator.Net.Autofac" Version="4.7.0" />

    <!-- Pin to resolve NU1605 downgrade conflicts -->
    <PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
    <PackageReference Include="System.Text.Encoding.Extensions" Version="4.3.0" />
    <PackageReference Include="System.Diagnostics.Tracing" Version="4.3.0" ...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>

Merge request reports