Bug: Azure DevOps Artifact Feed set wrong Package Dependencies - azure-devops

Question

We use our private Artifacts Feed on Azure DevOps Server 2020.1 (on-prem). I get a feed MyFeed and a feed MyFeedTest. I use the MyFeedTest for Staging our NuGet Packages. When they are stable, they get pushed to MyFeed. If a NuGet package in the feed has a dependency on another NuGet package in the feed, I use the following line:
<PackageReference Include="ext.lib.MyPackage" Version="*" />
The issue here is that the Azure DevOps Server determines the dependency by itself, and it takes the Versions from the staging package in MyFeedTest for the packages in MyFeed even when the package MyFeedTest get unlist, even when the whole feed MyFeedTest get deleted.
The Azure DevOps Artifact should not determine the dependencies to another package by itself, and it should not ignore the defined dependency setting inside the package project file (Version="*").
In the end, my collogues get the following error in Visual Studio:
The Dependencies of the Package ext.lib.MyPackage on Azure DevOps Server looks like:
But to remember, the package ext.lib.DevExpress in Version 13.1.5.3 do not exist after deleting the whole feed MyTestFeed.
So how can I solve that? Is it possible to configure the Azure DevOps Server to not behave like this? We can't use staging with that mechanism.

Answer 1

The issue here is that the Azure DevOps Server determines the
dependency by itself
This is not determined by Azure DevOps Server, but resolved by NuGet. Version="*" means the highest stable version. Here is the document about Floating version resolutions.
I used dotnet CLI to create NuGet package. Here is my sample:
1.Add package reference in the "*.csproj" file.
<ItemGroup>
<PackageReference Include="ext.lib.MyPackage" Version="*" />
</ItemGroup>
2.Use dotnet pack command to build a NuGet package. This will generate a "*.nupkg" file. Change the suffix of this file to zip and extract files.
3.We can find a "*.nuspec" file. Open this file with Notepad, we can find the following content:
<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
<metadata>
<id>ext.lib.DevExpress</id>
<version>3.2.1</version>
<authors>ext.lib.DevExpress</authors>
<requireLicenseAcceptance>false</requireLicenseAcceptance>
<description>Package Description</description>
<dependencies>
<group targetFramework="net5.0">
<dependency id="ext.lib.MyPackage" version="1.2.3" exclude="Build,Analyzers" />
</group>
</dependencies>
</metadata>
</package>
So we can find that before this package is pushed to Azure DevOps, the dependencies of the package have been resolved to explicit versions and this is the expected behavior.
If you don't need ext.lib.DevExpress as dependencies any more, you need to remove this package reference in your ext.lib.MyPackage and push your package again.