From ddad5a551f435c53568d7c91df3caf3b36b4bb80 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 8 Sep 2026 11:39:40 -0400 Subject: [PATCH 1/2] fix(generators): floor Microsoft.CodeAnalysis.CSharp to the .NET 8 SDK's Roslyn version Compono.Generators.dll (the packaged, shipped analyzer) was built against Microsoft.CodeAnalysis.CSharp 5.9.0. Roslyn's own analyzer-loading gate refuses to load an analyzer built against a NEWER compiler than the host's own - silently, with only a build warning (CS9057), never an error - so on the .NET 8/9/10 STABLE SDKs (bundled Roslyn 4.11.0.0/ 4.14.0.0/5.0.0.0, all older than 5.9.0.0) the generator simply never ran. A consuming Composer.Create() then failed at runtime with a misleading "no generated plan" CompositionException instead of a build-time signal pointing at the real cause. This repo's own CI, and both real dogfood consumers (alexa-vox-craft, trivia-platform), all pin an 11.0-preview SDK, so nothing caught this - every officially-supported target (net8.0/net9.0/net10.0/net11.0) except the one this repo's own tooling happens to run on was silently broken. Confirmed empirically, before and after, via a throwaway consumer built against each of the four SDKs (8.0.408/9.0.304/10.0.103/11.0.100-preview.7), using a scenario that exercises constructor composition, Share() graph-wide identity, and a Compono.TestDoubles-generated interface double - not just a trivial root type. Before: CS9057 + CompositionException on 8/9/10. After: identical, correct output (same deterministic seed) on all four. Also verified via a real PublishAot run under the .NET 10 SDK directly (not the repo's own 11.0-preview SDK). - Directory.Packages.props: floor Microsoft.CodeAnalysis.CSharp to 4.11.0 (the .NET 8 SDK's own bundled compiler version, not a version chosen arbitrarily) - Compono.Generators is the only project this centrally governs that's actually packed/shipped as an analyzer. - Compono.Benchmarks/Compono.Generators.Tests: neither is packed/shipped, and both need LanguageVersion.CSharp14 (undefined below ~5.x) for their own in-process CSharpGeneratorDriver use against net10.0/net11.0 targets - VersionOverride="5.9.0" keeps them on the newer version they actually need without affecting the shipped analyzer's own compile. - .github/dependabot.yml: ignore all automated updates to Microsoft.CodeAnalysis.CSharp - this floor is a deliberately cross-SDK-verified decision, not something that should move via an unattended bump (this repo's own CI wouldn't catch a regression here, since it pins the 11.0-preview SDK). Full solution: dotnet build (0 warnings/errors) and dotnet test (3737/3737 passed). Package-validation (inspect-packed-nupkgs.sh) green for all twelve packages. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01NiVv392P3m46azTD1TpU3s --- .github/dependabot.yml | 16 +++++++++++++++ Directory.Packages.props | 14 ++++++++++++- .../Compono.Benchmarks.csproj | 20 +++++++++++-------- .../Compono.Generators.Tests.csproj | 9 ++++++++- 4 files changed, 49 insertions(+), 10 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8fb52460..a1406cde 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -34,6 +34,22 @@ updates: - "major" patterns: - "*" + ignore: + # Directory.Packages.props' central Microsoft.CodeAnalysis.CSharp pin is deliberately + # floored to the .NET 8 SDK's own bundled Roslyn compiler version (4.11.0), not the latest + # available - Compono.Generators.dll (the packaged, shipped analyzer) is built once against + # this version and loaded as-is by every consumer's host compiler regardless of their own + # TargetFramework. A newer Roslyn compiler always loads an older-referenced analyzer fine + # (forward-compatible), but the reverse silently fails: Roslyn's own analyzer-version gate + # (CS9057) refuses to load an analyzer built against a NEWER compiler than the host's own, + # with only a build warning, not an error - the generator then just never runs, and a + # consumer's Composer.Create() fails at runtime with a misleading "no generated plan" + # CompositionException instead of a build-time signal pointing at the real cause. Confirmed + # empirically: bumping this above 4.11.0 breaks the .NET 8/9/10 STABLE SDKs (this repo's own + # CI pins an 11.0-preview SDK, so CI alone would not catch a regression here). Raising this + # floor is a deliberate, manually-verified decision (re-run the cross-SDK empirical check + # this ignore rule's own commit performed), not something to accept via an automated bump. + - dependency-name: "Microsoft.CodeAnalysis.CSharp" - package-ecosystem: "github-actions" directory: "/" diff --git a/Directory.Packages.props b/Directory.Packages.props index dbfcd59e..18827f79 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -184,7 +184,19 @@ PrivateAssets="all" so they never leak to consumers - see docs/adr/0003-generator-package-distribution.md. --> - + + - - + + + - + supported SDK's actual GA compiler version is correct and sufficient; it isn't a floor that + needs bumping merely because a newer package version exists - see + docs/adr/0003-generator-package-distribution.md's Amendment 1. -->