Microsoft.Graph.Beta5.115.0-preview requires Microsoft.Bcl.Memory.9.0.0

[svrooij]

When upgrading from Microsoft.Graph.Beta.5.94.0-preview to Microsoft.GRaph.Beta.5.115.0-preview I noticed that Microsoft.Bcl.Memory 9.0.0 was installing.

This package explicitly states, in the readme:

This library is not necessary nor recommended when targeting versions of .NET that include the relevant support.

So the question is, when targeting net8.0 why is this package even installed? And apart from that, can we do something about that. We don't want to go the same mess with all the Azure.* packages.

[Frulfump]

https://www.nuget.org/packages/Microsoft.Graph.Beta/5.115.0-preview#dependencies-body-tab
Shows

What's pulling in Microsoft.Bcl.Memory 9.0.0 if you are using .NET 8 SDK 8.0.400 or later.
https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-why using dotnet nuget why Microsoft.Bcl.Memory should give some leads.
Created dotnet/runtime#117647 to see if the README can be updated and preferably an analyzer created to warn when these packages are used where they shouldn't.

[svrooij]

@Frulfump here is the culprit I think.... https://www.nuget.org/packages/Microsoft.Kiota.Authentication.Azure/#dependencies-body-tab

[Frulfump]

@svrooij hmm I don't think so, I tried this

(rg is ripgrep https://github.com/BurntSushi/ripgrep)

Adding a global.json since I have the .NET 10 preview 5 installed as well
https://www.nuget.org/packages/Microsoft.Graph.Core/#dependencies-body-tab shows Microsoft.Kiota.Authentication.Azure as a dependency. So I didn't install that specifically.

➜ dotnet new global.json --sdk-version 9.0.302
The template "global.json file" was created successfully.

➜ dotnet new console
The template "Console App" was created successfully.

Processing post-creation actions...
Restoring C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948.csproj:
Restore succeeded.

➜ dotnet add package Microsoft.Graph.Beta --version 5.115.0-preview

Build succeeded in 0,4s
info : X.509 certificate chain validation will use the default trust store selected by .NET for code signing.
info : X.509 certificate chain validation will use the default trust store selected by .NET for timestamping.
info : Adding PackageReference for package 'Microsoft.Graph.Beta' into project 'C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948.csproj'.
info : Restoring packages for C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948.csproj...
info :   CACHE https://api.nuget.org/v3/vulnerabilities/index.json
info :   CACHE https://api.nuget.org/v3-vulnerabilities/2025.07.10.23.23.28/vulnerability.base.json
info :   CACHE https://api.nuget.org/v3-vulnerabilities/2025.07.10.23.23.28/2025.07.15.05.23.42/vulnerability.update.json
info : Package 'Microsoft.Graph.Beta' is compatible with all the specified frameworks in project 'C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948.csproj'.
info : PackageReference for package 'Microsoft.Graph.Beta' version '5.115.0-preview' added to file 'C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948csproj'.
info : Generating MSBuild file C:\repos\repros\msgraph-sdk-dotnet\issue2948\obj\issue2948.csproj.nuget.g.targets.
info : Writing assets file to disk. Path: C:\repos\repros\msgraph-sdk-dotnet\issue2948\obj\project.assets.json
log  : Restored C:\repos\repros\msgraph-sdk-dotnet\issue2948\issue2948\issue2948.csproj (in 194 ms).

➜ dotnet nuget why Microsoft.Bcl.Memory
Project 'issue2948' does not have a dependency on 'Microsoft.Bcl.Memory'.

➜ rg Microsoft.Bcl.Memory -i -n
<Empty output>

So it must(should) be something else causing Microsoft.Bcl.Memory 9.0.0 to be installed.
I think Visual Studio can some times show why things are transitively referenced https://devblogs.microsoft.com/dotnet/introducing-transitive-dependencies-in-visual-studio/ the third image specifically.