fix: resolve NU1506 duplicate package errors and update SDK to 1.6.29 by ANcpLua · Pull Request #3 · ANcpLua/qyl

ANcpLua · 2026-01-24T05:31:58Z

Problem

Das qyl-Projekt hatte zwei systematische Build-Probleme:

1. ❌ NU1506: Duplicate PackageVersion Errors

error NU1506: Duplicate 'PackageVersion' items found:
- ANcpLua.Analyzers 1.9.0
- Microsoft.CodeAnalysis.BannedApiAnalyzers 3.3.4
- JonSkeet.RoslynAnalyzers 1.0.0-beta.6
- Microsoft.Sbom.Targets 4.1.5

Ursache: Directory.Packages.props definierte Pakete mit Update="...", die bereits vom ANcpLua.NET.Sdk bereitgestellt wurden → Kollision beim NuGet restore.

2. ⚠️ Veraltete SDK-Versionen

SDK war bei 1.6.26, aber neueste Version ist 1.6.29 (3 Versionen veraltet)

3. 📦 Keine Dependabot-Konfiguration

Ohne Dependabot wurden SDK-Pakete nicht synchron gehalten
Manuelle Updates waren fehleranfällig

Lösung

✅ 1. Dependabot konfiguriert (`.github/dependabot.yml`)

Gruppiert alle ANcpLua.NET.Sdk* Pakete zusammen
Verhindert partielle Updates, die Version-Pin-Check-Fehler verursachen
Automatische wöchentliche Updates (Mittwoch)
Zusätzliche Gruppierungen: OpenTelemetry, Microsoft.Extensions, Testing, gRPC

✅ 2. SDK auf 1.6.29 aktualisiert (`global.json`)

- "ANcpLua.NET.Sdk": "1.6.26",
- "ANcpLua.NET.Sdk.Web": "1.6.26",
- "ANcpLua.NET.Sdk.Test": "1.6.26",
+ "ANcpLua.NET.Sdk": "1.6.29",
+ "ANcpLua.NET.Sdk.Web": "1.6.29",
+ "ANcpLua.NET.Sdk.Test": "1.6.29",

✅ 3. Package-Duplikate entfernt (`Directory.Packages.props`)

Entfernt:

❌ <PackageVersion Update="ANcpLua.Analyzers" Version="1.10.2"/>
❌ <PackageVersion Update="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="3.3.4" />
❌ <PackageVersion Update="JonSkeet.RoslynAnalyzers" Version="1.0.0-beta.6"/>
❌ <PackageVersion Include="Microsoft.Sbom.Targets" Version="4.1.5"/>

Hinzugefügt:

📝 Dokumentationskommentar, der erklärt, welche Pakete vom SDK verwaltet werden
📝 Verhindert zukünftige versehentliche Duplikate

Behalten:

✅ ANcpLua.Roslyn.Utilities* - projektspezifische Versionen

Ergebnis

✅ NU1506 Duplikat-Fehler behoben
✅ SDK auf neueste Version (1.6.29)
✅ Dependabot verhindert zukünftige Versionskonflikte
✅ Build sollte jetzt mit PublishAot=true erfolgreich sein

Testing

Nach Merge dieses PRs:

✅ dotnet restore sollte keine NU1506-Fehler mehr zeigen
✅ dotnet build sollte erfolgreich durchlaufen
✅ AOT-Publish sollte ohne Package-Version-Konflikte funktionieren
✅ Zukünftige Dependabot-PRs werden SDK-Pakete gruppiert aktualisieren

Änderungen

➕ Neu: .github/dependabot.yml (66 Zeilen)
📝 Geändert: global.json (SDK 1.6.26 → 1.6.29)
📝 Geändert: Directory.Packages.props (4 doppelte Einträge entfernt, Dokumentation hinzugefügt)

🤖 Generated with Claude Sonnet 4.5

Summary by CodeRabbit

Chores
- Added automated dependency update configuration with a weekly schedule for SDKs, packages, and actions
- Updated build SDK versions to 1.6.29
- Streamlined analyzer/package version management to reduce version conflicts
- Adjusted warning-as-error/NoWarn settings to reflect installed analyzers
Documentation
- Added an internal gRPC implementation analysis documenting architecture, trade-offs, and recommended next steps

_{✏️ Tip: You can customize this high-level summary in your review settings.}

This commit fixes the systematic build failures caused by duplicate PackageVersion errors: **Problem 1: Duplicate PackageVersion (NU1506)** - ANcpLua.Analyzers, Microsoft.CodeAnalysis.BannedApiAnalyzers, JonSkeet.RoslynAnalyzers, and Microsoft.Sbom.Targets were defined both in ANcpLua.NET.Sdk AND Directory.Packages.props - This caused NU1506 errors when building with PublishAot=true **Problem 2: Outdated SDK versions** - SDK packages were at 1.6.26, but latest is 1.6.29 (3 versions behind) **Problem 3: No Dependabot configuration** - Without Dependabot, SDK packages became out of sync and required manual updates **Changes:** 1. ✅ Created .github/dependabot.yml with SDK grouping - Groups all ANcpLua.NET.Sdk* packages together - Prevents version mismatches in future updates 2. ✅ Updated SDK versions in global.json: 1.6.26 → 1.6.29 - ANcpLua.NET.Sdk - ANcpLua.NET.Sdk.Test - ANcpLua.NET.Sdk.Web 3. ✅ Cleaned Directory.Packages.props - Removed duplicate PackageVersion entries (Update="...") - Added documentation comment explaining which packages are managed by the SDK - Kept ANcpLua.Roslyn.Utilities* as they are project-specific **Result:** - NU1506 duplicate package errors are resolved - Dependabot will keep SDK packages synchronized - Future updates will be grouped, preventing partial updates Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

gemini-code-assist · 2026-01-24T05:32:16Z

Summary of Changes

Hello @ANcpLua, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Dieser Pull Request behebt kritische Build-Probleme, die durch doppelte Paketversionen und veraltete SDKs verursacht wurden. Durch die Aktualisierung der SDK-Versionen und die Entfernung redundanter Pakete wird die Build-Stabilität wiederhergestellt. Zusätzlich wird Dependabot konfiguriert, um zukünftige Versionskonflikte proaktiv zu verhindern und die Abhängigkeiten automatisch auf dem neuesten Stand zu halten, was die Wartung vereinfacht und die Zuverlässigkeit des Projekts verbessert.

Highlights

Behebung von NU1506-Fehlern: Doppelte Paketversionen, die durch Directory.Packages.props verursacht wurden, wurden entfernt, da diese Pakete bereits vom ANcpLua.NET.Sdk bereitgestellt werden.
SDK-Aktualisierung: Die ANcpLua.NET.Sdk-Versionen in global.json wurden von 1.6.26 auf 1.6.29 aktualisiert.
Dependabot-Konfiguration: Eine neue dependabot.yml-Datei wurde hinzugefügt, um automatische wöchentliche Updates für .NET SDKs, NuGet-Pakete (mit Gruppierungen für ANcpLua SDKs, OpenTelemetry, Microsoft.Extensions, Testing und gRPC) und GitHub Actions zu ermöglichen.
Prävention zukünftiger Konflikte: Ein Dokumentationskommentar wurde in Directory.Packages.props hinzugefügt, um zu erklären, welche Pakete vom SDK verwaltet werden, und so zukünftige versehentliche Duplikate zu verhindern.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-01-24T05:32:16Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Updates add Dependabot config, bump three ANcpLua.NET.Sdk msbuild-sdks to 1.6.29, remove centrally-versioned analyzer and SBOM package entries from package props, adjust warnings settings, and add a detailed internal gRPC implementation analysis document.

Changes

Cohort / File(s)	Summary
Dependabot Configuration `\.github/dependabot.yml`	Added Dependabot config: weekly (Wednesday) updates for dotnet-sdk, NuGet, and GitHub Actions; NuGet updates grouped into SDKs, utilities, OpenTelemetry, Microsoft.Extensions, testing, and gRPC patterns.
Build SDK Version Updates `global.json`	Bumped msbuild-sdks: `ANcpLua.NET.Sdk`, `ANcpLua.NET.Sdk.Web`, `ANcpLua.NET.Sdk.Test` from `1.6.26` → `1.6.29`.
Package Version Management `Directory.Packages.props`	Removed explicit PackageVersion Update entries for analyzer packages (`ANcpLua.Analyzers`, `Microsoft.CodeAnalysis.BannedApiAnalyzers`, `JonSkeet.RoslynAnalyzers`) and removed `Microsoft.Sbom.Targets` Include; replaced with comments noting analyzers now managed by `ANcpLua.NET.Sdk`.
Warning Configuration `Directory.Build.props`, `tests/Directory.Build.props`	Removed VSTHRD* rules from WarningsAsErrors in `Directory.Build.props` and dropped `VSTHRD111` from `tests/Directory.Build.props` NoWarn list and related comment.
Documentation `docs/internal/grpc-implementation-analysis.md`	Added a comprehensive internal analysis of the project's gRPC implementation, covering architecture, protobuf handling, endpoints, streaming strategy (SSE), gaps, and recommendations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly and specifically summarizes the main changes: fixing NU1506 duplicate package errors and updating the SDK to version 1.6.29.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

Dieser Pull Request behebt die NU1506-Fehler durch das Entfernen doppelter Paketdefinitionen und aktualisiert gleichzeitig das ANcpLua.NET.Sdk auf Version 1.6.29. Zusätzlich wird Dependabot konfiguriert, um zukünftige Abhängigkeits-Updates zu automatisieren. Die Änderungen sind gut strukturiert und die hinzugefügten Kommentare in Directory.Packages.props sind sehr hilfreich, um zukünftige Fehler zu vermeiden. Ich habe einen kleinen Verbesserungsvorschlag für die Dependabot-Konfiguration, um sie konsistent mit den Änderungen an den Paketabhängigkeiten zu halten.

gemini-code-assist · 2026-01-24T05:33:05Z

+        patterns:
+          - "ANcpLua.Roslyn.Utilities*"
+          - "ANcpLua.Analyzers"
+      # Group OpenTelemetry packages


In dieser Konfiguration wird ANcpLua.Analyzers für Dependabot-Updates gruppiert. Laut den Änderungen in Directory.Packages.props wird dieses Paket jedoch jetzt vom ANcpLua.NET.Sdk verwaltet und sollte nicht mehr direkt referenziert werden, um Duplikatfehler zu vermeiden.

Um die Konfiguration konsistent zu halten und zukünftige Verwirrung zu vermeiden, empfehle ich, ANcpLua.Analyzers aus dieser Dependabot-Gruppe zu entfernen. Dependabot sollte keine Pakete verfolgen, die transitiv verwaltet werden.

**Problem:** - WarningsAsErrors referenced VSTHRD100, VSTHRD002, VSTHRD003 - NoWarn referenced VSTHRD111 - These analyzers were never installed → invalid references **Changes:** 1. ✅ Directory.Build.props - Removed VSTHRD100, VSTHRD002, VSTHRD003 from WarningsAsErrors - Added comment explaining why (analyzer never installed) - Kept critical async/dispose rules: CA1816, CA2012, CA2016 2. ✅ tests/Directory.Build.props - Removed VSTHRD111 from NoWarn - Kept CA1707 (underscores in test names) and xUnit1051 3. ✅ docs/internal/grpc-implementation-analysis.md - Added comprehensive gRPC implementation documentation - Documented current approach vs. modern alternatives (LightProto, MemoryPack) - Provides decision matrix for serialization choices - Reference for future gRPC architecture decisions **Result:** - No more warnings about missing analyzer packages - Cleaner build output - Better documentation for gRPC implementation strategy Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

… cost ModelPricingRow already carried CacheReadCost/CacheWriteCost/ReasoningCost columns but ComputeCost only priced input+output, and no span-level cache/ reasoning token fields existed -- so all three columns were dead. Transpiled from yurekami/aegis CostEntry.compute_cost (harvest #7). End-to-end wiring (sanctioned regenerate path, no hand-edited .g.cs): - collector-semantic-policy.json: projectionConstants + spanHotAttributeKeys for gen_ai.usage.cache_read/cache_creation.input_tokens + reasoning.output_tokens - regenerated CollectorSemanticAttributeCatalog.g.cs (3 new consts) - StorageAttributeProjection + SpanHotAttributeProjection: extract the 3 fields - SpanStorageRow: 3 new columns + upsert DO UPDATE SET clause - IngestionStorageMapper: map projection -> row - ComputeCost: additive per-class pricing, cache/reasoning rates fall back to input/output rate when a model omits them Token classes are disjoint (Anthropic/OpenAI report them separately) so costs add. Collector build 0W/0E; VerifyCollectorSemanticAttributeCatalog green. Also recorded scoping verdicts in yurekami-harvest.md: harvest #1/#3/#4 are REF-ONLY (already handled in qyl) -- no dead code written. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

gemini-code-assist Bot reviewed Jan 24, 2026

View reviewed changes

ANcpLua merged commit ed18659 into main Jan 24, 2026
6 of 7 checks passed

ANcpLua deleted the refactor/internal-otlp-types branch January 24, 2026 05:44

This was referenced Apr 22, 2026

feat(semconv): donation-ready NuGet packages + runtime cutover #156

Merged

feat(analyzers): 245 per-entry deprecated semconv diagnostics + codefixes #157

Merged

claude Bot mentioned this pull request May 5, 2026

chore(semconv): bump OTel semconv 1.40.0 → 1.41.0 #187

Closed

5 tasks

coderabbitai Bot mentioned this pull request May 5, 2026

Dependency Dashboard #191

Open

15 tasks

claude Bot mentioned this pull request May 10, 2026

docs: log branch hygiene SDK blocker #313

Merged

1 task

coderabbitai Bot mentioned this pull request Jun 15, 2026

Dependency Dashboard ANcpLua/Qyl.OpenTelemetry.AutoInstrumentation#7

Open

26 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: resolve NU1506 duplicate package errors and update SDK to 1.6.29 - #3

fix: resolve NU1506 duplicate package errors and update SDK to 1.6.29#3
ANcpLua merged 2 commits into
mainfrom
refactor/internal-otlp-types

ANcpLua commented Jan 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jan 24, 2026

Uh oh!

coderabbitai Bot commented Jan 24, 2026 •

edited

Loading

Other AI code review bot(s) detected

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jan 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ANcpLua commented Jan 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

1. ❌ NU1506: Duplicate PackageVersion Errors

2. ⚠️ Veraltete SDK-Versionen

3. 📦 Keine Dependabot-Konfiguration

Lösung

✅ 1. Dependabot konfiguriert (.github/dependabot.yml)

✅ 2. SDK auf 1.6.29 aktualisiert (global.json)

✅ 3. Package-Duplikate entfernt (Directory.Packages.props)

Ergebnis

Testing

Änderungen

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jan 24, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Estimated code review effort

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ANcpLua commented Jan 24, 2026 •

edited by coderabbitai Bot

Loading

✅ 1. Dependabot konfiguriert (`.github/dependabot.yml`)

✅ 2. SDK auf 1.6.29 aktualisiert (`global.json`)

✅ 3. Package-Duplikate entfernt (`Directory.Packages.props`)

coderabbitai Bot commented Jan 24, 2026 •

edited

Loading