`upgrade --version` installs a different target version after dependency resolution retry

Checklist

• I confirm there are no unresolved issues reported on the Chocolatey Status page.
• I have verified this is the correct repository for opening this issue.
• I have verified no other issues exist related to my problem.
• I have verified this is not an issue for a specific package.
• I have verified this issue is not security related.
• I confirm I am using official, and not unofficial, or modified, Chocolatey products.

What You Are Seeing?

When upgrading a package with an explicit --version, Chocolatey initially queries the requested version correctly. If the first dependency-resolution attempt fails, Chocolatey retries using additional package information and considers other available versions of the explicitly requested target package.

The retry can then install a different, newer version of the target package than the version supplied through --version.

In this case:

• Installed target version before the operation: 12.5.2
• Explicitly requested target version: 12.4.2
• Version actually installed: 12.5.6

The command completed successfully with exit code 0.

Package IDs, the private repository hostname, and private paths in the log below have been replaced with generic values. Version numbers are unchanged.

What is Expected?

--version 12.4.2 should be a hard constraint on the package explicitly named in the command.

Chocolatey may resolve, install, upgrade, or downgrade that package's dependencies as necessary. However, it should never substitute another version of the explicitly requested target package.

If no valid dependency graph exists for target-package version 12.4.2, the operation should fail without changing the target package.

The acceptable outcomes are therefore:

1. Install exactly target-package version 12.4.2 with a compatible dependency graph.
2. Fail dependency resolution and make no target-package change.

Installing target-package version 12.5.6 is not an acceptable outcome when --version 12.4.2 was specified.

How Did You Get This To Happen?

The target package was already installed at version 12.5.2.

The following command attempted to downgrade it to 12.4.2:

choco upgrade target-package --version 12.4.2 -y --allowdowngrade --ignore-package-exit-codes --no-progress

The system also contained packages with dependency constraints involving the target package. The initial dependency-resolution attempt failed, triggering Chocolatey's additional-information retry.

During the retry, Chocolatey enumerated other versions of the target package and selected version 12.5.6.

Relevant Sanitized Log

[INFO ] - Chocolatey v2.7.3

[DEBUG] - Command line: C:\ProgramData\chocolatey\choco.exe upgrade target-package --version 12.4.2 -y --allowdowngrade --ignore-package-exit-codes --no-progress
[DEBUG] - Received arguments: upgrade target-package --version 12.4.2 -y --allowdowngrade --ignore-package-exit-codes --no-progress

[DEBUG] - Configuration: CommandName='upgrade'|
Input='target-package'|
Version='12.4.2'|AllVersions='False'|
PackageNames='target-package'|
IgnoreDependencies='False'|
AllowDowngrade='True'|

[INFO ] - [NuGet] GET https://private-source.example/api/nuget/chocolatey/Packages(Id='target-package',Version='12.4.2')
[INFO ] - [NuGet] OK https://private-source.example/api/nuget/chocolatey/Packages(Id='target-package',Version='12.4.2')

[WARN ] - [NuGet] One or more unresolved package dependency constraints detected in the Chocolatey lib folder. All dependency constraints must be resolved to add or update packages. If these packages are being updated this message may be ignored, if not the following error(s) may be blocking the current package operation:
'dependent-package-a 3.10.2 constraint: target-package (>= 4.9.8 && < 13.0.0)',
'dependent-package-b 6.21.0 constraint: target-package (>= 11.18.6 && < 13.0.0)'

[WARN ] - Re-attempting package dependency resolution using additional available package information...

[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?id='target-package'&semVerLevel=2.0.0
[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?semVerLevel=2.0.0&id=%27target-package%27&%24skip=100
[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?semVerLevel=2.0.0&id=%27target-package%27&%24skip=200
[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?semVerLevel=2.0.0&id=%27target-package%27&%24skip=300
[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?semVerLevel=2.0.0&id=%27target-package%27&%24skip=400
[INFO ] - [NuGet] CACHE https://private-source.example/api/nuget/chocolatey/FindPackagesById()?semVerLevel=2.0.0&id=%27target-package%27&%24skip=500

[DEBUG] - Package download location 'https://private-source.example/api/nuget/chocolatey/Download/target-package/12.5.6'
[INFO ] - [NuGet] GET https://private-source.example/api/nuget/chocolatey/Download/target-package/12.5.6
[INFO ] - [NuGet] OK https://private-source.example/api/nuget/chocolatey/Download/target-package/12.5.6

[INFO ] - [NuGet] Acquiring lock for the installation of target-package 12.5.6
[INFO ] - [NuGet] Acquired lock for the installation of target-package 12.5.6
[INFO ] - [NuGet] Installed target-package 12.5.6 from https://private-source.example/api/nuget/chocolatey

target-package v12.5.6

[INFO ] - The upgrade of target-package was successful.

Chocolatey upgraded 2/2 packages.
[DEBUG] - Exiting with 0

The log demonstrates that:

1. Chocolatey parsed Version='12.4.2'.
2. Chocolatey initially queried target-package version 12.4.2.
3. Dependency resolution triggered the additional-information retry.
4. The retry enumerated all available versions of target-package.
5. Chocolatey downloaded and installed target-package version 12.5.6.
6. The operation reported success.

User Story

No response

System Details

• Operating system: Windows Server 2019
• Chocolatey CLI version: 2.7.3
• Chocolatey edition: FOSS
• Package source: Private NuGet-compatible Artifactory repository
• Command executed from an elevated process

Installed Packages

N/A see logs above

Output Log

N/A see logs above

Additional Context

The Chocolatey 2.7.3 implementation appears to retry NuGetResolverConstraintException by loading all versions of parent packages with FindAllPackageVersions. It then invokes the NuGet resolver using DependencyBehavior.Highest.

Source:

https://github.com/chocolatey/choco/blob/2.7.3/src/chocolatey/infrastructure.app/services/NugetService.cs

It appears that the command-line version is not retained as a hard constraint during this retry. The explicitly requested version may be represented as a preferred version, allowing NuGet's resolver to select another target-package version when finding a valid graph.

Is there an intended way to prevent this behavior while retaining normal dependency resolution? If not, the requested target package identity and version should remain fixed across the initial and fallback resolution attempts.

Acceptance Criteria

No response

Related Issues

No response

┆Issue is synchronized with this Clickup task by Unito