RDK0012 — Stable package depends on a prerelease
Severity: warning · Command: redecker inspect
You never asked for a preview. You got one anyway, four levels down.
Opting in only covers what you can see
Taking a prerelease is a decision you make on purpose — --prerelease, or a range that admits one. That decision governs what you reference directly. It does not govern what your dependencies reference.
So a package that ships a stable version while depending on a prerelease puts preview code into a graph that opted out of preview code, and nothing announces it. Restore does not warn. The promise a stable version makes — this API is settled, this package is not going to be pulled — quietly stops applying at a depth nobody inspects.
It is not rare, and not only small packages
Across 2,682 Microsoft.* and System.* packages, 0.4% do this:
| Package | Depends on |
|---|---|
Microsoft.Maui.Essentials@10.0.90 | Xamarin.AndroidX.Security.SecurityCrypto 1.1.0.4-alpha07 |
Microsoft.Azure.Workflows.WebJobs.Extension@1.44.16 | Microsoft.Azure.WebJobs.Script.Abstractions 1.0.0-preview |
Microsoft.DocAsCode.Build.Engine@2.67.5 | Jint 3.0.0-beta-2049 |
Microsoft.Windows.CsWin32@0.3.298 | three prereleases |
Microsoft.NETCore.UniversalWindowsPlatform@6.2.14 | Microsoft.Net.Native.Compiler 2.2.12-rel-31116-00 |
Microsoft.Maui.Essentials is the one worth staring at. It is current, it is stable, it is installed in an enormous number of applications, and it depends on an alpha.
Only the lower bound counts
A range whose upper bound is a prerelease — [1.0.0, 2.0.0-preview) — resolves to a stable version and is not reported.
This is not a hypothetical. The first pass at this rule matched a pattern against the version string and flagged exactly that shape. Ranges are parsed properly now, and only MinVersion.IsPrerelease counts, because the lower bound is what restore actually picks.
What it does not report
A prerelease depending on a prerelease. Completely ordinary, and says nothing about anybody's stability. The rule only looks at packages whose own version is stable.
The judgement call it does make
Microsoft.Identity.Web.GraphServiceClientBeta@4.14.2 depends on Microsoft.Graph.Beta 5.56.0-preview, and it is reported.
You could argue the name says Beta so the buyer is warned. The rule disagrees, because the version is what tooling reads: 4.14.2 is stable, so it installs without --prerelease, appears in no preview filter, and passes any policy that blocks prereleases. If the intent is that consumers are opting into preview code, the version should say so — that is precisely what a prerelease tag is for.
Example
warning RDK0012: a stable package depends on the prerelease Contoso.Abstractions 1.0.0-preview
Contoso.Abstractions 1.0.0-preview is a prerelease. Opting into prereleases governs what a
repository references directly, not what its dependencies reference, so anyone installing this
gets prerelease code without asking for it — and the promise a stable version makes stops
applying at a depth nobody inspects. Either depend on a stable release, or ship this package as
a prerelease so the choice is visible to whoever takes it.Why a warning
Sometimes there is no stable release to depend on and shipping anyway is the right call. The rule's job is to make sure that was a decision rather than an accident — and to make it visible to whoever installs the result.