Is polly bringing System.Net.Http 4.2.0.0?

Summary: I’m writing a library that depends on Polly and I discovered that the moment I add polly as a package reference it suddenly brings System.Net.Http 4.2.0.0. This is a very painful well known issue on .net (see this) and I wouldn’t like the consumers of our library to go through it, it forces them to write obscure assembly redirects and if they don’t they may (this is the annoying part) have runtime issues depending on the GAC of the system.

Expected behavior:

Polly shouldn’t bring any System.Net.Http dependencies since is not listed on the dependencies of their nuget package: https://www.nuget.org/packages/Polly/

Actual behaviour:

This is the output of ildasm of a testing library after adding polly as a dependency and using httpclient:

.assembly extern System.Net.Http
{
  .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A )                         // .?_....:
  .ver 4:2:0:0
}

Steps / Code to reproduce the problem:

A very simple library project should reproduces this:

TestingPolly.csproj

<?xml version="1.0" encoding="utf-8"?>
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <RootNamespace>TestingPolly</RootNamespace>
    <AssemblyName>TestingPolly</AssemblyName>
    <TargetFramework>net461</TargetFramework>
    <Platforms>x64</Platforms>
    <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
  </PropertyGroup>
  <ItemGroup>
    <!-- Try removing Polly -->
    <PackageReference Include="Polly" Version="7.1.0" />
    <PackageReference Include="System.Net.Http" Version="4.3.3" />
  </ItemGroup>
</Project>

Class1.cs

using System.Net.Http;

namespace TestingPolly
{
    public class Class1
    {
        private HttpClient foo;
    }
}

After building the project, running this command on the output directory of the project (on the VS developer command prompt) with the polly package ildasm TestingPolly.dll /OUT=testingpolly.txt && notepad testingpolly.txt will output this:

.assembly extern System.Net.Http
{
  .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A )                         // .?_....:
  .ver 4:2:0:0
}

If polly is removed, ildasm will output this (expected since we depend on System.Net.Http):

.assembly extern System.Net.Http
{
  .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A )                         // .?_....:
  .ver 4:1:1:2
}

[reisenberger]

Polly v7.2.0 has been published with .NET Framework targets 4.6.1 and 4.7.2 now supported natively as part of the nuget package. Should resolve this issue.

[hyrmn]

@afcruzs We experienced the same. @jglinsek tracked down a way to resolve it in the short-term by adding an explicit binding redirect to downgrade system.net.http to 4.0.0.0

      <dependentAssembly>
        <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-4.2.0.0" newVersion="4.0.0.0" />
      </dependentAssembly>

This may not work for your use case but, if so, it might be a way forward in the short-term. This issue affects us on 461 and 472.