关于NuGet警告NU1601的疑问：依赖版本符合要求仍触发警告及依赖来源不明的咨询

Let’s dive into your two NU1601 warning issues and break down what’s happening, plus how to resolve them:

1. Why does NU1601 trigger when "everything seems to work fine"? #

First, let’s clear up what NU1601 actually signals: this warning fires when NuGet can’t resolve the exact version of a dependency that was requested by a project or transitive package, and falls back to a lower version instead.

Even if your app runs without issues, the warning is flagging a potential mismatch: the package that requested the higher version might rely on features or fixes only present in that version. Since the resolved version is backward-compatible, things work now, but there’s a risk of hidden bugs down the line if that dependent package uses APIs not available in the lower resolved version.

Sometimes the "request" comes from a transitive dependency you don’t see directly, which is why it feels like "everything is fine" but the warning still pops up.

2. Why am I seeing NU1601 when the resolved version is higher than the requested minimum? #

Your case with AWSSDK.DynamoDBv2 is unusual—NU1601 is supposed to trigger only when the resolved version is lower than the requested version. Here are the most likely explanations:

• Outdated NuGet client: Older versions of NuGet had bugs in their resolution warning logic, including cases where warnings were incorrectly triggered for higher resolved versions. Updating NuGet to the latest version (via Visual Studio’s NuGet Package Manager or dotnet nuget update source in the CLI) should fix this.
• Hidden transitive dependency request: The warning message might be showing the wrong "requested" version. It’s possible another package in your dependency graph is asking for a higher specific version (e.g., 3.7.0.35) that NuGet couldn’t fulfill, so it fell back to 3.7.0.30. The warning might be incorrectly displaying the lower >=3.7.0.8 range from a different dependency instead of the actual higher request.
• Project configuration conflicts: Check if your Common.fsproj has explicit binding redirects or multiple package references that are sending conflicting version signals to NuGet.

Fixing the "unknown source of the dependency request" problem #

To figure out exactly which project or package is requesting that version of AWSSDK.DynamoDBv2, use these NuGet CLI commands:

• Run dotnet list YourSolutionName.sln package --include-transitive to get a full, hierarchical view of all dependencies. This will show exactly which package/project brings in each version of AWSSDK.DynamoDBv2.
• For verbose restore logs that detail the entire resolution process, run dotnet msbuild /t:Restore /v:d. Look for lines referencing AWSSDK.DynamoDBv2—you’ll see every version request and how NuGet decided on the final resolved version.

Quick Fixes to Resolve the Warnings #

Once you’ve identified the root cause, here are your options:

• Update the dependent package: If a transitive package is requesting a higher version that NuGet can’t resolve, update that package to a version that accepts your resolved AWSSDK.DynamoDBv2 version.
• Pin the version explicitly: Add an explicit PackageReference to AWSSDK.DynamoDBv2 in Common.fsproj with the version you want to use, which will override transitive requests.
• Suppress the warning (if confirmed safe): If you’re certain the resolved version is fully compatible, you can suppress NU1601 for that package in your project file:

  <PackageReference Include="AWSSDK.DynamoDBv2" Version="3.7.0.30">
    <NoWarn>NU1601</NoWarn>
  </PackageReference>
  

内容的提问来源于stack exchange，提问作者Thomas