Bug: csproj-analyzer-hintpath-packages-config-version-skew

[drmoisan]

• Work Mode: full-bug

Summary

16 first-party .csproj files carry <Analyzer Include> HintPaths naming older Meziantou.Analyzer/Roslynator.Analyzers versions than the versions declared in their sibling packages.config files, so a clean-worktree NuGet restore followed by the repo's analyzer-baseline build fails with CS0006 (metadata file not found) for every affected project.

Environment

• OS/version: Windows, .NET Framework / VSTO toolchain
• Command/flags used: msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true in a fresh worktree with no pre-populated packages/ directory
• Data source or fixture: N/A

Steps to Reproduce

1. Create a new git worktree/clone of the repository with no packages/ directory present.
2. Run dotnet tool restore and the repo's standard NuGet restore for the solution.
3. Run the analyzer-baseline msbuild command above.

Expected Behavior

The analyzer-baseline build succeeds against whatever Meziantou.Analyzer/Roslynator.Analyzers versions are declared in each project's packages.config.

Actual Behavior

10 CS0006 errors occur: the affected .csproj files' <Analyzer Include> items hard-code HintPaths to Meziantou.Analyzer.3.0.156 and Roslynator.Analyzers.4.16.0, while the corresponding packages.config entries declare 3.0.174 and 4.16.1 respectively, so NuGet restores the newer package directories and the older, csproj-referenced paths never exist on disk.

Logs / Screenshots

• Attached minimal logs or screenshot
• Snippet: CS0006: Metadata file 'packages\Meziantou.Analyzer.3.0.156\analyzers\...\Meziantou.Analyzer.dll' could not be found (and the Roslynator.Analyzers 4.16.0 equivalent), repeated across 16 first-party projects.

Impact / Severity

• Blocker
• Medium
• Low

Source

From: docs/features/potential/2026-08-28-csproj-analyzer-hintpath-packages-config-version-skew.md