Why is Autofac.Integration.WebApi.Owin 5.0.0 referencing System.Net.Http 4.2.0 on TargetFramework v4.7.1?

Question

I have an assembly with TargetFrameworkVersion v4.7.1 that has a reference to Autofac.Integration.WebApi.Owin 5.0.0.

During compile, I get a warning saying warning MSB3277: Found conflicts between different versions of "System.Net.Http" that could not be resolved. These reference conflicts are listed in the build log when log verbosity is set to detailed. warning MSB3277: Found conflicts between different versions of "System.Net.Http" that could not be resolved. These reference conflicts are listed in the build log when log verbosity is set to detailed. Running my application on a server that has only .NET Framework 4.7.1 installed, I get the following runtime exception

System.IO.FileNotFoundException: Could not load file or assembly 'System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.
File name: 'System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
   at Owin.AutofacWebApiAppBuilderExtensions.UseAutofacWebApi(IAppBuilder app, HttpConfiguration configuration)

Assembly manager loaded from:  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Running under executable  C:\xx\yyServer\yyServer.exe
--- A detailed error log follows. 

=== Pre-bind state information ===
LOG: DisplayName = System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
 (Fully-specified)
LOG: Appbase = file:///C:/xx/yy/Server/
LOG: Initial PrivatePath = NULL
Calling assembly : Autofac.Integration.WebApi.Owin, Version=5.0.0.0, Culture=neutral, PublicKeyToken=17863af14b0044da.

From dotPeek, I can see the following information about the assemblies

Autofac.Integration.WebApi, 5.0.0.0, msil, .Net Framework v4.6.1, Debug
   References:
     - System.Net.Http (4.2.0.0)
Autofac.Integration.WebApi.Owin, 5.0.0.0, msil, .Net Framework v4.6.1, Debug
   References:
     - System.Net.Http (4.2.0.0)
My.Assembly, 1.0.0.0, msil, .Net Framework v4.7.1, Debug
   References:
     - System.Net.Http (4.0.0.0)

If I create a new and empty project targeting .NET Framework v.4.6.1-4.7.1, the System.Net.Http reference claims Version is 4.0.0.0. If I bump the project up to 4.7.1, the System.Net.Http reference says 4.2.0.0. Looking at nuget packages for System.Net.Http, there is no version 4.2.0. Using .NET Framework 4.7.2 for the actual project might work, but I'm not in a position to update to a new TargetFramework at the moment.

Adding the following assembly redirect to the app.config appears to fix this particular issue at runtime, however I'm not sure how happy I am with redirecting framework assemblies, and what other consequences that might bring. The compile time warning is still present.

<dependentAssembly>
    <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
     <bindingRedirect oldVersion="0.0.0.0-4.2.0.0" newVersion="4.0.0.0" />
</dependentAssembly>

Why is the Autofac assembiles referencing version 4.2.0? Is there an issue with the package? Are there better ways to fix this rather than using an assembly redirect?

Answer 1

Taking Autofac out of it for a minute, if you do a search on system.net.http 4.2.0.0 you'll find that this is a problem with a lot of packages, from DocumentDb to System.Collections.Immutable . It apparently stems from a tooling issue where an assembly was built using VS 2017 (which is where System.Net.Http 4.2.0.0 comes from) and at build time that version was there, yet at runtime the project was not built with the same toolset and the assembly goes missing.

As you found, the short-term workaround is the assembly binding redirect.

For the longer term workaround, the Autofac package needs an update. I've filed an issue on your behalf.