Fixed: "NU1608: Pomelo.EntityFrameworkCore.MySql 9.0.0 requires Microsoft.EntityFrameworkCore.Relational (>= 9.0.0 && <= 9.0.999) but version 10.0.14 was resolved"
NU1608: Detected package version outside of dependency constraint: Pomelo.EntityFrameworkCore.MySql 9.0.0 requires Microsoft.EntityFrameworkCore.Relational (>= 9.0.0 && <= 9.0.999) but version Microsoft.EntityFrameworkCore.Relational 10.0.14 was resolved. The message spells out the problem: the newest Pomelo MySQL provider is built for EF Core 9, and the project runs EF Core 10. That isn't a version to nudge; it's a provider that doesn't support your EF Core yet.
What I Was Doing
In a .NET 10 solution with EF Core 10.0.14 and Oracle's MySql.EntityFrameworkCore, I added the newest version of the other main EF Core provider for MySQL, the community's Pomelo, to the data project:
dotnet package add Pomelo.EntityFrameworkCore.MySql --version 9.0.0 --project src/Dewiride.Inventory.Data
9.0.0 was its newest version, previews included, as dotnet package search Pomelo.EntityFrameworkCore.MySql --exact-match --prerelease showed.
What I Expected
Pomelo installed next to the rest of EF Core 10.
What I Got
error: NU1608: Warning As Error: Detected package version outside of dependency constraint: Pomelo.EntityFrameworkCore.MySql 9.0.0 requires Microsoft.EntityFrameworkCore.Relational (>= 9.0.0 && <= 9.0.999) but version Microsoft.EntityFrameworkCore.Relational 10.0.14 was resolved.
error: NU1902: Warning As Error: Package 'MySqlConnector' 2.4.0 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-473q-m89c-ghf8
log : Failed to restore /Users/you/projects/dewiride-inventory-api/src/Dewiride.Inventory.Data/Dewiride.Inventory.Data.csproj (in 3.43 sec).
Two errors, both "Warning As Error" because the solution sets TreatWarningsAsErrors. The build failed with the same two, for both projects: the web API gets the data project's packages too.
What I Checked
What the version range says. (>= 9.0.0 && <= 9.0.999) is Pomelo's own rule for EF Core: any 9.0 version, nothing else. Its package metadata confirms it, Microsoft.EntityFrameworkCore.Relational [9.0.0, 9.0.999], and shows that Pomelo 9.0.0 targets only net8.0. The project has EF Core 10.0.14, outside the range.
What NU1608 means. Microsoft's NU1608 page: "A resolved package is higher than a dependency constraint allows. This means that a package referenced directly by a project overrides dependency constraints from other packages." The project's EF Core 10 won over Pomelo's limit, which is why it's only a warning: NuGet can resolve it, it just shouldn't be trusted.
Whether it could work anyway. EF Core's providers page is clear: "EF Core providers typically do not work across major versions. For example, a provider released for EF Core 8 will not work with EF Core 9." The same goes for 9 and 10.
The second error. NU1902 is NuGet Audit: Pomelo 9.0.0 brings MySqlConnector 2.4.0, its driver, and that version has a published moderate-severity advisory.
Why It Happens
Pomelo 9.0.0 is built for EF Core 9: it accepts Microsoft.EntityFrameworkCore.Relational from 9.0.0 to 9.0.999 and nothing else. The project's EF Core 10.0.14 is outside that range, so NuGet reported NU1608, and TreatWarningsAsErrors made it an error. The second error came in with Pomelo's driver: MySqlConnector 2.4.0 has a published moderate-severity advisory, NU1902.
The Fix
The NU1608 page offers suppressing the warning when the mismatch "is intentional". It isn't here: suppressing it would run an EF Core 9 provider on EF Core 10, which the providers page says won't work. The fix is a provider built for your EF Core version. For EF Core 10, that's Oracle's MySql.EntityFrameworkCore 10.0.12, which the project already used, so Pomelo comes out again:
dotnet package remove Pomelo.EntityFrameworkCore.MySql --project src/Dewiride.Inventory.Data
info : Removing PackageReference for package 'Pomelo.EntityFrameworkCore.MySql' from project '/Users/you/projects/dewiride-inventory-api/src/Dewiride.Inventory.Data/Dewiride.Inventory.Data.csproj'.
With Central Package Management, one more step: the command removed the project's reference but left the version line in Directory.Packages.props:
<PackageVersion Include="Pomelo.EntityFrameworkCore.MySql" Version="9.0.0" />
Harmless, since no project references it, but misleading; I deleted the line.
After the Fix
Build succeeded in 1.7s
Both errors were gone: NU1608 with Pomelo, and NU1902 with the old driver it had brought. That build ran right after the removal; after I deleted the leftover line, the build succeeded again.
If You Need Pomelo
Then use the EF Core version it supports: EF Core 9 packages, 9.0.x, across the whole project, which means not moving to EF Core 10 until Pomelo releases a version for it. Check with dotnet package search Pomelo.EntityFrameworkCore.MySql --exact-match --prerelease. Keep in mind the NU1902 advisory for MySqlConnector 2.4.0 too: a newer driver version would be needed.
Common Mistakes
| Mistake | What happens | Do this instead |
|---|---|---|
Suppressing NU1608 with NoWarn | An EF Core 9 provider runs on EF Core 10, which providers don't support | Use a provider for your EF Core version |
Downgrading only Microsoft.EntityFrameworkCore.Relational | Mixed EF Core 9 and 10 packages | Keep every EF Core package on one major version |
Leaving the PackageVersion after removing the package | A version for a package nobody uses | Delete the line from Directory.Packages.props |
| Assuming the most-downloaded provider supports the newest EF Core | It may lag behind a release | Check the versions with dotnet package search first |
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
NU1608: … Pomelo.EntityFrameworkCore.MySql 9.0.0 requires Microsoft.EntityFrameworkCore.Relational (>= 9.0.0 && <= 9.0.999) | Pomelo 9 supports EF Core 9 only | Use Oracle's MySql.EntityFrameworkCore with EF Core 10, or keep every EF Core package on 9.0 |
NU1902: … 'MySqlConnector' 2.4.0 has a known moderate severity vulnerability | Pomelo 9.0.0 brings that driver version | Removing Pomelo removes it; keeping Pomelo needs a newer driver |
The PackageVersion line stays in Directory.Packages.props after dotnet package remove | The command removes only the project's reference | Delete the line yourself |
FAQ
Why was the API project affected? I added Pomelo to the data project.
The API references the data project, and packages flow through project references, so restore saw Pomelo in both.
Is Oracle's provider a drop-in replacement for Pomelo?
No. The registration method differs, UseMySQL in Oracle's provider against UseMySql in Pomelo's, and so do some features and defaults. Oracle MySql.EntityFrameworkCore vs Pomelo for EF Core 10 compares them.
Conclusion
NU1608 for Pomelo on EF Core 10 means the provider's own dependency range, EF Core 9.0.x, doesn't include your EF Core version, and EF Core providers don't work across major versions. Don't suppress it: use a provider built for EF Core 10, such as Oracle's MySql.EntityFrameworkCore, or keep the whole project on EF Core 9 until Pomelo catches up. After dotnet package remove, delete the leftover PackageVersion if you use Central Package Management.
