Grpc.Tools version 2.55.1 not resolved to specific version error

[Kubana]

Couple of days ago I started getting this exception when generating SBOM from one of our projects.

Dependency (Grpc.Tools) with version range ([2.55.1, )) referenced by (Name:Grpc.AspNetCore Version:2.55.0) did not resolve to a specific version.
Unable to locate valid bom ref for Grpc.Tools [2.55.1, )

What is the issue here?

[mtsfoni]

Are you using the current version of cyclonedx-dotnet? I hoped we got rid of that bug.

Do you maybe have a different version of grpc.tools referenced directly?

[Kubana]

Currently running the dotnet tool CycloneDX version 3.0.8 , still the same error
In project.assets.json I have this record:

"Grpc.AspNetCore/2.55.0": {
"type": "package",
"dependencies": {
"Google.Protobuf": "3.23.1",
"Grpc.AspNetCore.Server.ClientFactory": "2.55.0",
"Grpc.Tools": "2.55.1"
},
"compile": {
"lib/net7.0/.": {}
},
"runtime": {
"lib/net7.0/.": {}
}
}

[mtsfoni]

With what argument do you call the tool?
Normaly a single project.assets.json should be unambiguous.
This problem can arise, if you have a solution where different projects refer to different versions of a library as the tool doesn't know which version to use.

I want to change the tool to just add all versions of that library in case, but I have no free capacity.

A workaround can be, to generate the sboms by refering the "root-component"-projects (meaning your .exe / service-backend ). I recommend doing it that way for increased accuracy anyway and handle all my projects like that. (I generate a frontend and backend bom seperately then)

[Kubana]

dotnet-CycloneDX.exe {projectName}.csproj -o CycloneDXOutputs -fn {projectName}.xml -dpr and it fails sadly on the project that is creating the .exe

[Kubana]

Problem persists even in version 4.0.0 problem is with Grpc.Tools nuget package version range [2.60.0,

Dependency (Grpc.Tools) with version range ([2.60.0, )) referenced by (Name:Grpc.AspNetCore Version:2.60.0) did not resolve to a specific version.
Unable to locate valid bom ref for Grpc.Tools [2.60.0, )
our every project that uses this nuget package has this problem