CollinAlpert
Only works for direct references, Not transitive?
I've tried to incorporate this in a couple projects where we use Moq (thankfully 4.18 and lower right now) and it doesn't seem to trigger even if Moq is updated to the offending version(s). The only time i got it to trigger and fail the build was when i delibrately added a direct reference to Devlooped.SponsorLink to a project.
The current version of Moq (4.20.69) does not depend on SponsorLink, which is why the analyzer does not trigger. See https://www.nuget.org/packages/Moq/4.20.69#dependencies-body-tab
I tried it locally against 4.20.0, I saw the SponsorLink dependency (and its subsquent nag) but the analyzer didn't trigger. I tried debugging it, and indeed the reference is not in ctx.Compliation.ReferencedAssemblyNames. I'm not sure if that's expected or not, though.
Interesting. I wrote a test which installs version 4.20.0 and it passes. But I can't seem to get the build error. Will need to investigate a bit further.