cyclonedx-dotnet icon indicating copy to clipboard operation
cyclonedx-dotnet copied to clipboard

Exclude developer dependencies is not reflecting real runtime dependencies

Open gotztibor opened this issue 1 year ago • 2 comments

The NuGet package assets are not considered correctly when developer dependencies are excluded.

The following assets are considered to have "runtime" dependency:

  • LibraryIncludeFlags.Runtime,
  • LibraryIncludeFlags.Native,
  • LibraryIncludeFlags.ContentFiles

Upon generating the dependencies without the developer dependencies (only availabe at build, but not at runtime) the dependencies are not calculated correctly.

Example project file:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <OutputType>exe</OutputType>
  </PropertyGroup>

  <ItemGroup>
    <!-- runtime true -->
    <PackageReference Include="Google.Protobuf" Version="3.25.2" PrivateAssets="analyzers;build" />
    <!-- runtime true with transitive dependencies -->
    <PackageReference Include="log4net" Version="2.0.15" ExcludeAssets="none" />
    <!-- runtime false, without transitive dependencies -->
    <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" ExcludeAssets="all" />
    <!-- runtime true -->
    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" IncludeAssets="runtime" ExcludeAssets="native;contentFiles;build" />
    <!-- runtime true -->
    <PackageReference Include="Serilog" Version="3.1.1" PrivateAssets="all" IncludeAssets="runtime" />
  </ItemGroup>

</Project>

Expected outcome: As the Microsoft.Extensions.Logging is excluded fully, this will be just a developer dependency, and also it's transitive dependencies must not be shown as well. Also the build output folder and the default publish folder and the possibly generated NuGets package are not containing those NuGets and not referencing them.

gotztibor avatar Feb 06 '24 14:02 gotztibor

Please see Pull Request 848

gotztibor avatar Feb 06 '24 15:02 gotztibor

This issue is stale because it has been open for 3 months with no activity.

github-actions[bot] avatar May 12 '24 01:05 github-actions[bot]