CycloneDX / CycloneDX/cyclonedx-dotnet

Exclude developer dependencies is not reflecting real runtime dependencies

Open
#847 3 comments 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

# The NuGet package assets are not considered correctly when developer dependencies are excluded.
The following assets are considered to have "runtime" dependency:
* LibraryIncludeFlags.Runtime,
* LibraryIncludeFlags.Native,
* LibraryIncludeFlags.ContentFiles

Upon generating the dependencies without the developer dependencies (only availabe at build, but not at runtime) the dependencies are not calculated correctly.

Example project file:
```


net8.0
exe












```

Expected outcome:
As the Microsoft.Extensions.Logging is excluded fully, this will be just a developer dependency, and also it's transitive dependencies must not be shown as well. Also the build output folder and the default publish folder and the possibly generated NuGets package are not containing those NuGets and not referencing them.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.