ProjectReference transitive dependencies
- Dominant language
- C#
- Stars
- 5.5k
- Forks
- 1.5k
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 141
Description
### Steps to reproduce
Let's consider these 3 project files :
ProjectA
```xml
net471
```
ProjectB
```xml
net471
```
ProjectC
```xml
net471
```
The 3 projects depends on each other as follows : `ProjectC -(depends on)-> ProjectB -> ProjectA`
### Expected behavior
`ProjectC` should not be able to use elements from `ProjectA` (public classes for example) since it doesn't reference this project directly.
### Actual behavior
`ProjectC` has access to `ProjectA` via transitivity as it can be seen in his assets file :
```json
{
...
"ProjectA/1.0.0": {
"type": "project",
"framework": ".NETFramework,Version=v4.7.1",
"compile": {
"bin/placeholder/ProjectA.dll": {}
},
"runtime": {
"bin/placeholder/ProjectA.dll": {}
}
},
"ProjectB/1.0.0": {
"type": "project",
"framework": ".NETFramework,Version=v4.7.1",
"dependencies": {
"ProjectA": "1.0.0"
},
"compile": {
"bin/placeholder/ProjectB.dll": {}
},
"runtime": {
"bin/placeholder/ProjectB.dll": {}
}
}
...
}
```
As mentioned in https://github.com/dotnet/project-system/issues/2313, it appears that this behavior can be cancelled by using `PrivateAssets`, from [`PackageReference` dependency assets](https://docs.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets), when referencing `ProjectA` :
```xml
```
Using `ExcludeAssets` when referencing `ProjectB` also works :
```xml
```
However, these metadatas are originally applicable only for `PackageReference` and I can't find any documentation of this behavior for `ProjectReference` (in the [`ProjectReference` item reference](https://docs.microsoft.com/en-us/visualstudio/msbuild/common-msbuild-project-items?view=vs-2019#projectreference) for example).
So, should this (`PrivateAssets` or `ExcludeAsssets`) be really used in `ProjectReference` tag ?
### Environment data
`msbuild /version` output: 15.9.21.664
Visual Studio : Professional 2017, version 15.9.15
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.