dotnet / dotnet/msbuild

ProjectReference transitive dependencies

Open
#4,717 9 comments 7 reactions 0 assignees View on GitHub
triaged
Dominant language
C#
Stars
5.5k
Forks
1.5k
Avg merge
1d 8h
Merged PRs (30d)
141

Description

### Steps to reproduce

Let's consider these 3 project files :

ProjectA
```xml


net471

```

ProjectB
```xml


net471



```

ProjectC
```xml


net471



```

The 3 projects depends on each other as follows : `ProjectC -(depends on)-> ProjectB -> ProjectA`

### Expected behavior

`ProjectC` should not be able to use elements from `ProjectA` (public classes for example) since it doesn't reference this project directly.

### Actual behavior

`ProjectC` has access to `ProjectA` via transitivity as it can be seen in his assets file :

```json
{
...
"ProjectA/1.0.0": {
"type": "project",
"framework": ".NETFramework,Version=v4.7.1",
"compile": {
"bin/placeholder/ProjectA.dll": {}
},
"runtime": {
"bin/placeholder/ProjectA.dll": {}
}
},
"ProjectB/1.0.0": {
"type": "project",
"framework": ".NETFramework,Version=v4.7.1",
"dependencies": {
"ProjectA": "1.0.0"
},
"compile": {
"bin/placeholder/ProjectB.dll": {}
},
"runtime": {
"bin/placeholder/ProjectB.dll": {}
}
}
...
}
```

As mentioned in https://github.com/dotnet/project-system/issues/2313, it appears that this behavior can be cancelled by using `PrivateAssets`, from [`PackageReference` dependency assets](https://docs.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets), when referencing `ProjectA` :

```xml



```

Using `ExcludeAssets` when referencing `ProjectB` also works :

```xml



```

However, these metadatas are originally applicable only for `PackageReference` and I can't find any documentation of this behavior for `ProjectReference` (in the [`ProjectReference` item reference](https://docs.microsoft.com/en-us/visualstudio/msbuild/common-msbuild-project-items?view=vs-2019#projectreference) for example).
So, should this (`PrivateAssets` or `ExcludeAsssets`) be really used in `ProjectReference` tag ?

### Environment data

`msbuild /version` output: 15.9.21.664
Visual Studio : Professional 2017, version 15.9.15

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.