microsoft / microsoft/component-detection
Fix support for Paket on .NET ecosystem
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
I suggest that this library should support Paket.
Due to previous issues of NuGet, another OSS community-driven package manager has been existing in the .NET ecosystem: Paket. Paket is very popular and is used mostly in a) large scale C# projects, b) small scale F# projects.
The dependencies of a project using Paket are especially easy to detect: There is a paket.lock file in project root folder, and that has a list of all the used dependencies with version (and also transitive dependencies if needed), as the picture demonstrates:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the component-detection entry points for project dependency files and compare how existing lockfile formats are handled. Use a representative paket.lock in the project root to define the expected direct and transitive dependency versions; done means Paket projects are detected with those dependencies reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100