NuGet 中传递包引用的最佳实践

Question

I am relatively new to the new .NET project format, and was looking to solicit some opinions on how best to manage a library's dependencies.

Let's say I am writing a library (intended to be shared as a NuGet package) which contains some ASP.NET core functionality.

In my library's csproj file, I can add a reference to Microsoft.AspNet.Core and happily use everything I want from it or any of its transitive dependencies.

An alternative approach would be to explicitly add references for each part of AspNet.Core that I use, as I start using types from those packages. For example, to add a package reference to Microsoft.AspNetCore.Http.Abstractions the first time I use HttpContext .

To me, the latter approach seems like it would be preferable. It provides a more clear description of the actual dependencies of my package, and is not susceptible to breaking in the same way as referencing Microsoft.AspNet.Core may be when updating to a version which may remove Microsoft.AspNetCore.Http.Abstractions from its transitive dependency graph.

If the general consensus is indeed the latter approach described above, is there any way to enforce this behaviour? For example, by failing a build if a project references types in a transitive dependency?

Really interested to hear everyone's thoughts on this!

Answer 1

I'm an experienced C# developer and maintainer of several NuGet packages. Though those packages don't actually have any dependencies.

I agree that the latter approach of only referencing the exact packages used is preferable. This has several advantages:

1. Helps prevents conflicts between assembly versions by reducing the number of packages your package pulls in
2. Minimizes the total added size to projects using your package
3. May enable advanced scenarios for users of your package

I recently had to file a bug due to the third situation. The xUnit library provides their assertions in two different packages xunit.assert and xunit.assert.source . The second enables you to extend the assertion class with custom assertions. I was using the xunit.categories package and it references xunit which references several packages including xunit.assert . So when I tried to switch to using xunit.assert.source I got a conflict because they contain the same classes. However, xunit.categories doesn't even use the assertion portion of xUnit. It should only reference xunit.core .

Answer 2

I think I prefer explicitly referencing packages. However, I can understand the answer may be subjective.

In any case, there is a tool that helps you find transitive package references :

https://github.com/spectresystems/snitch