将 Microsoft IdentityModel 包更新到 6.23x 突然增加了 10 个 package 依赖项

Question

Anyone experience an unexpected issue when upgrading your IdentityModel package dependencies? Is this a "bug" or is there another way to get around this?

I have several .NET 4.8.1 framework console apps that have a dependency on the IdentityModel package, which has always been a collection of these packages:

Microsoft.IdentityModel.JsonWebTokens 
Microsoft.IdentityModel.Logging       
Microsoft.IdentityModel.Tokens       
System.IdentityModel.Tokens.Jwt       

Our most recent packages were on 6.19. Nuget showed that 6.23.1 was available. So I let it "update" the packages... which suddenly pulled in MANY more packages (that were NOT shown as dependencies):

Microsoft.IdentityModel.Abstractions   
Microsoft.Bcl.AsyncInterfaces          
System.Buffers                         
System.Memory                          
System.Numerics.Vectors                
System.Runtime.CompilerServices.Unsafe 
System.Text.Encoding                   
System.Text.Encodings.Web              
System.Text.Json                       
System.Threading.Tasks.Extensions      
System.ValueTuple                      

Answer 1

We can see the difference between the dependencies of the two versions：

6.19.0 6.26.1

And when we update this package we can see that:

So I think this is normal, it is caused by the change in the dependencies of the Microsoft.IdentityModel.Tokens package