.NET Core 1.1 allowing access to indirect dependencies types

Question

I created a new .NET Core 1.1 solution and noticed an odd behavior: if I create multiple projects in the solution and chain-reference them, I'm able to freely access types located in a dependency of a dependency, any level down.

This is an example:

We have a Sandbox solution, a Baz class library project, a Bar class library project referencing Baz and a Foo console app project referencing Bar .

From the Foo project I'm able to access and use BazThing , a type defined in the Baz project, even though Foo doesn't have a reference on Baz .

This works with NuGet packages too: if I add Entity Framework to Baz through NuGet I'm able to use the DbContext type in the Foo project.

This is a huge problem when the projects are used to implement layer segregation.

Developers are now allowed to access and use implementation details of the dependencies or bypass layer segregation, both "maliciously" and by mistake (in the above mentioned example, IntelliSense will happily suggests to use BazThings when typing ba without any warning).

Is this how things will work from now on, or are we missing something?

Is it possible to prevent/inhibit this behavior somehow?

Where can I find documentation about this behavior?

Answer 1

That is intended behavior of modern NuGet/msbuild. It is called meta-packages / transitive dependencies and used for example for the NETStandard.Library package to include all libraries of the base class library. I do not think there is a way hiding them. Expect this feature to be added to full .NET Framework projects within the next releases of VS.

Aside of your questions, my personal opinion here is that hiding artifacts behind reference trees is maybe useful at first sight but does not bring any architectural benefit. A loaded assembly can be invoked. One way or the other. Layering, layer bridging and adherence to architecture can be only teached/learned/reviewed/documented. Teach the devs but do not build walls around them. Discipline should not be enforced by the artifacts but by the devs themselves.