How to find out which assembly caused a specific assembly to be in the bin folder?

Question

I have a Microsoft.AspNetCore.Authentication.JwtBearer.dll version 3.0 which is old and has a vulnerability. I am trying to find which assembly is dependent on it. First I manually expanded every referenced package to the bottom children in every project and I couldn't find it. I probably missed it plus this is not a good reliable way.

I ran 'do.net list package --include-transitive'. It showed Microsoft.AspNetCore.Authentication.JwtBearer in a couple projects but it doesn't show which assembly is dependent on it.

This is a new .NET 6 project I created with the latest of the packages so I am surprised to see this old assembly in there.

What's a good way to find out the dependent assembly?

Answer 1

You could try tracking it through MSBuild. The output from the ResolveAssemblyReference (RAR) task indicates how each dependency is required. Do do.net build -bl or msbuild /bl then open the msbuild.binlog using https://msbuildlog.com/ .

Find the result of the ResolveAssemblyReference task (there's a shortcut to search for this, $rar ). Expand the node for the task, and the node labeled "Results". Search there to see how the dependency was resolved (you might be able to find it quickly using Microsoft.AspNetCore.Authentication.JwtBearer under($rar) as your search term).

If it's a Primary Reference or Unified Primary Reference, then your project referenced it directly; otherwise if it's a Dependency or Unified Dependency, then expanding that node should show the details of which other assemblies required it.

A more concise search might be required by under(Microsoft.AspNetCore.Authentication.JwtBearer) but I'm not sure how close that will get you to the results. If it is a primary reference, then there might not be any matches for that search query.