aboutcode-org / nuget-inspector

Inspect and resolve .NET and NuGet package dependencies like dotnet and nuget do. Fetch manifests data. Runs on Linux, Windows and macOS as a standalone application.
https://github.com/nexB/nuget-inspector
4 stars 4 forks source link

Version of dependency not determined correctly #59

Open nnobelis opened 2 months ago

nnobelis commented 2 months ago

I have the following context with a transient NuGet dependency in a C# project.

Common/Common.csproj: Using Microsoft.Azure.Cosmos 3.42.0 TargetProject/TargetProject.csproj: Using Common and using AspNetCore.HealthChecks.CosmosDb 8.0.1 which has a dependency on Microsoft.Azure.Cosmos 3.37.0 or higher.

Sample project: https://github.com/nnobelis/NugetInspectorResolutionExample

Because TargetProject is using Common, the used cosmos version in project 2 is 3.42.0. I can see that in the bin folder as well (deps.json refers to 3.42.0 and the dll version is 3.42.0). Despite effectively using Microsoft.Azure.Cosmos 3.42.0, Nuget Inspector still find Cosmos 3.37.0 as a dependency of TargetProject (see https://github.com/nnobelis/NugetInspectorResolutionExample/blob/main/nuget-inspector.json).

I expect the dependency to be Cosmos@3.42.0 as specified in Common.