search

dotnet / Silk.NET

The high-speed OpenGL, OpenCL, OpenAL, OpenXR, GLFW, SDL, Vulkan, Assimp, WebGPU, and DirectX bindings library your mother warned you about.
https://dotnet.github.io/Silk.NET
MIT License
4.19k stars 407 forks source link

Remove two NuGet package dependencies for certain TFMs #643

Closed nathan-alden-sr closed 3 years ago

nathan-alden-sr commented 3 years ago

Similar to https://github.com/dotnet/Silk.NET/issues/637, and as discussed on Discord here.

image

I noticed that the Silk.NET.Maths package (and perhaps others) include a couple of NuGet package dependencies for the net5.0 TFM. It seems like these packages are not necessary at all (and may not be for other TFMs, as well).

Many people/teams will make decisions about whether to use a package based explicitly on the package's dependencies, especially in the era of increasing package management supply chain attacks. If possible, it would be nice to see these two unneeded dependencies removed so Silk.NET.Maths is effectively standalone. That will give me piece-of-mind at a package security level. Although I am only using Silk.NET.Maths myself, it seems that if a change is made it should be made to all the other packages, as well.

HurricanKai commented 3 years ago

This should be a very simple change, just excluding the two packages above a certain .NET version (HashCode is available on .NET Standard 2.1, Net5, Net6, NetCore2+) (Half is available on Net5 and Net6) Good Issue for Hacktoberfest, so I'll let it sit here for a while 🙂

nathan-alden-sr commented 3 years ago

I'll pick this up.