Dotnet Nuget Why, your new best friend to troubleshoot transitive dependencies issues

Recently, a new dotnet CLI command was introduced without too much fanfare, so I thought it was worth writing a few lines about it. This new command is very useful to debug transient dependency issues, the command is dotnet nuget why and it helps figure out why a transitive package is referenced.

This command is available starting with .NET SDK version 8.0.4xx, so ensure you have at least that version installed. If not, you can download it here .

You can verify if you have a compatible SDK using the following commands:

dotnet --info

The output of this command will display, among other details, all the installed dotnet SDKs on the machine along with their respective versions

or

dotnet --list-sdks

Usage

#

The command usage looks like the following:

dotnet nuget why <PROJECT|SOLUTION> <PACKAGE> [-f|--framework <FRAMEWORK>]

The output looks is similar to what you can see here below:

dotnet nuget why ConsoleApplication.sln System.Collections.Immutable
Project 'ConsoleApplication' has the following dependency graph(s) for 'System.Collections.Immutable':

  [net8.0]
   │
   └─ BenchmarkDotNet (v0.13.12)
      ├─ Microsoft.CodeAnalysis.CSharp (v4.1.0)
      │  └─ Microsoft.CodeAnalysis.Common (v4.1.0)
      │     └─ System.Collections.Immutable (v5.0.0)
      └─ Microsoft.Diagnostics.Runtime (v2.2.332302)
         └─ System.Collections.Immutable (v5.0.0)

If the project under analysis targets multiple frameworks, there’s an option to specify which framework to look at using the -f flag as shown below:

dotnet nuget why ConsoleApplication.sln System.Collections.Immutable -f net6.0
Project 'ConsoleApplication' has the following dependency graph(s) for 'System.Collections.Immutable':

  [net6.0]
   │
   └─ BenchmarkDotNet (v0.13.12)
      ├─ Microsoft.CodeAnalysis.CSharp (v4.1.0)
      │  └─ Microsoft.CodeAnalysis.Common (v4.1.0)
      │     └─ System.Collections.Immutable (v5.0.0)
      └─ Microsoft.Diagnostics.Runtime (v2.2.332302)
         └─ System.Collections.Immutable (v5.0.0)

Inspect transitive vulnerabilities

#

This tool becomes very useful especially when there’s a vulnerable transitive dependency to investigate.

It would be useful to have a flag that shows all vulnerable packages in a given project, but that’s not currently available. However, you can achieve this with a bit of Linux shell gynmastics as follows:

dotnet list package --vulnerable --include-transitive --format json | grep id | cut -d':' -f2 | sed 's/"\(.*\)".*/\1/' | xargs -I {} dotnet nuget why <project name> {}

That’s it for today, I hope you find this useful, till the next time!