How to hide dependent Nuget .dll's from consuming parent .dlls - What is the difference between 'Private Dependencies' and 'Merge / Repack' dependencies?

Question

Note: When I use the word .dll, I mean a NuGet package I have made that has a collection of methods, and dependencies, such as Newtonsoft.Json as an example.

---

Hello!

I am building an infrastructure of NuGet packages which keeps modularity in mind. Basically, if I have more NuGet packages, I only need to write the code once, and it can be shared between other .dll's which require the code. If I did not do this, I would need to copy and paste the code in multiple separate NuGet package .dlls'

Here is an example diagram, I tried to think of a some-what realistic case of 'dependency hell' where NuGet packages depend on other NuGet packages

The scenario:

My thing is that when I install 1 NuGet package (AAA) which relies on 5 other NuGet packages (BBB, CCC, DDD, EEE, FFF) for example, the parent (123) which consumes (AAA) will be able to reference all public methods in (BBB, CCC, DDD, EEE, FFF) packages.

The Question:

How do I prevent the parent (123) the ability to reference public methods in (BBB, CCC, DDD, EEE, FFF) packages? I only want the parent (123) to have the ability to use public methods from (AAA) which the parent (123) consumes and relies on as a direct dependency?

Why do I want this?

It seems wrong that the parent (123) can reference all of those other public methods, I am sure I will get some errors or issues down the line if I allow this.

My Research for the solution??

Private dependencies:

https://stackoverflow.com/questions/50875356/how-to-exclude-a-package-from-a-class-library-nuget-package

I am not sure if this is what I want.. but maybe it will work?

Merge or Repack dependencies using ILMerge or ILRepack:

https://www.meziantou.net/merging-assemblies-using-ilrepack.htm

https://www.continuousimprover.com/2016/05/the-magic-of-hiding-your-nuget.html

I am not sure if I I need to use ILMerge or Repack, it seems like maybe its overkill? or maybe its exactly what I need?

---

I am a bit stuck on this and would love some guidance or suggestions if you guys have any! Maybe im being over-zealous and do not need to worry about 'The Scenario' at all!

Thanks everyone!

Answer 1

In this scenario, you can use the PrivateAssets metadata to control this behavior.

<ItemGroup>
<PackageReference Include="Private.Package" Version="1.0.0" PrivateAssets="all" />
</ItemGroup>

more documentation you can find in:
https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets

hope this answers your question.

Answer 2

private assets are assets you don't want exposed to the consumer. say you use a test harness, and don't want that included in you nuget package. private means the asset is not included in the nuget package. if used for a dependent dll, then the dll is not included, but the code will not run if the consumer does not include the dll.

the assembly merge is probably what you are trying to do. this embeds the dependent assemblies in the target, but they have a new namespace. this affects attributes also. so you will need to careful if you use reflection.

the will work best if you only expose one master nuget package. say you have 2 peer packages a & b, and they both use c & d, it means both a & b need imbedded copies of c & d. if c & d depend on other dependencies, these must be imbedded in a & b also. but if the consumer can use a & d, you end up with more copies.