No way to detect vulnerabilities in .NET Tool packages since dependencies are not listed

[mareek]

NuGet Product Used

dotnet.exe

Product Version

8.0.403

Worked before?

I don't think that it has worked before as no .NET Tool seems to have dependency on nuget.org

Impact

It bothers me. A fix would be nice

Repro Steps & Context

1. Create a new .NET Console project
2. Add a reference to System.Text.Json
3. Add a PackageId element to the csproj. The csproj should look like this :

<Project Sdk="Microsoft.NET.Sdk">
	<PropertyGroup>
		<OutputType>Exe</OutputType>
		<TargetFramework>net8.0</TargetFramework>
		<ImplicitUsings>enable</ImplicitUsings>

		<PackageId>HelloTool</PackageId>
	</PropertyGroup>

	<ItemGroup>
		<PackageReference Include="System.Text.Json" Version="8.0.5" />
	</ItemGroup>
</Project>

4. Run dotnet pack

The resulting .nupkg list System.Text.Json as a dependecy

6. Add <PackAsTool>true</PackAsTool> to <PropertyGroup> element in the .csproj. The csproj should look like this :

<Project Sdk="Microsoft.NET.Sdk">
	<PropertyGroup>
		<OutputType>Exe</OutputType>
		<TargetFramework>net8.0</TargetFramework>
		<ImplicitUsings>enable</ImplicitUsings>

		<PackageId>HelloTool</PackageId>
                <PackAsTool>true</PackAsTool>
	</PropertyGroup>

	<ItemGroup>
		<PackageReference Include="System.Text.Json" Version="8.0.5" />
	</ItemGroup>
</Project>

7. Run dotnet pack

The resulting .nupkg doesn't contain any dependecy

Verbose Logs

No response

[jebriede]

Thanks for the detailed repro. I was able to reproduce the issue as described.

[zivkan]

This is by design. Tool packages are self-contained.

I feel like this issue is likely an XY-Problem. @mareek, what problem do you believe tool packages having dependencies will solve?

[mareek]

At my company we have a policy to periodically check the nuget packages we use and their dependencies for security vulnerabilities. We wanted to extend that policy to the .NET Tools we use but we discovered that their dependencies are not listed.

Having the list of dependencies of .NET Tools would allow us to scan for security vulnerabilities

[nkolev92]

The long term solution here is SBOMs.
We'll track this as part of this epic: #12497.