deps 0.0.0-alpha2

🌳 DependencyHierarchy

Command-line tool that shows and filters a tree of a .NET project's effective NuGet package dependencies and their versions, including transitive dependencies.

• Prerequisites
• Installation
  • Update
• Usage
  • Version conflict highlighting
• Options
  • Filter to only show one package
  • Project directory
  • Disable text colors
• Acknowledgements

Prerequisites

• .NET Runtime 6 or later
• A .NET project's source code you want to inspect

Installation

This will install the tool for your user, to be run from any directory.

dotnet tool install --global deps

Update

To update an existing installation to the latest version.

dotnet tool update --global deps

Usage

1. Go to a .NET project directory. This is the directory that has an obj subdirectory. For C# projects, this is usually the same directory that contains your .csproj file.

   cd mysolution/myproject/
   

2. If you haven't restored this project since changing its settings, cleaning, or cloning it, restore its depedencies it to ensure that obj/project.assets.json is up-to-date. Opening the project in Visual Studio or building it with dotnet build will also restore it automatically.

   dotnet restore
   

This tool does not automatically restore your project for you, so that you can specify all the options to dotnet restore that you need.

1. Run the deps tool.

   deps
   

This will print all of the effective NuGet dependencies of your project.

CSCore : 1.2.1.2
PowerMate : 1.1.1
  HidClient : 1.0.1
    HidSharp : 2.1.0

The leftmost, least indented packages are top-level/direct dependencies, manually defined in your .csproj or packages.config file. Indented packages underneath them are their transitive dependencies that are automatically included when you declare the top-level dependency. The most indented packages are leaf dependencies.

The above example shows that the project has two direct dependencies: CSCore and PowerMate. The PowerMate package also has a transitive dependency on HidClient, which in turn has a transitive dependency on HidSharp, which has no other dependencies.

Version conflict highlighting

.NET projects can only install one version of any given package. If different versions of the same package are all dependencies of your project, the compiler can't use all of them, so NuGet will perform automatic version conflict resolution to pick the one version to actually import.

This tool will show all of the candidate versions of dependencies, and will highlight when that version differs from the effective version that NuGet chose. This can help you figure out why a specific version of a package is in your project.

BouncyCastle.Cryptography : 2.3.1
MailKit : 4.5.0
  MimeKit : 4.5.0
    BouncyCastle.Cryptography : 2.3.0 (omitted for conflict with 2.3.1)
    System.Security.Cryptography.Pkcs : 8.0.0
      System.Formats.Asn1 : 8.0.0

In the above example, a project depends on MailKit, which transitively depends on BouncyCastle.Cryptography. At the time, the latest version of MailKit depended on the version 2.3.0 of BouncyCastle.Cryptography, which is vulnerable to several security issues. To resolve these, the newer, fixed 2.3.1 version of BouncyCastle.Cryptography was added as a direct, top-level dependency of the project. Doing so overrode the version that MailKit transitively depended upon, forcing MailKit to use the fixed version. This tool highlights the version conflict and how it was resolved.

Options

Filter to only show one package

By default, the output shows all dependencies of the project. To only show one package and its dependents, while hiding all unrelated packages, pass the --filter or -f option. This can help you figure out why a specific package is in your project.

deps --filter HidClient

PowerMate : 1.1.1
  HidClient : 1.0.1

This example shows that HidClient is in the project because it is a transitive dependency of the PowerMate top-level dependency.

Project directory

By default, this tool looks for a .NET project (that contains an obj subdirectory) in the current working directory. To work with a project in a different directory, you can do one of the following.

• Change to the project directory using cd:

  cd mysolution/myproject/
  

• Specify the project directory (absolute or relative to the current working directory) as a command-line argument:

  deps mysolution/myproject/
  

Disable text colors

By default, the output text is colored to make it easier to distinguish different package names, versions, and conflict highlights. To disable this coloring and not print any ANSI escape sequences, for example if you want to process the output in a text editor or CI build tool, you can pass the --no-color option.

deps --no-color

This program will also attempt to automatically disable color output if the console doesn't support it, but this argument allows you to force it off if the heuristic fails.

Acknowledgements

• Eclipse m2e for implementing this essential functionality a very long time ago in a GUI, better than any other IDE or tool ever has
• npm ls for implementing this essential functionality in a command-line interface
• DotNetWhy for inspiring me to create a .NET Tool that could answer my questions
• DependencyGraph.App for doing the same thing as my program, but NuGet Gallery search is so ineffective that it didn't show this tool to me when I searched for "dependencies" until after I had already built and published my program