From a0e15204f2fa57224157016e0fd55eb019614db9 Mon Sep 17 00:00:00 2001 From: Paul Dorsch <107068277+pauld-msft@users.noreply.github.com> Date: Thu, 31 Oct 2024 11:29:37 -0400 Subject: [PATCH] Update nuget known limitations (#1295) Previous limitations was written before new nuget detector was rolled out. This clarifies some of the points and removes the indication that the new detector hasn't rolled out yet. --- docs/detectors/nuget.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/detectors/nuget.md b/docs/detectors/nuget.md index 972891531..4df9e35d7 100644 --- a/docs/detectors/nuget.md +++ b/docs/detectors/nuget.md @@ -20,8 +20,8 @@ NuGet Detection is performed by parsing any `*.nuspec`, `*.nupkg`, `*.packages.c ## Known Limitations -- The NuGet detector is currently overreporting because the global NuGet cache gets searched. This is because of NuGet's [restore behaviour][4] which downloads all possible dependencies before [resolving the final dependency graph][5]. To solve this overreporting a new NuGet Detector approach will be rolled out. This new approach will now only parse `*.packages.config` and `*.project.assets` (`*.csproj`) files. This means any components that are only found in `*.nuspec` or `*.nupkg` files will not be detected with the new NuGet Detector approach. -- There are also dependencies from the .NET SDK that are underreported. The list of dependencies can be found [here][6]. +- Any components that are only found in `*.nuspec` or `*.nupkg` files will not be detected with the latest NuGet Detector approach, because the NuGet detector that scans `*.nuspec` or `*.nupkg` files overreports. This is due to of NuGet's [restore behaviour][4] which downloads all possible dependencies before [resolving the final dependency graph][5]. +- Dependencies from the .NET SDK that are underreported. The list of dependencies can be found [here][6]. [4]: https://learn.microsoft.com/en-us/nuget/consume-packages/package-restore#package-restore-behavior [5]: https://learn.microsoft.com/en-us/nuget/concepts/dependency-resolution