Packages pruned by NuGet Package Pruning disappear from the SBOM

[Whathecode]

This tool relies on project.assets.json to list all dependencies in the SBOM. But, this file is affected by package pruning from .NET 10 onwards:

... package pruning removes packages from the restore graph when the .NET Runtime Libraries already provide them.

For example, if you take on a direct dependency to System.ServiceModel.Primitives, this includes a transitive dependency to Microsoft.Extensions.ObjectPool and System.Security.Cryptography.Xml. But, project.assets.json will only list Microsoft.Extensions.ObjectPool as System.Security.Cryptography.Xml is pruned.

Using --recursive at least causes the dependency to be linked (since it is retrieved through PackageReference instead). However, it still does not link the dependency to where it was pulled in from.

[mtsfoni]

The pruned package is not delivered as a NuGet component and is not required as an additional deployment component. Its functionality is supplied by the target .NET runtime.

Well but then there are self-contained builds and AOT. Where in a second step does dependencies are added again. I am afraid we with all those new features and different paths that can source dependencies we reach the limits of this tool.