PrivateAssets ignored on publish when targeting net462

[nphmuller]

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFrameworks>netcoreapp1.0;net462</TargetFrameworks>
    <OutputType>Exe</OutputType>
  </PropertyGroup>
  
  <ItemGroup>
    <PackageReference Include="StackExchange.Redis" Version="1.2.1"  />
    <PackageReference Include="Newtonsoft.Json" Version="10.0.1" PrivateAssets="All" />
  </ItemGroup>
</Project>

Run dotnet restore && dotnet build && dotnet publish -f netcoreapp1.0 && dotnet publish -f net462

bin\Debug\netcoreapp1.0\publish does not contain Newtonsoft.Json.dll, which is expected.
bin\Debug\net462\publish does however contain Newtonsoft.Json.dll, which is unexpected.

PS: Nice how small my sample could be with the new csproj format. Greate job!

[dasMulli]

PrivateAssets means the dependency is consumed but won't flow into other projects referencing your app/library.
I would expect it to still be part of a project's published output. So to me, it seems that the bug is actually it not being part of the netcoreapp output.
(Hoever, if you actually used the newtonsoft.json reference and it was a library, someone using the library via NuGet would then not be able to use the library as newtonsoft.json would be missing.)

[nphmuller]

Clear! But strange, because dotnet migrate converts the following part from project.json

"Newtonsoft.Json": {
  "type": "build",
  "version": "10.0.1"
}

to the following csproj file part.

<PackageReference Include="Newtonsoft.Json" Version="10.0.1">
  <PrivateAssets>All</PrivateAssets>
</PackageReference>

(Newtonsoft.Json is just an example of course. I'm actually trying this with a different package.)

It's also listed here as the proper way.

What would be the proper alternative with MsBuild to have a build-time only project reference? (So no copying to the output folder and no publishing).

[nguerrera]

@dasMulli

I would expect it to still be part of a project's published output.

PrivateAssets=All does suppress publishing, but that was arguably a mistake. We've added Publish=true as a way to get PrivateAssets without impacting publish, and Publish=false to impact publish without impacting how dependency flows to consumers.

I suspect the issue here is that the CopyLocalLockFileAssemblies implied for .NETFramework circumvents the publish filtering.