How to hide dependent Nuget .dll's from consuming parent .dlls - What is the difference between 'Private Dependencies' and 'Merge / Repack' dependencies?

Question

Note: When I use the word .dll, I mean a NuGet package I have made that has a collection of methods, and dependencies, such as Newtonsoft.Json as an example.

Hello!

I am building an infrastructure of NuGet packages which keeps modularity in mind. Basically, if I have more NuGet packages, I only need to write the code once, and it can be shared between other .dll's which require the code. If I did not do this, I would need to copy and paste the code in multiple separate NuGet package .dlls'

Here is an example diagram, I tried to think of a some-what realistic case of 'dependency hell' where NuGet packages depend on other NuGet packages

The scenario:

My thing is that when I install 1 NuGet package (AAA) which relies on 5 other NuGet packages (BBB, CCC, DDD, EEE, FFF) for example, the parent (123) which consumes (AAA) will be able to reference all public methods in (BBB, CCC, DDD, EEE, FFF) packages.

The Question:

How do I prevent the parent (123) the ability to reference public methods in (BBB, CCC, DDD, EEE, FFF) packages? I only want the parent (123) to have the ability to use public methods from (AAA) which the parent (123) consumes and relies on as a direct dependency?

Why do I want this?

It seems wrong that the parent (123) can reference all of those other public methods, I am sure I will get some errors or issues down the line if I allow this.

My Research for the solution??

Private dependencies:

https://stackoverflow.com/questions/50875356/how-to-exclude-a-package-from-a-class-library-nuget-package

I am not sure if this is what I want.. but maybe it will work?

Merge or Repack dependencies using ILMerge or ILRepack:

https://www.meziantou.net/merging-assemblies-using-ilrepack.htm

https://www.continuousimprover.com/2016/05/the-magic-of-hiding-your-nuget.html

I am not sure if I I need to use ILMerge or Repack, it seems like maybe its overkill? or maybe its exactly what I need?

I am a bit stuck on this and would love some guidance or suggestions if you guys have any! Maybe im being over-zealous and do not need to worry about 'The Scenario' at all!

Thanks everyone!

Answer

In this scenario, you can use the PrivateAssets metadata to control this behavior.

more documentation you can find in:
https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets

hope this answers your question.