analyzer-package-audit

To audit NuGet analyzer dependencies, inspect the generated nuspec and nupkg contents to distinguish transitive dependencies from bundled analyzer assemblies and verify the exposed dependency surface. This checks for hidden or bundled assets.

Bundled assets are analyzer assemblies packaged directly inside the nupkg, while transitive dependencies are external packages resolved through the dependency graph. Auditing distinguishes these to ensure dependency contracts are accurate.

Compare shipped README documentation with the actual packed nupkg behavior to catch inconsistencies. This identifies discrepancies between documented dependency contracts and the real transitive or bundled analyzer assets.

Yes, this audit applies to NuGet source-generator packaging scenarios to ensure required DLLs like OasReader.dll are bundled as analyzer assets without incorrectly masking other transitive dependencies like Refit.

Correlate project references with the inspected nuspec and nupkg contents to report discrepancies in dependency contracts. This verifies that packed outputs expose the correct dependency surface rather than just project references.