Investigate why transitive dependencies are leaking

[kevinchalet]

For reasons I ignore, something regressed in beta4/5 that caused transitive dependencies to leak across packages.
It shouldn't cause any technical issue, but it adds unnecessary/unwanted noise in the package dependencies:

https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.AspNetCore/OpenIddict.AspNetCore.csproj
https://www.nuget.org/packages/OpenIddict.AspNetCore/3.0.0-beta5.20503.76

Beta4:

Beta3:

[kevinchalet]

Potential culprits:

• .NET SDK 5.0 RC1.
• snupkgs, that we enabled recently.
• CPVM.

[kevinchalet]

The NuGet team confirmed this is caused by CPVM: NuGet/Home#10115.

[kevinchalet]

The NuGet team doesn't plan to change this behavior in 5.0 RTM and it's not clear when they'll be able to introduce a switch to opt out this unwanted behavior. As such, we'll need to remove CPVM.

@martincostello I'm afraid we'll also have to do that in the aspnet-contrib repos... 😭

[martincostello]

How much of an issue is this in the other repos with minimum dependencies? For example, MyGet only shows this for the Apple provider for 5.0 RC2:

[kevinchalet]

Hum yeah, good point. It looks like we don't have <PackageVersion>s for the transitive dependencies referenced by the IM packages we depend on, so it's much less visible in the OAuth/OpenID 2.0 repos than here (in another project, we now have up to 44 direct references compared to 7 before this change 🤣).

[kevinchalet]

@martincostello we can get a similar centralized management experience by using <PackageReference Update />: #1130. Thoughts?