--- title: Limit what NuGet packages can do in your project | daily.dev description: NuGet packages can bring more than just runtime libraries: they can also include MSBuild props/targets and Roslyn analyzers that execute during restore,... canonical: https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Limit what NuGet packages can do in your project | daily.dev og:description: NuGet packages can bring more than just runtime libraries: they can also include MSBuild props/targets and Roslyn analyzers that execute during restore,... og:url: https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc og:image: https://api.daily.dev/og/posts/FlXGgYYBC.png og:image:alt: Limit what NuGet packages can do in your project og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Limit what NuGet packages can do in your project **[Meziantou](https://daily.dev/sources/meziantou)** · 3 min read · 2 upvotes · 0 comments ## Summary NuGet packages can bring more than just runtime libraries: they can also include MSBuild props/targets and Roslyn analyzers that execute during restore, design-time build, or build, creating a supply-chain risk. The IncludeAssets and ExcludeAssets attributes on PackageReference let developers restrict which asset groups (compile, runtime, build, buildTransitive, analyzers, contentFiles) get imported. Examples cover including only runtime/compile assets, disabling analyzers while keeping the library, disabling build targets while keeping analyzers, and using a package purely for build tooling with PrivateAssets="all". Recommends testing after changing filters since some packages need their analyzers or build targets to function, and pairing this with lock files and package source mapping for stronger protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I stop a NuGet package from running its analyzers but still use the library? Use ExcludeAssets set to analyzers on the PackageReference element in the .csproj file. For example, wrapping a PackageReference with analyzers keeps the runtime and compile assets while preventing the package's Roslyn analyzers from running during build. _daily.dev surfaces practical .NET dependency hardening techniques like this for developers securing their builds._ ### What is the difference between IncludeAssets and ExcludeAssets in a NuGet PackageReference? IncludeAssets specifies an allowlist of asset groups (such as compile and runtime) to import from a package, blocking everything else including analyzers and build targets by default. ExcludeAssets instead keeps NuGet's default behavior of importing everything, but removes specific groups like analyzers, build, buildMultitargeting, or buildTransitive while still allowing others such as contentFiles. _Developers weighing dependency risk trade-offs can find similar .NET packaging guidance on daily.dev._ ### How do I add a NuGet package that only provides build tooling without it flowing to consumers of my project? Reference the package with PrivateAssets="all" combined with IncludeAssets set to build;buildMultitargeting;buildTransitive. PrivateAssets="all" stops the dependency from flowing transitively to projects that reference your project, while IncludeAssets limits what is imported to only the build-related assets. _daily.dev helps .NET engineers track NuGet configuration patterns for managing transitive build dependencies._ ## Similar posts on daily.dev - [NuGet Package Pruning: Cleaner Dependencies and Actionable Vulnerability Reports](https://daily.dev/posts/nuget-package-pruning-cleaner-dependencies-and-actionable-vulnerability-reports-to2rg1k06) · .NET Blog · 30 upvotes · 0 comments - [Incremental Source Generators Done Right: Ship It Without Breaking Consumers — Daily DevOps & .NET](https://daily.dev/posts/incremental-source-generators-done-right-ship-it-without-breaking-consumers-daily-devops-net-jcaoono9a) · Daily DevOps & .NET · 3 upvotes · 0 comments - [Enhanced security in NuGet for .NET 10](https://daily.dev/posts/enhanced-security-in-nuget-for-net-10-az3nuw9gp) · The Art of Simplicity · 8 upvotes · 0 comments - [The Complete Guide to Creating NuGet Packages in .NET](https://daily.dev/posts/the-complete-guide-to-creating-nuget-packages-in-net-4carsceoo) · We Are .NET · 0 upvotes · 0 comments - [Stop Your AI Agent Picking the Wrong .NET Libraries](https://daily.dev/posts/stop-your-ai-agent-picking-the-wrong-net-libraries-m6tagi9al) · Code with Mukesh · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#.net](https://daily.dev/tags/.net), [#c#](https://daily.dev/tags/c#), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Limit what NuGet packages can do in your project","url":"https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc"},"datePublished":"2026-08-24T12:13:43.867Z","dateModified":"2026-09-14T08:37:50.299Z","description":"NuGet packages can bring more than just runtime libraries: they can also include MSBuild props/targets and Roslyn analyzers that execute during restore,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/508c1d9554378f84579bf92663a0f279?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/508c1d9554378f84579bf92663a0f279?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Meziantou","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Meziantou","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1bdfdd5349654b08ab6fa3f1ac38192c","url":"https://daily.dev/sources/meziantou"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,.net,c#,nuget","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Meziantou","item":"https://daily.dev/sources/meziantou"},{"@type":"ListItem","position":3,"name":"Limit what NuGet packages can do in your project"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc#faq","mainEntity":[{"@type":"Question","name":"How do I stop a NuGet package from running its analyzers but still use the library?","acceptedAnswer":{"@type":"Answer","text":"Use ExcludeAssets set to analyzers on the PackageReference element in the .csproj file. For example, wrapping a PackageReference with analyzers keeps the runtime and compile assets while preventing the package's Roslyn analyzers from running during build. daily.dev surfaces practical .NET dependency hardening techniques like this for developers securing their builds."}},{"@type":"Question","name":"What is the difference between IncludeAssets and ExcludeAssets in a NuGet PackageReference?","acceptedAnswer":{"@type":"Answer","text":"IncludeAssets specifies an allowlist of asset groups (such as compile and runtime) to import from a package, blocking everything else including analyzers and build targets by default. ExcludeAssets instead keeps NuGet's default behavior of importing everything, but removes specific groups like analyzers, build, buildMultitargeting, or buildTransitive while still allowing others such as contentFiles. Developers weighing dependency risk trade-offs can find similar .NET packaging guidance on daily.dev."}},{"@type":"Question","name":"How do I add a NuGet package that only provides build tooling without it flowing to consumers of my project?","acceptedAnswer":{"@type":"Answer","text":"Reference the package with PrivateAssets=\"all\" combined with IncludeAssets set to build;buildMultitargeting;buildTransitive. PrivateAssets=\"all\" stops the dependency from flowing transitively to projects that reference your project, while IncludeAssets limits what is imported to only the build-related assets. daily.dev helps .NET engineers track NuGet configuration patterns for managing transitive build dependencies."}}]} ```