Repository navigation
6.3.0 marks Microsoft.ML.OnnxRuntime.Gpu and its dependencies as development-only (scope="excluded"), so --exclude-dev drops a shipped runtime package #1139
Description
Since 6.3.0 (#1138), a project that references Microsoft.ML.OnnxRuntime.Gpu gets that package and its whole dependency tree marked scope="excluded". With --exclude-dev, the BOM comes out empty. 6.2.0 and 6.2.1 mark the same packages required.
These packages ship. A dotnet publish puts Microsoft.ML.OnnxRuntime.dll, libonnxruntime.so and the provider libraries in the output, and the app crashes on start without them.
Microsoft.ML.OnnxRuntime.Gpu has no lib/runtime assets of its own, only buildTransitive props and targets. Its dependencies carry the real files. My guess is the new check reads "no runtime assets" as development-only, then carries that down to the dependencies.
Steps to reproduce
dotnet new console -n Repro --framework net10.0
cd Repro
dotnet add package Microsoft.ML.OnnxRuntime.Gpu --version 1.25.1
Replace Program.cs with:
using Microsoft.ML.OnnxRuntime;
Console.WriteLine(OrtEnv.Instance().GetVersionString());Then:
dotnet build
dotnet-CycloneDX Repro.csproj -o out -fn bom.json -F Json
dotnet-CycloneDX Repro.csproj -o out-ed -fn bom.json -F Json -ed
The result is the same with the template's default Program.cs.
Results
| Version | No flag | --exclude-dev |
|---|---|---|
| 6.2.0 | all 5 components required |
all 5 components |
| 6.2.1 | all 5 components required |
all 5 components |
| 6.3.0 | all 5 components excluded |
no components |
The 5 components are Microsoft.ML.OnnxRuntime.Gpu, .Gpu.Linux, .Gpu.Windows, .Managed and System.Numerics.Tensors.
Expected: all 5 are required, as in 6.2.x, because they end up in the published output.
Environment: .NET SDK 10, net10.0, Windows 11.
Activity
wahyuen commentedon Oct 12, 2026
I think I've found where it comes from, in
ProjectAssetsFileService.csat v6.3.0.SetIsDevDependency(L131-L168) returnstruewhen a package has no runtime-capable assets and has build assets:Microsoft.ML.OnnxRuntime.Gpuis a meta-package. Its only assets arebuildTransitive/netstandard2.1/Microsoft.ML.OnnxRuntime.Gpu.propsand.targets, so it's marked as a dev dependency even though it's a plain directPackageReference.The reachability walk (L181) only starts from direct references that aren't dev dependencies:
The meta-package is never a starting point, so
.Gpu.Linux,.Gpu.Windows,.ManagedandSystem.Numerics.Tensorsare never reached, and they all becomeexcludedtoo, although they carry the runtime and native assets.A package that only carries build assets but has dependencies that carry runtime or native assets probably shouldn't count as development-only. Treating a direct reference with the default
IncludeAssets/PrivateAssetsas runtime would fix this case too.chore(release): 6.3.1
ci: Bump cyclonedx from 6.3.0 to 6.3.1 (#527)
Bump cyclonedx from 6.3.0 to 6.3.1 (#168)