I currently generate a seperate BOM for each target framework of my library projects (because the dependencies differ between frameworks and i want to minimize false positive vulnerability alerts).
With about ten separate packages and five target frameworks for each package, i end up invoking the tool about fifty times in a loop.
I had the idea to speed up the generation process by running a global NuGet restore on the complete solution up front and then invoke the tool with -tfm XYZ and --disable-package-restore.
But this does not work, all dependencies of all targets are combined into each bom, the -tfm switch is ignored.
Although looking into the assets.json, the dependencies are listed for each target framework separately, so in theory filtering the assets.json info by target framework should be possible.
I currently generate a seperate BOM for each target framework of my library projects (because the dependencies differ between frameworks and i want to minimize false positive vulnerability alerts).
With about ten separate packages and five target frameworks for each package, i end up invoking the tool about fifty times in a loop.
I had the idea to speed up the generation process by running a global NuGet restore on the complete solution up front and then invoke the tool with -tfm XYZ and --disable-package-restore.
But this does not work, all dependencies of all targets are combined into each bom, the -tfm switch is ignored.
Although looking into the assets.json, the dependencies are listed for each target framework separately, so in theory filtering the assets.json info by target framework should be possible.