Roslyn analyzers generate warnings for projects where they weren't installed as a nuget package

[JarLob]

15.7.5:

Steps to Reproduce:

1. Open some solution with projects and tests. You can use Nancy for example: git clone https://github.com/NancyFx/Nancy.git
2. Click manage nuget packaged for solution and add some roslyn analyzers nuget package, for example https://www.nuget.org/packages/Microsoft.CodeQuality.Analyzers to a single project in the solution - Nancy
3. Build the solution.

Expected Behavior:
Code quality warnings just from a single project in the solution.

Actual Behavior:
Warnings from test projects too. Microsoft.CodeQuality.Analyzers listed as a dependency under projects, that were not selected when installing the nuget package (nuget manager still shows only one project installed).

Notice, that Microsoft.CodeQuality.Analyzers has <developmentDependency>true</developmentDependency> in nuspec.

Do I miss something? Does it work as expected? How to use roslyn analyzers just for selected subset of projects?

[JarLob]

Tried the same with a solution that doesn't have netstandard projects and it works as expected - no analyzers appeared in dependent projects.

[mavasani]

This is by design. See the "NOTE" at the end of https://docs.microsoft.com/en-us/visualstudio/code-quality/use-roslyn-analyzers for clarification and PrivateAssets workaround.

@gewarren Thanks a lot for documenting this. @JarLob Did you try to search the documentation or google your specific issue? Wonder if we can highlight the documentation better in searches as this is quite a common issue that people seem to be facing.

[mavasani]

@sharwell pointed out that @JarLob has correct expectations for his scenario and <developmentDependency>true</developmentDependency> should automatically imply <PrivateAssets >all</PrivateAssets>. This is NuGet bug NuGet/Home#4125, which should be fixed with NuGet/NuGet.Client#2182

[JarLob]

Actually I didn't try to web search for that, but I did search issues. Now hopefully it will be even easier to find. I also put the information on my analyzer site