为什么dotnet发布不发布预期的版本？

Question

处理CVE-2018-8409，注意到我们的dotnet发布（.NET Core 2.1.403 ASPNET核心应用程序）正在我们的输出目录中发布System.IO.Pipelines.dll的v4.0.0.1。

我添加了一个nuget包引用到System.IO.Pipelines的v4.5.3。

我在构建输出中看不到对v4.0.0.1的引用，除此之外：

Unified primary reference "System.IO.Pipelines, Version=4.0.0.1, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51".
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.connections.abstractions\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Connections.Abstractions.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.http.connections\1.0.4\lib\netstandard2.0\Microsoft.AspNetCore.Http.Connections.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.core\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Core.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.transport.abstractions\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.server.kestrel.transport.sockets\2.1.3\lib\netstandard2.0\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll" because AutoUnify is 'true'.
         Using this version instead of original version "4.0.0.0" in "<home_dir>\.nuget\packages\microsoft.aspnetcore.signalr.core\1.0.4\lib\netstandard2.0\Microsoft.AspNetCore.SignalR.Core.dll" because AutoUnify is 'true'.
         Resolved file path is "<home_dir>\.nuget\packages\system.io.pipelines\4.5.3\lib\netstandard2.0\System.IO.Pipelines.dll".
         Reference found at search path location "{HintPathFromItem}".
         This reference is not "CopyLocal" because at least one source item had "Private" set to "false" and no source items had "Private" set to "true".
         The ImageRuntimeVersion for this reference is "v4.0.30319"

NOTE : <home_dir> is my user directory, it's not actually part of the output, fyi.

然而，当我在VS2017中检查时，我清楚地看到nuget包说System.IO.Pipelines（4.5.3）

我期望System.IO.Pipelines 4.5.3将在输出中，包括任何必要的程序集绑定重定向。

我缺少什么想法？

谢谢！

Answer 1

在一个非常讨厌的举动中，进一步的分析向我揭示了nuget包4.5.3，包含程序集版本4.0.0.1

Whyyyyyyy微软，Whyyyyyyy