NoWarn does not flow transitively through P2P references

[natidea]

Repro

1. Create two .NETStandard projects and create a P2P reference: ProjA -> ProjB

2. Add the following package reference to ProjB:

  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="10.0.0" />
  </ItemGroup>

3. Observe two NU1603 warnings, and corresponding warnings in the Dependencies Node:

4. Suppress the warning in ProjB either with NoWarn metadata on the package reference, or a global NoWarn property, or through Project Properties UI

Expected
All warnings go away

Actual
The warning for ProjB goes away but the warning for ProjA remains in the error list, and is also in the assets file. The dependency node also displays what looks like a phantom warning for ProjA.

This phantom warning is happening because the diagnostic in the assets file was raised and sent to the dependencies node, but it is not displayed because the faulty package reference does not actually exist in ProjA. (Dependencies node should probably do better about not showing a warning icon if the underlying diagnostic is not visible)

Workaround is to also suppress the warning in ProjA, but this can only be done using a global NoWarn. Updating the transitive package reference in ProjA with an MSBuild "Update" does not work, i.e.:

  <ItemGroup>
    <PackageReference Update="Newtonsoft.Json">
      <NoWarn>NU1603</NoWarn>
    </PackageReference>
  </ItemGroup>

Of course, another workaround is to explicitly add the project reference to ProjA instead of receiving it transitively.

Details about Problem

VS: d15prerel.26625.0

NuGet: 4.3.0-preview3-4168

dotnet.exe --version: 1.1.0-preview1-005051

/cc @mishra14 @emgarten @rrelyea @srivatsn

[natidea]

Perhaps the real problem here is that the original NU1603 warning should not flow transitively through the P2P ref in the first place, because it ends up looking like a duplicate:

[mishra14]

I did some preliminary analysis. It seems that on restore, Newtonsoft.Json does flow up to ProjA as we take the flattened graph while restoring ProjA and that contains all the dependencies from ProjB.

Will discuss this a bit more internally.

[rrelyea]

Let's continue meeting on friday. for now, this is pushed to post 4.3

[mishra14]

Moving to 4.4/To-Do based on internal discussion.

[nkolev92]

Feedback ticket 463600 also raised this concern.

[mishra14]

• Complete Design for flowing transitive NoWarn #5689 - Design task
• Implement code for flowing NoWarn properties Transitively #5691 - Implement the code/feature task
• Test the transitive flow of NoWarn  #5693 - Test task