@AArnott would you like for me to give this a first pass/attempt similar to the other PR'S we have done?

@AArnott i have started work on this & i am finding inconsistencies with what is on nuget.org. Could you help point me to where the packages are defined as what i am noticing is that isn't using the csproj so not sure why the deails hence dependencies are coming from.

I don't understand. The referenced packages all come from nuget.org. What exactly are you seeing to create the confusion?

When I look on nuget.org at the 2.5.140 version, I see System.Runtime.CompilerServices.Unsafe listed as a dependency however when I look at the csproj it ain't listed. Same result if I look at the latest preview. On looking at the csproj there is a property which further indicates to me that the packages are not built using csproj but something else which I can't locate

That csproj does in fact create the nuget package.

The Unsafe dependency is probably because we use transitive pinning, so any transitive dependency for which we specify a version (as we do for Unsafe) ends up as a direct dependency so our nuget package can specify that version.

So if you want to remove the Unsafe dependency from the package, look for transitive routes and remove them.

ahh, I forgot to consider how transitive dependencies are handled and as such merge request is now all updated. Thanks for the hint. ;)