dotnet list package should show RID specific packages

[zivkan]

NuGet Product(s) Affected

dotnet.exe

Current Behavior

dotnet list package --vulnerable --include-transitive does not list some packages that NuGetAudit (restore) does. This is because audit will check all RID graphs, but dotnet list package only checks the no-RID graphs.

Desired Behavior

Any package that NuGetAudit reports as vulnerable during restore should also be discoverable with dotnet list package.

However, when a project contains multiple RIDs, and the graphs are the same, it should show 'groups' with the same package list, to avoid long output that is difficult to understand. See dotnet nuget why for an example.

Additional Context

list package previously did show packages from all the RIDs (although it didn't tell you that it was a RID-specific graph, or what the RID was), but it was removed because it looked like redundant output:

• dotnet list package on a solution outputs duplicate entries for framework #7607