In dotnet/msbuild@20cdf6f#r73773876 @ericstj pointed that we could do the following things to cleanup BDN dependencies:

There are references to a lot of packages which are out of date and not used on later frameworks.

In this particular case, the references to System.Reflection.Emit 4.3.x from Benchmark.NET are causing .NETCore 1.1 packages to be downloaded and never used. Referencing the newer version of System.Reflection.Emit would avoid this, so that's the most important thing to fix these Component Governance warnings.

I took a few minutes to review the dependencies of BDN and here's what I would recommend:

1. In the netstandard2.0 configuration:
   - remove System.ValueTuple - it's part of netstandard2.0
   - update System.Reflection.Emit* to 4.7.0
   - update Microsoft.DotNet.PlatformAbstractions to 3.1.6
   - update System.Threading.Tasks.Extensions to 4.5.4
   - update Microsoft.Win32.Registry to 5.0.0
   - update System.Management to 6.0.0

2. Consider a netstandard2.1 target and do the following (in addition to 1)
   - Remove System.Reflection.Emit*
   - Remove System.Threading.Tasks.Extensions
   - Request that Perfolizer produce a version that targets this framework and removes System.Memory reference.

3. Consider a net6.0 or newer target.
   - Remove PlatformAbstractions and use RuntimeInformation
   - Remove Microsoft.Win32.Registry

We should definitely address the nestandard2.0 issues. We can also consider adding the net6.0 target.

I am marking this issue as up-for-grabs. The person who is willing to work on it should test following scenarios:

1. "Modern" project files - you can create a new .NET 6.0+ console app, install BDN and run a simple benchmark
2. "Old" project files - you can create a new .NET 4.6.1 console app, install BDN and run a simple benchmark

To test local packages, you need to use the following command:

dotnet pack -c Release .\BenchmarkDotNet.sln

And add the folders that contain produced NuGet packages to nuget.config file (you can run dotnet new nugetconfig to create the file):

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <!--To inherit the global NuGet package sources remove the <clear/> line below -->
    <clear />

    <add key="api.nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="perfolizer-nightly" value="https://www.myget.org/F/perfolizer/api/v3/index.json" />
    <!-- reuquired test local build packages -->
    <add key="folder1" value="D:\projects\BenchmarkDotNet\src\BenchmarkDotNet.Annotations\bin\Release\" />
    <add key="folder1" value="D:\projects\BenchmarkDotNet\src\BenchmarkDotNet\bin\Release\" />
  </packageSources>
</configuration>