When CPM transitive pinning is used, direct dependencies of packages that are referenced by a development dependency are "leaked" to a class library project (that references this development ...