Auto-referenced packages gets added to packages.lock.json for Microsoft.NET.Sdk.BlazorWebAssembly

[vedion]

Hi,

I have a project using: <Project Sdk="Microsoft.NET.Sdk.BlazorWebAssembly"> and <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>

I get two Auto-referenced packages added to the "packages.lock.json" file:

{
  "version": 2,
  "dependencies": {
    "net8.0": {
      "Microsoft.AspNetCore.Components.WebAssembly": {
        "type": "Direct",
        "requested": "[8.0.3, )",
        "resolved": "8.0.3",
        "contentHash": "fjmErNTFesEhytAEw/MNddi5oubBPPZB/2jivD4G+hv5Z+vQnuHRAh1YNy0IKJV3T49Fvu4AhUdcLfEZvO24QA==",
        "dependencies": {
          "Microsoft.AspNetCore.Components.Web": "8.0.3",
          "Microsoft.Extensions.Configuration.Binder": "8.0.1",
          "Microsoft.Extensions.Configuration.Json": "8.0.0",
          "Microsoft.Extensions.Logging": "8.0.0",
          "Microsoft.JSInterop.WebAssembly": "8.0.3"
        }
      },
      "Microsoft.AspNetCore.SignalR.Client": {
        "type": "Direct",
        "requested": "[8.0.3, )",
        "resolved": "8.0.3",
        "contentHash": "zjQGIt4s+2zIVy0etNRxcMf79JEI4C3zpPwNu3pPFepe7G/T1lbyg6Q/rqW8GTr7SEVHWlwTNRbeaJ5FTENjrA==",
        "dependencies": {
          "Microsoft.AspNetCore.Http.Connections.Client": "8.0.3",
          "Microsoft.AspNetCore.SignalR.Client.Core": "8.0.3"
        }
      },
      "Microsoft.Extensions.Http": {
        "type": "Direct",
        "requested": "[8.0.0, )",
        "resolved": "8.0.0",
        "contentHash": "cWz4caHwvx0emoYe7NkHPxII/KkTI8R/LC9qdqJqnKv2poTJ4e2qqPGQqvRoQ5kaSA4FU5IV3qFAuLuOhoqULQ==",
        "dependencies": {
          "Microsoft.Extensions.Configuration.Abstractions": "8.0.0",
          "Microsoft.Extensions.DependencyInjection.Abstractions": "8.0.0",
          "Microsoft.Extensions.Diagnostics": "8.0.0",
          "Microsoft.Extensions.Logging": "8.0.0",
          "Microsoft.Extensions.Logging.Abstractions": "8.0.0",
          "Microsoft.Extensions.Options": "8.0.0"
        }
      },
      "Microsoft.Extensions.Logging.Configuration": {
        "type": "Direct",
        "requested": "[8.0.0, )",
        "resolved": "8.0.0",
        "contentHash": "ixXXV0G/12g6MXK65TLngYN9V5hQQRuV+fZi882WIoVJT7h5JvoYoxTEwCgdqwLjSneqh1O+66gM8sMr9z/rsQ==",
        "dependencies": {
          "Microsoft.Extensions.Configuration": "8.0.0",
          "Microsoft.Extensions.Configuration.Abstractions": "8.0.0",
          "Microsoft.Extensions.Configuration.Binder": "8.0.0",
          "Microsoft.Extensions.DependencyInjection.Abstractions": "8.0.0",
          "Microsoft.Extensions.Logging": "8.0.0",
          "Microsoft.Extensions.Logging.Abstractions": "8.0.0",
          "Microsoft.Extensions.Options": "8.0.0",
          "Microsoft.Extensions.Options.ConfigurationExtensions": "8.0.0"
        }
      },
      "Microsoft.NET.ILLink.Tasks": {
        "type": "Direct",
        "requested": "[8.0.2, )",
        "resolved": "8.0.2",
        "contentHash": "hKTrehpfVzOhAz0mreaTAZgbz0DrMEbWq4n3hAo8Ks6WdxdqQhNPvzOqn9VygKuWf1bmxPdraqzTaXriO/sn0A=="
      },
      "Microsoft.NET.Sdk.WebAssembly.Pack": {
        "type": "Direct",
        "requested": "[8.0.2, )",
        "resolved": "8.0.2",
        "contentHash": "sq7Zs4E699WDIbFloiK/qmp9JtL8vpzMGILjnzYjkY4O1qj6z1Iu36dl4xWXrkVsKDnxw8CZ7NDqsntq5FFPgg=="
      },

I do not have a direct reference to "Microsoft.NET.ILLink.Tasks" and "Microsoft.NET.Sdk.WebAssembly.Pack". They are also marked with "(A)" when doing a "dotnet list .\Client.csproj package":

Project 'Client' has the following package references
   [net8.0]: 
   Top-level Package                                     Requested        Resolved      
   > Microsoft.AspNetCore.Components.WebAssembly         8.0.3            8.0.3
   > Microsoft.AspNetCore.SignalR.Client                 8.0.3            8.0.3
   > Microsoft.Extensions.Http                           8.0.0            8.0.0
   > Microsoft.Extensions.Logging.Configuration          8.0.0            8.0.0
   > Microsoft.NET.ILLink.Tasks                    (A)   [8.0.3, )        8.0.3
   > Microsoft.NET.Sdk.WebAssembly.Pack            (A)   [8.0.3, )        8.0.3

It is correct that the auto-referenced packages gets added to the "packages.lock.json" file?

Best Regards, Anders Havn

.NET Version

8.0.203

[vedion]

For us this is an issue when the Microsoft-hosted agents are being updated. While updating the agents are running different .NET Core SDK versions and we will get this error on the pipeline:

"error NU1004: The package reference Microsoft.NET.Sdk.WebAssembly.Pack version has changed from [8.0.3, ) to [8.0.2, ).The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file."