Allow `Update` attribute to update `PackageReference` project items for transitive references

[bzd3y]

NuGet Product(s) Involved

MSBuild.exe

The Elevator Pitch

I was about to submit this to the MSBuild repository, but then I realized that it might actually belong here.

Currently it looks like Update does not update PackageReference items (at least in the case of transitive references). Allowing that could be useful when it is necessary or desirable to modify transitive references without promoting them to direct references and then version locking them.

One existing solution to this scenario is to exclude/not include "contentfiles" assets from directly reference package, like "EntityFrameworkCore.Design". And that does seem to work in this case, but to my understanding that will also exclude the assets of that library itself. So it might cause problems in situations where the library needs its "contentfiles" included to work properly (I don't believe that is the case for EFCore, but I could be wrong).

Another solution is to reference the dependency directly above with something like this:

<PackageReference Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.14.0" ExcludeAssets="all" />

But, as I described above, that now creates a direct reference that is version locked and will need to be managed by developers.

To avoid that, I propose something like the following:

<PackageReference Update="Microsoft.CodeAnalysis.Workspaces.MSBuild" ExcludeAssets="all" />

Alternatively, if it is for some reason easier to implement or more idiomatic (I don't think it is), the following might be an option:

<PackageReference Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="*" ExcludeAssets="all" />

Additional Context and Details

An example of where this would be helpful is the scenario(s) described in the following issues:

dotnet/roslyn#80127
dotnet/efcore#36970
#4856
petabridge/Incrementalist#355

These all seem to essentially be the same issue with the "Microsoft.CodeAnalysis.Workspaces.MSBuild package, but they all give an idea of how much activity this is creating.