Restore using lock file fails for Blazor WASM projects

[dosolkowski-work]

NuGet Product Used

dotnet.exe

Product Version

10.0.101

Worked before?

8.0

Impact

It's more difficult to complete my work

Repro Steps & Context

Trying to restore NuGet packages using locked mode fails for Blazor WASM projects due to a package appearing in the lock file even though it is not referenced. I tried reporting this as a .NET SDK bug but was told this is a NuGet issue.

Reproduction repository: https://github.com/dosolkowski-work/dotnet-restore-error

Steps:

1. Run dotnet new blazorwasm
2. Add project settings:

    <Deterministic>true</Deterministic>
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
    <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode>

3. Run dotnet restore --force --force-evaluate to generate a lock file
4. Build in CI fails: dotnet publish dotnet-restore-error.csproj -c Release --output publish

Verbose Logs

Edited for readability:

/__w/dotnet-restore-error/dotnet-restore-error/dotnet-restore-error.csproj : error NU1004: The package references have changed for net10.0.
Lock file's package references:
 Microsoft.AspNetCore.App.Internal.Assets:[10.0.1, ),
 Microsoft.AspNetCore.Components.WebAssembly:[10.0.1, ),
 Microsoft.AspNetCore.Components.WebAssembly.DevServer:[10.0.1, ),
 Microsoft.DotNet.HotReload.WebAssembly.Browser:[10.0.101, ),
 Microsoft.NET.ILLink.Tasks:[10.0.1, ),
 Microsoft.NET.Sdk.WebAssembly.Pack:[10.0.1, ),
project's package references:
 Microsoft.AspNetCore.App.Internal.Assets >= 10.0.1,
 Microsoft.AspNetCore.Components.WebAssembly >= 10.0.1,
 Microsoft.AspNetCore.Components.WebAssembly.DevServer >= 10.0.1,
 Microsoft.NET.ILLink.Tasks >= 10.0.1,
 Microsoft.NET.Sdk.WebAssembly.Pack >= 10.0.1.
The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.

See action run log for details.

[donnie-msft]

Hello @dosolkowski-work , thank you for the clear repro of your issue. It looks like Blazor WASM is including an additional package in Debug that they remove in Release:

Microsoft.DotNet.HotReload.WebAssembly.Browser:[10.0.101, )

We're going to follow-up with them on that as it's causing a non-deterministic build.

In the meantime, if you create your lock file with the Release configuration, the lock files will match later when you publish. Just add the MSBuild property to your restore command: -p:Configuration=Release.

The whole restore command would be:
dotnet restore -p:Configuration=Release --force --force-evaluate

Let us know if that works around the problem for your scenario.