Enabling AOT with package lock files is adding a dependency to `Microsoft.NET.ILLink.Tasks`

[nachtjasmin]

Describe the bug

When enabling the IsAotCompatible property together with RestorePackagesWithLockFile, dotnet adds Microsoft.NET.ILLink.Tasks as a direct dependency to the lock file. As an effect, even patch updates of the .NET SDK (e.g. from 8.0.100 to 8.0.101) ends up in breaking package builds.

Therefore, even a patch update ends up in being a breaking change, although it should not have an effect on the NuGet package.

To Reproduce

1. Create a new project, e.g. a console app with dotnet new console.
2. Enable IsAotCompatible and RestorePackagesWithLockFile in the .csproj.
3. As a result, the packages.lock.json looks like this (on my system with .NET 8.0.100):

{
  "version": 1,
  "dependencies": {
    "net8.0": {
      "Microsoft.NET.ILLink.Tasks": {
        "type": "Direct",
        "requested": "[8.0.0, )",
        "resolved": "8.0.0",
        "contentHash": "B3etT5XQ2nlWkZGO2m/ytDYrOmSsQG1XNBaM6ZYlX5Ch/tDrMFadr0/mK6gjZwaQc55g+5+WZMw4Cz3m8VEF7g=="
      }
    }
  }
}

An example gist with the project files shows the minimum code required to reproduce it.

Further technical details

Output of dotnet --info

.NET SDK:
 Version:           8.0.100
 Commit:            57efcf1350
 Workload version:  8.0.100-manifests.2d90560f

Runtime Environment:
 OS Name:     fedora
 OS Version:  39
 OS Platform: Linux
 RID:         fedora.39-x64
 Base Path:   /usr/lib64/dotnet/sdk/8.0.100/

.NET workloads installed:
 Workload version: 8.0.100-manifests.2d90560f
There are no installed workloads to display.

Host:
  Version:      8.0.0
  Architecture: x64
  Commit:       5535e31a71

.NET SDKs installed:
  6.0.126 [/usr/lib64/dotnet/sdk]
  8.0.100 [/usr/lib64/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.26 [/usr/lib64/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.0 [/usr/lib64/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.26 [/usr/lib64/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.0 [/usr/lib64/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  None

Environment variables:
  DOTNET_ROOT       [/usr/lib64/dotnet]

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[glen-84]

I'm not doing anything with AOT, but I keep seeing a change to lock files like this:

[TomGathercole]

We're seeing the same issue, which has broken our build pipelines a couple of times in the last few months (We use --locked-mode to restore, which will break if build agents have a newer patch version).

I think we've got a workaround for this by using a global.json with rollforward set to disable:

{
  "sdk": {
    "version": "8.0.202",
    "rollForward": "disable"
  }
}

But we expect this to cause some friction with local development, since Visual Studio will often uninstall older SDK versions when updated. We'll also need to manually update the SDK version rather than relying on the rollforward behaviour.

[TomGathercole]

Note: We're seeing this in projects with Sdk="Microsoft.NET.Sdk.BlazorWebAssembly", not setting IsAotCompatible directly.