Implicit SDK-inserted PackageReferences cause friction with NuGet LockFiles

Start with global.json, Client.csproj, and packages.lock.json, then reproduce restore with SDK 8.0.200 and 8.0.202 using --force-evaluate and --locked-mode. Compare the implicit package references and lock-file versions; done means locked-mode restore remains consistent with the SDK selected by global.json.

Hi,

I have a project using:
<Project Sdk="Microsoft.NET.Sdk.BlazorWebAssembly">
and
<RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>

I get an auto-referenced package added to the "packages.lock.json" file:

{
  "version": 2,
  "dependencies": {
    "net8.0": {
      ...
      "Microsoft.NET.ILLink.Tasks": {
        "type": "Direct",
        "requested": "[8.0.2, )",
        "resolved": "8.0.2",
        "contentHash": "hKTrehpfVzOhAz0mreaTAZgbz0DrMEbWq4n3hAo8Ks6WdxdqQhNPvzOqn9VygKuWf1bmxPdraqzTaXriO/sn0A=="
      },      
      ...

I do not have a direct reference to "Microsoft.NET.ILLink.Tasks". It is also marked with "(A)" when doing a "dotnet list .\Client.csproj package":

Project 'Client' has the following package references
   [net8.0]: 
   Top-level Package                                     Requested        Resolved      
   > Microsoft.AspNetCore.Components.WebAssembly         8.0.2            8.0.2
   > Microsoft.AspNetCore.SignalR.Client                 8.0.2            8.0.2
   > Microsoft.Extensions.Http                           8.0.0            8.0.0
   > Microsoft.Extensions.Logging.Configuration          8.0.0            8.0.0
   > Microsoft.NET.ILLink.Tasks                    (A)   [8.0.2, )        8.0.2
   > Microsoft.NET.Sdk.WebAssembly.Pack            (A)   [8.0.2, )        8.0.2

I have a global.json file that looks like this:

{
  "sdk": {
    "version": "8.0.200",
    "rollForward": "disable"
  }
}

When running "dotnet restore --force-evaluate" it respects the SDK version in global.json and updates the packages.lock.json file to use v8.0.2 of Microsoft.NET.ILLink.Tasks:

"Microsoft.NET.ILLink.Tasks": {
  "type": "Direct",
  "requested": "[8.0.2, )",
  "resolved": "8.0.2",
  "contentHash": "hKTrehpfVzOhAz0mreaTAZgbz0DrMEbWq4n3hAo8Ks6WdxdqQhNPvzOqn9VygKuWf1bmxPdraqzTaXriO/sn0A=="
},

The Microsoft-hosted agents have v8.0.202 installed and when running "dotnet restore --locked-mode" it does not respect global.json and fails:
"error NU1004: The package reference Microsoft.NET.Sdk.WebAssembly.Pack version has changed from [8.0.3, ) to [8.0.2, ).The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file."

- task: PowerShell@2
  displayName: 'Restore NuGet packages'
  inputs:
    targetType: 'inline'
    script: |
      dotnet restore --locked-mode --configfile "$(Build.SourcesDirectory)/NuGet.config"

Best Regards,
Anders Havn

Expected Behavior

"dotnet restore --locked-mode" also respects the .NET SDK version in global.json.