Direct reference in group does not resolve conflict with VS2017 and PackageReference

PaketConflictExampleFixed.zip

Description

When using paket to manage nuget packages for a .NET Framework 4.7.1 project which uses the PackageReference management format with VS2017 we have found that having grouped packages which all require different versions of the same transitive dependency (e.g. Newtonsoft.Json) seems to cause a NU1605 warning indicating a package downgrade was detected.

The usual way to resolve this condition is to add a direct dependency in the project which overrides any transitive package references. We have done this via the paket.dependencies file and paket is able to resolve those conflicts fine however Visual Studio cannot and shows a yellow warning symbol next to the package reference.

I can see that when converting to paket the csproj file is updated with an import for Paket.Restore.targets so I set about exploring that to see how it works. As far as I can tell lines 139 - 151 are responsible for outputting each PackageReference to the project so I added a Message to dump the contents of the PaketReferencesFileLines variable to inspect its contents. I can see that Newtonsoft.Json is included three times in this order:

Newtonsoft.Json,11.0.2,Direct,Common,false
Newtonsoft.Json,10.0.3,Transitive,Main,false
Newtonsoft.Json,10.0.1,Transitive,Website,false

As you can see paket included the direct dependency, but as far as Visual Studio is concerned these are all direct dependencies and the order of them appears to be important, so the last one wins. Therefor Visual Studio ends up trying to resolve the conflict with version 10.0.1 which causes the NU1605 warning.

I think this is related to our grouping as the transitives are coming from separate groups, but intuition suggested to me that a group with a locked dependency should still be prioritized over other references.

Repro steps

1. Create a .NET Framework 4.7.1 project with VS2017 which uses the new PackageReference package management format.
2. Create a paket.dependencies file adding two packages in separate groups each of which depend upon differing versions of Newtonsoft.Json (e.g. 10.0.1 and 10.0.3).
3. Add a Newtonsoft.Json dependency to the paket.dependencies file locked to a newer version (e.g. 11.0.2).
4. Reference the three dependencies in the paket.references file.
5. Perform a paket install.
6. Load the project in VS2017 to see the warning under Dependencies > NuGet > Newtonsoft.Json (10.0.1)

See attached example solution: PaketConflictExampleFixed.zip

Expected behavior

Package version conflict should be resolved to version 11.0.2.

Actual behavior

Package version conflict is attempted to be resolved to version 10.0.1 causing errors.

Reproduce the warning with the attached example and inspect Paket.Restore.targets around lines 139–151, focusing on how PaketReferencesFileLines is generated from paket.dependencies and paket.references. Verify that the direct Newtonsoft.Json version is emitted in a way Visual Studio 2017 honors, and confirm the project resolves to 11.0.2 without NU1605.