Incorrect and duplicate versions detected of a component in the same project file when using central package management (NuGet)

@jcfiorenzano is already working on this.

Since Feb 26, 2024.

I'm using Central Package Management to manage my NuGet versions centrally, and also pin subdependencies to higher versions, for instance to mitigate vulnerable transitive dependencies.

I pinned [`System.IdentityModel.Tokens.Jwt`](https://www.nuget.org/packages/System.IdentityModel.Tokens.Jwt#usedby-body-tab) because it had a vulnerability, which is used by [`Microsoft.IdentityModel.Protocols.OpenIdConnect`](https://www.nuget.org/packages/Microsoft.IdentityModel.Protocols.OpenIdConnect/), which is used by [`Microsoft.Data.SqlClient`](https://www.nuget.org/packages/Microsoft.Data.SqlClient/), which is used by [`Microsoft.EntityFrameworkCore.SqlServer`](https://www.nuget.org/packages/Microsoft.EntityFrameworkCore.SqlServer/) which I directly reference.

```xml

true
true

```

```xml

net8.0

```

I'm using the [`sbom-tool`](https://github.com/microsoft/sbom-tool) to generate my SBOM, and the scan manifest shows:

```json
{
"locationsFoundAt": [
"/src/MyProject.Persistence/MyProject.Persistence.csproj"
],
"component": {
"name": "System.IdentityModel.Tokens.Jwt",
"version": "6.24.0",
"authors": null,
"type": "NuGet",
"id": "System.IdentityModel.Tokens.Jwt 6.24.0 - NuGet",
"packageUrl": {
"Scheme": "pkg",
"Type": "nuget",
"Namespace": null,
"Name": "System.IdentityModel.Tokens.Jwt",
"Version": "6.24.0",
"Qualifiers": null,
"Subpath": null
}
},
"detectorId": "NuGetProjectCentric",
"isDevelopmentDependency": null,
"dependencyScope": null,
"topLevelReferrers": [
{
"name": "Microsoft.Data.SqlClient",
"version": "5.1.4",
"authors": null,
"type": "NuGet",
"id": "Microsoft.Data.SqlClient 5.1.4 - NuGet",
"packageUrl": {
"Scheme": "pkg",
"Type": "nuget",
"Namespace": null,
"Name": "Microsoft.Data.SqlClient",
"Version": "5.1.4",
"Qualifiers": null,
"Subpath": null
}
},
{
"name": "Microsoft.EntityFrameworkCore.SqlServer",
"version": "8.0.0",
"authors": null,
"type": "NuGet",
"id": "Microsoft.EntityFrameworkCore.SqlServer 8.0.0 - NuGet",
"packageUrl": {
"Scheme": "pkg",
"Type": "nuget",
"Namespace": null,
"Name": "Microsoft.EntityFrameworkCore.SqlServer",
"Version": "8.0.0",
"Qualifiers": null,
"Subpath": null
}
}
],
"containerDetailIds": [],
"containerLayerIds": {}
},
```

Interestingly, in a different project in the same solution the dependency version *is* correctly detected, but the project mentioned above *also* shows up here:

```json
{
"locationsFoundAt": [
"/src/MyProject.Web/MyProject.Web.csproj",
"/tests/MyProject.Tests.Integration/MyProject.Tests.Integration.csproj",
"/src/MyProject.Persistence/MyProject.Persistence.csproj"
],
"component": {
"name": "System.IdentityModel.Tokens.Jwt",
"version": "7.2.0",
"authors": null,
"type": "NuGet",
"id": "System.IdentityModel.Tokens.Jwt 7.2.0 - NuGet",
"packageUrl": {
"Scheme": "pkg",
"Type": "nuget",
"Namespace": null,
"Name": "System.IdentityModel.Tokens.Jwt",
"Version": "7.2.0",
"Qualifiers": null,
"Subpath": null
}
}
}
```

AB#2139506