Multiple installed versions of .NET Desktop Runtime are incorrectly matched when running `winget upgrade`.

Brief description of your issue

When multiple versions of Microsoft .NET Desktop Runtime are installed under certain circumstances (see below), WinGet CLI will incorrectly identify some of them, offering an update that it should not.

Steps to reproduce

First of all, I should comment that this has supposedly happened as a result of a Lenovo Vantage Service update due to dependencies it has with both Microsoft ASP.NET Core 7.0.15 - Shared Framework (x64) and Microsoft Windows Desktop Runtime - 7.0.15 (x64) and which I have managed to successfully recreate on a relatively fresh Windows 10 Version 22H2 virtual machine running on Hyper-V.

With that said, here are the step-by-step instructions on how to reproduce it:

1. Install .NET Desktop Runtime 6.0 with WinGet: winget install Microsoft.DotNet.DesktopRuntime.6.
2. Install .NET Desktop Runtime 7.0 but instead of using WinGet, download the installer from the official website and install it manually (be sure it's the Desktop Runtime and matching architecture).
3. Now, run winget upgrade and see that an update is offered, however, it is for Microsoft.DotNet.DesktopRuntime.6 trying to update to .NET 7.0 (looks like a mismatch):

Name                                             Id                                Version  Available Source
------------------------------------------------------------------------------------------------------------
Microsoft Windows Desktop Runtime - 7.0.15 (x64) Microsoft.DotNet.DesktopRuntime.6 > 6.0.26 7.0.15    winget

4. If we now uninstall Microsoft Windows Desktop Runtime - 7.0.15 from Settings or Control Panel and run winget upgrade again, it will report no updates available, as it should:

No installed package found matching input criteria.

Diving into the WinGet logs, I have detected the following:

2024-02-09 22:00:00.928 [REPO] Finding available package from installed package using system reference search: Query:[none] Include:ProductCode='{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime'+'microsoft'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime(x64)'+'microsoft'[Exact]
2024-02-09 22:00:00.964 [REPO] Found multiple matches for installed package [{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}] in source [Microsoft.Winget.Source_8wekyb3d8bbwe] when searching for [Query:[none] Include:ProductCode='{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime'+'microsoft'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime(x64)'+'microsoft'[Exact]]
2024-02-09 22:00:00.965 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.7
2024-02-09 22:00:00.966 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.Preview
2024-02-09 22:00:00.967 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.8
2024-02-09 22:00:00.968 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.6
2024-02-09 22:00:00.968 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.5
2024-02-09 22:00:00.969 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.3_1
[...]
2024-02-09 22:00:01.025 [REPO] Finding available package from installed package using system reference search: Query:[none] Include:ProductCode='{b2476903-b8da-4dcc-903f-378730bb4c48}'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime'+'microsoft'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime(x64)'+'microsoft'[Exact]
2024-02-09 22:00:01.056 [REPO] Found multiple matches for installed package [{b2476903-b8da-4dcc-903f-378730bb4c48}] in source [Microsoft.Winget.Source_8wekyb3d8bbwe] when searching for [Query:[none] Include:ProductCode='{b2476903-b8da-4dcc-903f-378730bb4c48}'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime'+'microsoft'[Exact] Include:NormalizedNameAndPublisher='microsoftwindowsdesktopruntime(x64)'+'microsoft'[Exact]]
2024-02-09 22:00:01.057 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.6
2024-02-09 22:00:01.057 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.Preview
2024-02-09 22:00:01.058 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.8
2024-02-09 22:00:01.058 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.7
2024-02-09 22:00:01.058 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.5
2024-02-09 22:00:01.059 [REPO]   Checking match with package id: Microsoft.DotNet.DesktopRuntime.3_1
2024-02-09 22:00:01.068 [REPO] Opening pinning index
2024-02-09 22:00:01.068 [REPO] Opening existing pinning index
2024-02-09 22:00:01.068 [REPO] Opening SQLite Index for ReadWrite at 'C:\Users\test\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\pinning.db'
2024-02-09 22:00:01.068 [SQL ] Opening SQLite connection #6: 'C:\Users\test\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\pinning.db' [2, 0]
2024-02-09 22:00:01.070 [REPO] Opened Pinning Index with version [1.0], last write [2023-12-26 15:10:19.000]
2024-02-09 22:00:01.123 [REPO] Did not find a Version for { 7.0.15 }
2024-02-09 22:00:01.124 [REPO] Did not find a Version for { 7.0.15 }
2024-02-09 22:00:01.151 [CLI ] Leaf command succeeded: root:upgrade

The interesting part here is that there are multiple possible matches but there's no Appropriate available package could not be determined message, and then seems to be that it's calling on pinning.db and that's where it maybe determines that .NET 6.0 was installed previously with WinGet so it (mis)match the .NET 7.0 installation as a .NET 6.0 installation too? I don't really know.

Expected behavior

It should detect Microsoft Windows Desktop Runtime - 7.0.15 as Microsoft.DotNet.DesktopRuntime.7 instead of Microsoft.DotNet.DesktopRuntime.6.

Actual behavior

It mismatch the Microsoft Windows Desktop Runtime - 7.0.15 package ID because it was installed without WinGet and there's another version that was installed previously using WinGet.

Environment

Windows Package Manager v1.6.3482
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.19045.3930
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.21.3482.0

Winget Directories
-------------------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Enabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Disabled
LocalArchiveMalwareScanOverride           Disabled

Start by reproducing the mismatch with winget install Microsoft.DotNet.DesktopRuntime.6, a manual .NET 7 Desktop Runtime installation, and winget upgrade; then inspect the provided repository-search logs and pinning.db references. Done means the 7.0.15 installation is identified as Microsoft.DotNet.DesktopRuntime.7 and the upgrade output no longer offers it under .6, with regression coverage added in the relevant area.