dotnet restore --locked-mode in Blazor WASM project is broken after v10.0.401 release

[ricardomomm]

Describe the bug

After updating my project global.json to the latest SDK release (10.0.401) and rebuilding the solution, VS updated my project package.lock.json file with the following references now pointing to 10.0.12:

• Microsoft.AspNetCore.App.Internal.Assets
• Microsoft.NET.ILLink.Tasks

But it did not update

• Microsoft.NET.Sdk.WebAssembly.Pack

When doing a dotnet restore --locked-mode in that project it throws an error because the restore tries to load 10.0.12 but the lock references 10.0.11 incorrectly.

Steps to reproduce

Setup a Blazor WASM project with the usage of nuget lock files, a global.json pointing to 10.0.400, build to generate the lock file, change global.json to point to 10.0.401, build again to update the lock file, execute dotnet restore --locked-mode, you should get:

error NU1004: The package reference Microsoft.NET.Sdk.WebAssembly.Pack version has changed from [10.0.12, ) to [10.0.11, ).The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.

Restore failed with 1 error(s) in 3.3s

Expected behavior

I expect the restore to abide by the lock file

Actual behavior

It is throwing the following error:

error NU1004: The package reference Microsoft.NET.Sdk.WebAssembly.Pack version has changed from [10.0.12, ) to [10.0.11, ).The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.

Restore failed with 1 error(s) in 3.3s

Is this a regression?

No response

Are there any workarounds?

I couldn't find one, by updating the lock file manually to reference the correct version would just force the next build to revert the changes

dotnet --info output

.NET SDK:
 Version:           10.0.401
 Commit:            e34a38d2ae
 Workload version:  10.0.400.1
 MSBuild version:   18.9.11+e34a38d2a

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.26200
 OS Platform: Windows
 RID:         win-x64
 Base Path:   C:\Program Files\dotnet\sdk\10.0.401\

.NET workloads installed:
 [android]
   Installation Source: SDK 10.0.400, VS 18.10.12201.205
   Manifest Version:    36.1.69/10.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.android\36.1.69\WorkloadManifest.json
   Install Type:              Msi

 [ios]
   Installation Source: SDK 10.0.400, VS 18.10.12201.205
   Manifest Version:    26.5.10315/10.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.ios\26.5.10315\WorkloadManifest.json
   Install Type:              Msi

 [maccatalyst]
   Installation Source: SDK 10.0.400, VS 18.10.12201.205
   Manifest Version:    26.5.10315/10.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.maccatalyst\26.5.10315\WorkloadManifest.json
   Install Type:              Msi

 [maui-windows]
   Installation Source: SDK 10.0.400, VS 18.10.12201.205
   Manifest Version:    10.0.20/10.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.maui\10.0.20\WorkloadManifest.json
   Install Type:              Msi

 [wasm-tools]
   Installation Source: SDK 10.0.400, VS 18.10.12201.205
   Manifest Version:    10.0.111/10.0.100
   Manifest Path:       C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.workload.mono.toolchain.current\10.0.111\WorkloadManifest.json
   Install Type:              Msi

Configured to use workload sets when installing new manifests.

Host:
  Version:      10.0.12
  Architecture: x64
  Commit:       95017c711e

.NET SDKs installed:
  8.0.417 [C:\Program Files\dotnet\sdk]
  9.0.314 [C:\Program Files\dotnet\sdk]
  10.0.103 [C:\Program Files\dotnet\sdk]
  10.0.203 [C:\Program Files\dotnet\sdk]
  10.0.302 [C:\Program Files\dotnet\sdk]
  10.0.401 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 9.0.16 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 10.0.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.21 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 9.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 10.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 9.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 10.0.7 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 10.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 10.0.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  x86   [C:\Program Files (x86)\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

IDE version

VS 18.10.0

Other details

No response

[github-actions]

🎯 Agentic Issue Triage

Triage Assessment:

• 🏷️ Labels: Applied Area-WasmSdk, Bug Area-WasmSdk Bug
• 💻 Assignment: @maraf | none
• 🟨 Confidence: medium - Report clearly points to WasmSdk lock-file versioning, but NuGet restore logic may share root cause.

Similar issues: #48795 (duplicate) #39697 (potentially related)

➡️ Summary: dotnet restore --locked-mode fails because Microsoft.NET.Sdk.WebAssembly.Pack version in the lock file doesn't match the SDK's supplied version after upgrading. Consider aligning implicit SDK-supplied package versions with lock file consistency checks across SDK patch updates.

Generated by 🏷️ Issue Triage for #56208 · copilot · auto · 94.1 AIC · ⌖ 7.89 AIC · ⊞ 14.6K · ◷

[dorssel]

Ran into the same issue.

After cleaning local cache (dotnet nuget locals all --clear), deleting obj and bin, and doing a full restore (on Windows), our (Linux) build-bot now complains:

error NU1403: Package content hash validation failed for Microsoft.NET.Sdk.WebAssembly.Pack.10.0.12. The package is different than the last restore.

So ... now it agrees 10.0.12 is the version to use, but Windows and Linux disagree on the digest.