lock file not updating when packagereference removed

[zivkan]

Details about Problem

NuGet product used (NuGet.exe | VS UI | Package Manager Console | dotnet.exe): dotnet.exe

NuGet version (x.x.x.xxx): 5.0.0.4

dotnet.exe --version (if appropriate): 3.0.100-preview3-010410

VS version (if appropriate): n/a

OS version (i.e. win10 v1607 (14393.321)): 17763.379

Worked before? If so, with which NuGet version:

Detailed repro steps so we can see the same problem

dotnet new console -n MyApp
dotnet restore --use-lock-file MyApp\MyApp.csproj
dotnet new classlib -n MyLib
dotnet add MyLib\MyLib.csproj package Newtonsoft.Json --version 12.0.1
dotnet add MyApp\MyApp.csproj reference MyLib\MyLib.csproj
dotnet restore MyApp\MyApp.csproj
# confirm MyApp\packages.lock.json contains Newtonsoft.Json as a transitive dependency

dotnet add MyApp\MyApp.csproj package Newtonsoft.Json --version 12.0.1
# confirm MyApp\packages.lock.json contains Newtonsoft.Json as a direct dependency

dotnet remove MyApp\MyApp.csproj package Newtonsoft.Json
dotnet restore MyApp\MyApp.csproj --force
# MyApp\packages.lock.json should have Newtonsoft.Json as a transitive dependency, but it's still listed as direct

dotnet remove MyLib\MyLib.csproj package Newtonsoft.Json
dotnet restore MyApp\MyApp.csproj --force
# MyApp\packages.lock.json should no longer have Newtonsoft.Json as a dependency, but it's still listed.

[nkolev92]

Pinpointed the issue in dev-nkolev92-lockFileRemovePackage .
Started some basic work, but will finish in week 3.

The issue is that we don't account for packages in the lock file, but not in the package graph when doing the dirty check.

//cc @anangaur

[nkolev92]

Same thing would happen if the dependency removed was coming from MyApp.

[nkolev92]

Customer report #8091.

[anangaur]

This seems like a 4.9.x candidate as discussed.

[nkolev92]

@anangaur Created #8094 with a list of servicing considerations, currently assigned to you, Rob + the authors of the fixes/features in the original milestone.