Project Dependencies of ProjectReferences marked as PrivateAssets should not be included in the lock file up to date check

[nkolev92]

8493.zip

Extract the above project, run dotnet restore --locked-mode

Motivation from #8493.

Issue being hit by @bddckr

fyi @tebeco Not your specific issue, but one that the discussion produced.

I want to keep this issue focused to the problem at hand.

Specifically refer to #8493 (comment).

Note that this has never worked correctly, so not a regression (in 4.9, it simply didn't validate it)

The fix is: https://github.com/NuGet/NuGet.Client/blob/638f34578d2221abc1259286ce2d4c132600cea7/src/NuGet.Core/NuGet.ProjectModel/ProjectLockFile/PackagesLockFileUtilities.cs#L168

We should strip out the PrivateAssets=All project references from p2pSpecProjectRestoreMetadataFrameworkInfo.ProjectReferences.

fyi @rrelyea

[nkolev92]

Relevant issue: #9332.

Potentially both might be addressed by the same bug fix.

[tebeco]

thx a lot for the followup @nkolev92

[nkolev92]

Hey @tebeco some of that is described here: https://github.com/NuGet/Home/blob/dev/designs/ClientDevProcess.md.

The milestone is the key thing here. That covers when we are trying to commit to certain items.
Ofc we don't get to 100% of the items.

[tebeco]

thx a lot for this

[nkolev92]

sorry for the delay...5.9 is when this will ship.

[tebeco]

a fix is still a fix :) 👍
regarding the version where is will land, would it be possible to have build automatically set a tag or associate a github milestone ? so that anyone opening an already close issue (same for PR) would know the minimal version ?

[nkolev92]

We tag the commits, would that be enough? In particular, see NuGet/NuGet.Client@e9722d6, it has 2 tags, 5.9.0.6991 and 5.9.0.6995.