CPM with Transitive Pinning does not work

[markk-df]

Describe the bug

Adding CPM with Transitive Pinning to a trivial sample breaks the code.

To Reproduce

https://github.com/dayforce-hcm/CPMTPDemo

Commit 01_Works works fine.
Commit 02_DoesNotWork does not work.

The README shows it clearly, here it is verbatim:

Before Central Package Management with Transitive Pinning

C:\work\CPMTPDemo [master ≡ +1 ~0 -0 !]> git co -q 01_Works
C:\work\CPMTPDemo [(01_Works) +1 ~0 -0 !]> dotnet build
Restore complete (0.6s)
  CPMTPBug net472 succeeded (0.3s) → bin\Debug\net472\CPMTPBug.dll

Build succeeded in 1.1s
C:\work\CPMTPDemo [(01_Works) +1 ~0 -0 !]>

After Central Package Management with Transitive Pinning

C:\work\CPMTPDemo [(01_Works) +1 ~0 -0 !]> git co -q 02_DoesNotWork
C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]> git diff -U0 01_Works 02_DoesNotWork
diff --git a/CPMTPBug.csproj b/CPMTPBug.csproj
index d5c181d..8e18e79 100644
--- a/CPMTPBug.csproj
+++ b/CPMTPBug.csproj
@@ -12 +12 @@
-    <PackageReference Include="HtmlSanitizer" Version="8.1.870" />
+    <PackageReference Include="HtmlSanitizer" />
diff --git a/__Directory.Packages.props b/Directory.Packages.props
similarity index 100%
rename from __Directory.Packages.props
rename to Directory.Packages.props
C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]>

C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]> cat .\Directory.Packages.props
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
    <CentralPackageVersionOverrideEnabled>false</CentralPackageVersionOverrideEnabled>
    <CentralPackageFloatingVersionsEnabled>true</CentralPackageFloatingVersionsEnabled>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="AngleSharp" Version="1.2.0" />
    <PackageVersion Include="HtmlSanitizer" Version="8.1.870" />
  </ItemGroup>
</Project>
C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]>

C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]> dotnet build
Restore complete (0.6s)
  CPMTPBug net472 failed with 1 error(s) (0.2s)
    C:\work\CPMTPDemo\Class1.cs(6,19): error CS0246: The type or namespace name 'IMarkupFormatter' could not be found (are you missing a using directive or an assembly reference?)

Build failed with 1 error(s) in 1.1s
C:\work\CPMTPDemo [(02_DoesNotWork) +1 ~0 -0 !]>

Further technical details

details of dotnet --info

.NET SDK: Version: 10.0.103 Commit: c2435c3e0f Workload version: 10.0.100-manifests.c992be6d MSBuild version: 18.0.11+c2435c3e0

Runtime Environment:
OS Name: Windows
OS Version: 10.0.26200
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\10.0.103\

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
Version: 10.0.3
Architecture: x64
Commit: c2435c3e0f

.NET SDKs installed:
9.0.308 [C:\Program Files\dotnet\sdk]
9.0.309 [C:\Program Files\dotnet\sdk]
10.0.102 [C:\Program Files\dotnet\sdk]
10.0.103 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.24 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.24 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 8.0.22 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.24 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Learn more:
https://aka.ms/dotnet/info

Download .NET:
https://aka.ms/dotnet/download

[phenning]

@baronfel , I think this should be triaged / moved to nuget?

[baronfel]

@phenning agree. Tagged with the nuget label, the bot will take it from here.