Using NuGet restore with lock files gives "NU1004: The packages lock file is inconsistent with the project dependencies" error

Question

I am getting this error when I use the -LockMode switch with the nuget restore command.

NU1004: The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.

What I am trying to achieve is to automatically upgrade my nuget references by using wildcards but use specific versions when I want to re-build my project from known sources. this blog posts describes how this can be achieved Enable repeatable package restores using a lock file.

When I use -UseLockFile & -LockMode on a simple solution with just one project it works as expected, the issue arises when I start adding another project to the solution.

Here're the steps:

I have published my package to an Azure DevOps feed and I have the following versions listed:

1.0.1-ci.1
1.0.1-ci.2

I have created a .Net 3.1 console app that references my package using wild cards, i.e.
Running the command nuget restore -UseLockFile -ForceEvaluate creates the packages.lock.json with the right reference (I am using -ForceEvaluate in order to ensure it always resolves to the latest version available on the feed), the contents of the lock file of my console project are:

{
  "version": 1,
  "dependencies": {
    ".NETCoreApp,Version=v3.1": {
      "My.Package": {
        "type": "Direct",
        "requested": "[1.0.*-ci.*, )",
        "resolved": "1.0.0-ci.2",
        "contentHash": "4HQuN7LNoZT9Z+MOL/Yig79FehhXBZmi26j3VtWR9Cgz8k5irWspSQ8aasVbNkYp7AgA2XaDQdr/cnwJnPilpQ=="
      }
    }
  }
}

I then publish a new version of My.Package (1.0.1-ci.3) and run the command nuget restore -LockedMode, and the version resolved is still 1.0.1-ci.2, and if I then run nuget restore -ForceEvaluate it will resolve as expected to 1.0.1-ci.3, so far so good!
The issue arises when I add a class library to my solution which uses the same package reference, i.e. , when I run restore -UseLockFile -ForceEvaluate my packages.lock.json file is updated to include the project dependency:

{
  "version": 1,
  "dependencies": {
    ".NETCoreApp,Version=v3.1": {
      "My.Package": {
        "type": "Direct",
        "requested": "[1.0.*-ci.*, )",
        "resolved": "1.0.0-ci.3",
        "contentHash": "4HQuN7LNoZT9Z+MOL/Yig79FehhXBZmi26j3VtWR9Cgz8k5irWspSQ8aasVbNkYp7AgA2XaDQdr/cnwJnPilpQ=="
      },
      "classlibrary1": {
        "type": "Project",
        "dependencies": {
          "My.Package": "1.0.0-ci.0"
        }
      }
    }
  }
}

While the contents of the lock file of the Class Library project are:

{
  "version": 1,
  "dependencies": {
    ".NETCoreApp,Version=v3.1": {
      "My.Package": {
        "type": "Direct",
        "requested": "[1.0.*-ci.*, )",
        "resolved": "1.0.0-ci.3",
        "contentHash": "4HQuN7LNoZT9Z+MOL/Yig79FehhXBZmi26j3VtWR9Cgz8k5irWspSQ8aasVbNkYp7AgA2XaDQdr/cnwJnPilpQ=="
      }
    }
  }
}

After this when I try running restore -LockMode I get the NU1004 error mentioned earlier.

Doing what the error message suggests and use -ForceEvaluate would clearly break what I wanted to achieve, yet I can't imagine that this relatively simple scenario is not covered by NuGet, so I would guess I am doing something wrong, does anyone have any ideas of what I could try to make this work?

user_2066474 · Answer

It sounds like you're adding a new dependency then running nuget restore -LockedMode without first running nuget restore -ForceEvaluate.

It's not obvious what NuGet should do in that case - you're telling it you only want to use the dependencies in your lock file but you've also added new dependencies too.

It sounds like this would typically fail the restore:

If locked mode is set, restore will either get the exact packages as listed in the lock file or fail if it cannot. For example, if you updated the defined package dependencies for the project after lock file was created

https://devblogs.microsoft.com/nuget/enable-repeatable-package-restores-using-a-lock-file/#why-use-a-lock-file

You might have hit a corner case if the only transitive dependency of your new dependency is one that's already in the lock file but at a different version.

In general though, whenever you add new dependencies you're going to need to update your lock file, then after that you should be set to carry on running nuget restore -LockedMode.

Using NuGet restore with lock files gives "NU1004: The packages lock file is inconsistent with the project dependencies" error

1 Answers