dotnet add package silently fails if CPM enabled and implicit SDK references exist to package

[devlead]

NuGet Product Used

dotnet.exe

Product Version

9.0.100-rc.1.24452.12

Worked before?

No response

Impact

It's more difficult to complete my work

Repro Steps & Context

Repro

1. dotnet new globaljson --force --sdk-version 9.0 --roll-forward latestFeature
2. dotnet new mstest --framework net9.0
3. Add Directory.Packages.props with ManagePackageVersionsCentrally=true and CentralPackageTransitivePinningEnabled=true
4. dotnet add package Microsoft.NET.Test.Sdk --version 17.11.1

Interestingly an empty <ItemGroup /> is added to csproj, which is an indication it tries to do something but fails half-way.

If I manually add the package reference

<PackageReference Include="Microsoft.NET.Test.Sdk" />

I'll get a warning

 warning NU1504: Duplicate 'PackageReference' items found. Remove the duplicate items or use the Update functionality to ensure a consistent restore behavior. The duplicate 'PackageReference' items are: Microsoft.NET.Test.Sdk , Microsoft.NET.Test.Sdk 17.10.0.

which likely part of the root cause as Microsoft.NET.Test.Sdk 17.10.0. is part of the MSTest.Sdk and in .NET 9 SDK MSTest template CSPROJ there're not longer any package references

<Project Sdk="MSTest.Sdk/3.5.1">

  <PropertyGroup>
    <TargetFramework>net9.0</TargetFramework>
    <LangVersion>latest</LangVersion>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <!--
      Displays error on console in addition to the log file. Note that this feature comes with a performance impact.
      For more information, visit https://learn.microsoft.com/dotnet/core/testing/unit-testing-platform-integration-dotnet-test#show-failure-per-test
      -->
    <TestingPlatformShowTestsFailure>true</TestingPlatformShowTestsFailure>
  </PropertyGroup>

</Project>

but they're part of the SDK targets
https://github.com/microsoft/testfx/blob/db0db46bc8ef5f99af7048156b2685877da89c80/src/Package/MSTest.Sdk/Sdk/Runner/ClassicEngine.targets#L40-L41

    <PackageReference Include="Microsoft.NET.Test.Sdk" Sdk="MSTest"
                      Version="$(MicrosoftNETTestSdkVersion)" VersionOverride="$(MicrosoftNETTestSdkVersion)" />

Current workaround is to set MicrosoftNETTestSdkVersion manually to Directory.Packages.props so it looks something like this

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
    <MicrosoftNETTestSdkVersion>17.11.1</MicrosoftNETTestSdkVersion>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="8.0.1" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNETTestSdkVersion)" />
  </ItemGroup>
</Project>

and csproj

<Project Sdk="MSTest.Sdk/3.6.0">

  <PropertyGroup>
    <TargetFramework>net9.0</TargetFramework>
    <LangVersion>latest</LangVersion>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <!--
      Displays error on console in addition to the log file. Note that this feature comes with a performance impact.
      For more information, visit https://learn.microsoft.com/dotnet/core/testing/unit-testing-platform-integration-dotnet-test#show-failure-per-test
      -->
    <TestingPlatformShowTestsFailure>true</TestingPlatformShowTestsFailure>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.Extensions.DependencyModel" />
  </ItemGroup>

</Project>

While this kinda works, it's a bit of a hack and it breaks some CI and SBOM tools.

Verbose Logs

dotnet add package Microsoft.NET.Test.Sdk --version 17.11.1

Build succeeded in 0,7s
info : X.509 certificate chain validation will use the default trust store selected by .NET for code signing.
info : X.509 certificate chain validation will use the default trust store selected by .NET for timestamping.
info : Adding PackageReference for package 'Microsoft.NET.Test.Sdk' into project 'C:\temp\mstestnet9\mstestnet9.csproj'.
info : Restoring packages for C:\temp\mstestnet9\mstestnet9.csproj...
info :   CACHE https://api.nuget.org/v3/vulnerabilities/index.json
info :   CACHE https://api.nuget.org/v3-vulnerabilities/2024.09.24.23.37.09/vulnerability.base.json
info :   CACHE https://api.nuget.org/v3-vulnerabilities/2024.09.24.23.37.09/2024.09.25.23.37.11/vulnerability.update.json
info : Package 'Microsoft.NET.Test.Sdk' is compatible with all the specified frameworks in project 'C:\temp\mstestnet9\mstestnet9.csproj'.
info : Generating MSBuild file C:\temp\mstestnet9\obj\mstestnet9.csproj.nuget.g.props.
info : Generating MSBuild file C:\temp\mstestnet9\obj\mstestnet9.csproj.nuget.g.targets.
info : Writing assets file to disk. Path: C:\temp\mstestnet9\obj\project.assets.json
log  : Restored C:\temp\mstestnet9\mstestnet9.csproj (in 225 ms).

[devlead]

Interestingly it's the same issue in visual studio updates are identified

it's says successful, it even says no more packages to update

but if you go back in the dialog they're still there.

as the "proper" way is to update the SDK, but don't believe Visual Studio is able to update

- <Project Sdk="MSTest.Sdk/3.51">
+ <Project Sdk="MSTest.Sdk/3.6.0">

so unsure how this is supposed to work🤔