Churn in lock file syntax

[DalekBaldwin]

Our team sees constant churn in our lock files in source control between specifying version numbers like "1.2.3" versus "[1.2.3, )", without any changes to how we are actually specifying them in our projects.

Particularly, for a dependency of "type": "Project", the transitive dependencies:

{
  "dependencies": {
    "net6.0": {
      "some.project": {
        "type": "Project",
        "dependencies": {
          "MessagePack": "[2.5.108, )"
        }
      }
    }
  }
}

versus:

{
  "dependencies": {
    "net6.0": {
      "some.project": {
        "type": "Project",
        "dependencies": {
          "MessagePack": "2.5.108"
        }
      }
    }
  }
}

I believe this is related to changes in Nuget itself, but we have no mechanism to enforce pinning the version of Nuget itself in our repos the same way we can with global.json or .config/dotnet-tools.json.

Is there a brief description of what versions of Nuget itself correspond with changes in the packages.lock.json format?

I notice that:

• Nuget 6.3.3.3 (chosen by dotnet SDK 6.0.412) prefers "[1.2.3,)"
• Nuget 6.2.4.1 (chosen by dotnet SDK 6.0.315) prefers "1.2.3"
• These are both the "latest" SDK for net6.0 according to https://dotnet.microsoft.com/en-us/download/dotnet/6.0 !

Is one of these formats going to be preferred going forward? Will this be stabilized between different downloads of the same SDK release?

[DalekBaldwin]

Update: It appears that the versions of Nuget chosen by both extant release streams of the dotnet 7 SDK (7.0.307 and 7.0.400) prefer the more verbose syntax ("[1.2.3, )"), so I'm going to assume that's the preferred format going forward.

[nkolev92]

The new version is the correct one.

I think it's likely #11870 and NuGet/NuGet.Client#4683 that led to an unintentional change.

That being said, this is a good change, and we haven't really gotten feedback beyond this, so I'll close this disc.