This is wrong. DotNet uses packages.lock.json explicitly to support the case where you want to be able to lock transitive dependencies that are specified with

This is wrong. DotNet uses packages.lock.json explicitly to support the case where you want to be able to lock transitive dependencies that are specified with a range value, or several other edge cases that might warrant explicitly declaring versions that are absent from csproj or sln files. https://devblogs.microsoft.com/dotnet/enable-repeatable-package-restores-using-a-lock-file/ https://devblogs.microsoft.com/dotnet/enable-repeatable-pack... https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#enabling-the-lock-file https://learn.microsoft.com/en-us/nuget/consume-packages/pac... Again - there's no free lunch here.