讨论： Pinning NuGet dependencies: PackageReference, central package management and packages.lock.json

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-16

暂无译文，显示原文。 原文

Step 7's `rollForward: disable` fixes one drift by creating another. With `disable`, any machine or CI image whose installed SDK patch differs from the pinned one refuses to build at all, so every SDK patch release, including the ones that carry security fixes to the SDK and the runtime it bundles, becomes a coordinated `global.json` change across every repository, and a developer whose laptop auto-updated is blocked until it lands. The default when a version is given is `latestPatch`, which accepts newer patches within the same feature band. The pin with `disable` is right only when SDK installation is itself driven from `global.json` (for example `actions/setup-dotnet` with `global-json-file`, or a container image built per repository); otherwise `latestPatch` plus the locked-mode restore is the workable compromise, and a locked-mode failure after an SDK patch is the signal to review the implicit references rather than a reason to freeze the SDK.