`Microsoft.EntityFrameworkCore.Design` breaks builds due to dependency on 'NuGet.Packaging' & 'NuGet.Protocol'

[KUTlime]

File a bug

The NuGet packages 'NuGet.Packaging' & 'NuGet.Protocol' break builds when the NuGet package "Microsoft.EntityFrameworkCore.Design" is linked to any project that treats warnings as errors.

These NuGet packages have reported security vulnerabilities, see https://www.nuget.org/packages/NuGet.Packaging/6.12.1
and this project dependencies in Version.

<NuGetProjectModelVersion>6.12.1</NuGetProjectModelVersion>

  Web.csproj: [NU1901] Warning As Error: Package 'NuGet.Packaging' 6.12.1 has a known low severity vulnerability, https://github.com/advisories/GHSA-g4vj-cjjj-v7hg
  Web.csproj: [NU1901] Warning As Error: Package 'NuGet.Protocol' 6.12.1 has a known low severity vulnerability, https://github.com/advisories/GHSA-g4vj-cjjj-v7hg

Include your code

<Project Sdk="Microsoft.NET.Sdk.Web">
  <ItemGroup>
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.*">
  </ItemGroup>

  <PropertyGroup>
    <TreatWarningsAsErrors>True</TreatWarningsAsErrors>
  </PropertyGroup>

</Project>

Or whatever settings are needed to switch warnings as errors.

Program.cs

Console.WriteLine("Hello, World!");

Include stack traces

dotnet nuget why ./LWDD.slnx 'NuGet.Packaging'

Projekt LWDD.Web has the following dependency graph for NuGet.Packaging:

  [net10.0]                                                                                                                                                                                                                                                                                                                                                                              
  └── Microsoft.VisualStudio.Web.CodeGeneration.Design (v10.0.2)                                                                                                                                                                                                                                                                                                                         
      ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)                                                                                                                                                                                                                                                                                                                                  
      │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                                  
      │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                               
      │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                                
      │           └── **NuGet.Protocol (v6.12.1) ** // <-- THIS IS THE PROBLEM                                                                                                                                                                                                                                                                                                                                          
      │               └── NuGet.Packaging (v6.12.1)  // <-- THIS IS THE PROBLEM                                                                                                                                                                                                                                                                                                                                    
      ├── Microsoft.VisualStudio.Web.CodeGenerators.Mvc (v10.0.2)                                                                                                                                                                                                                                                                                                                        
      │   ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)                                                                                                                                                                                                                                                                                                                              
      │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                              
      │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                           
      │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                            
      │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                                       
      │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                  
      │   ├── Microsoft.VisualStudio.Web.CodeGeneration (v10.0.2)                                                                                                                                                                                                                                                                                                                        
      │   │   ├── Microsoft.VisualStudio.Web.CodeGeneration.EntityFrameworkCore (v10.0.2)                                                                                                                                                                                                                                                                                                
      │   │   │   ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)                                                                                                                                                                                                                                                                                                                      
      │   │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                      
      │   │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                   
      │   │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                    
      │   │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                               
      │   │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                          
      │   │   │   ├── Microsoft.VisualStudio.Web.CodeGeneration.Core (v10.0.2)                                                                                                                                                                                                                                                                                                           
      │   │   │   │   ├── Microsoft.VisualStudio.Web.CodeGeneration.Templating (v10.0.2)                                                                                                                                                                                                                                                                                                 
      │   │   │   │   │   ├── Microsoft.VisualStudio.Web.CodeGeneration.Utils (v10.0.2)                                                                                                                                                                                                                                                                                                  
      │   │   │   │   │   │   ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)                                                                                                                                                                                                                                                                                                          
      │   │   │   │   │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                          
      │   │   │   │   │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                       
      │   │   │   │   │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                        
      │   │   │   │   │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                   
      │   │   │   │   │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                              
      │   │   │   │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                              
      │   │   │   │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                           
      │   │   │   │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                            
      │   │   │   │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                       
      │   │   │   │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                  
      │   │   │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                  
      │   │   │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                               
      │   │   │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                
      │   │   │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                           
      │   │   │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                      
      │   │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                      
      │   │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                   
      │   │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                    
      │   │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                               
      │   │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                          
      │   │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                          
      │   │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                       
      │   │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                        
      │   │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                                   
      │   │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                              
      │   │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                              
      │   │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                           
      │   │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                            
      │   │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                                       
      │   │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                  
      │   ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                                  
      │   └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                               
      │       └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                                
      │           └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                                           
      │               └── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                      
      ├── NuGet.Packaging (v6.12.1)                                                                                                                                                                                                                                                                                                                                                      
      └── NuGet.ProjectModel (v6.12.1)                                                                                                                                                                                                                                                                                                                                                   
          └── NuGet.DependencyResolver.Core (v6.12.1)                                                                                                                                                                                                                                                                                                                                    
              └── NuGet.Protocol (v6.12.1)                                                                                                                                                                                                                                                                                                                                               
                  └── NuGet.Packaging (v6.12.1) 

Include provider and version information

Microsoft.VisualStudio.Web.CodeGeneration.Design/Microsoft.DotNet.MSIdentity version: v10.0.2
Target framework: .NET 10
Operating system: Arch Linux + Windows 11
IDE: Visual Studio 2026, Rider 2026.1, dotnet CLI

Related issues

#2044

[Thieum]

#3720 would fix this