From 5383b3f77d3181ca06b1af7f3b60dff089ec2880 Mon Sep 17 00:00:00 2001
From: Sascha Kiefer <esskar@gmail.com>
Date: Tue, 16 Jun 2026 22:44:27 +0200
Subject: [PATCH] fix: pin .NET Framework reference assemblies for consistent
 lock file

The net48/net481 reference assemblies package is pulled in implicitly on
non-Windows hosts but comes from the OS on Windows, so a lock file generated
on macOS/Linux failed locked-mode restore on the Windows CI runner (NU1004).
Declare Microsoft.NETFramework.ReferenceAssemblies explicitly (PrivateAssets=all,
build-only) so packages.lock.json is identical regardless of build OS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/Serialize.Linq/Serialize.Linq.csproj | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/Serialize.Linq/Serialize.Linq.csproj b/src/Serialize.Linq/Serialize.Linq.csproj
index dee6844..b2fdbd8 100644
--- a/src/Serialize.Linq/Serialize.Linq.csproj
+++ b/src/Serialize.Linq/Serialize.Linq.csproj
@@ -168,6 +168,19 @@
 	<WarningLevel>7</WarningLevel>
   </PropertyGroup>
 
+  <!--
+    Reference the .NET Framework reference assemblies explicitly for the
+    net48/net481 targets. On non-Windows build hosts the SDK pulls this package
+    in implicitly (the reference assemblies aren't installed), but on Windows
+    they come from the OS and no package is added. Declaring it explicitly keeps
+    packages.lock.json identical across build operating systems so locked-mode
+    restores don't fail in CI. PrivateAssets="all" keeps it build-only and out
+    of the published package's dependencies.
+  -->
+  <ItemGroup Condition=" '$(TargetFramework)' == 'net48' or '$(TargetFramework)' == 'net481' ">
+    <PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" PrivateAssets="all" />
+  </ItemGroup>
+
   <ItemGroup Condition=" '$(TargetFramework)' == 'net6.0' ">
   </ItemGroup>