Description

I noticed the following issue. I have a complete empty folder with paket.exe and paket.dependencies.

The paket.dependencies file has the following content:

source https://nuget.org/api/v2

nuget FSharp.Core ~> 2.0

Now when I run paket install it will successfully pull the package and create a paket.lock file.

After this I run paket update nuget FSharp.Core version 4.0.0 and Paket pulls the v4 package of FSharp.Core and updates the paket.lock file despite the explicit rule ~> 2.0 in my paket.dependencies file.

Repro steps

See above.

Expected behavior

I see two possible behaviors which I would consider correct:

1. Paket doesn't allow me to update to a version which is not allowed by the paket.dependencies rules and throw an error or warning message.
2. Or Paket will update to the specified version, but also update the paket.dependencies file to match the new version.

Actual behavior

Mismatch between paket.dependencies and the actual pulled package.

Known workarounds

Manual fixing in files.

Related information

None