Package is resolved to different versions randomly on multiple paket update runs

Description

When I run paket update on this solution, it sometimes resolves the package NLog to version 4.4.6 instead of 4.4.12 for no apparent reason (no backtracking seems to occur, it’s the first version that appears in the console output). This seems to occur randomly, multiple runs of Paket flips between the two package versions. I’ve run it 10 times, and it picked the incorrect version 4 times, so it’s close to a 50-50 chance.

EDIT: This has nothing to do with the latest version, it happens with v5.124.1 too.

Repro steps

1. Run paket update on this solution a few times. This will produce the following two outputs randomly:

>paket update

Paket version 5.135.0
Resolving packages for group Main:
 - Microsoft.CodeAnalysis.CSharp is pinned to 1.3.2
 - Microsoft.CodeAnalysis.Common is pinned to 1.3.2
 - Microsoft.Orleans.Core is pinned to 1.3.1
 - Microsoft.Orleans.OrleansRuntime is pinned to 1.3.1
 - Microsoft.Orleans.OrleansProviders is pinned to 1.3.1
 - Microsoft.Orleans.OrleansSqlUtils is pinned to 1.3.1
 - Microsoft.Orleans.OrleansZooKeeperUtils is pinned to 1.3.1
 - Microsoft.Orleans.OrleansCodeGenerator is pinned to 1.3.1
 - Microsoft.Orleans.OrleansCodeGenerator.Build is pinned to 1.3.1
 - Microsoft.Orleans.TestingHost is pinned to 1.3.1
 - Microsoft.Extensions.DependencyInjection.Abstractions is pinned to 1.1.1
 - Microsoft.Extensions.DependencyInjection is pinned to 1.1.1
 - Newtonsoft.Json 9.0.1
 - Nito.AsyncEx 4.0.1
 - System.Threading.Tasks.Dataflow 4.8.0
 - System.ComponentModel.Annotations 4.4.1
 - Castle.Core 4.2.1
 - NLog 4.4.6
 - ZooKeeperNetEx 3.4.10.1
[...]

>paket update

Paket version 5.135.0
Resolving packages for group Main:
 - Microsoft.CodeAnalysis.CSharp is pinned to 1.3.2
 - Microsoft.CodeAnalysis.Common is pinned to 1.3.2
 - Microsoft.Orleans.Core is pinned to 1.3.1
 - Microsoft.Orleans.OrleansRuntime is pinned to 1.3.1
 - Microsoft.Orleans.OrleansProviders is pinned to 1.3.1
 - Microsoft.Orleans.OrleansSqlUtils is pinned to 1.3.1
 - Microsoft.Orleans.OrleansZooKeeperUtils is pinned to 1.3.1
 - Microsoft.Orleans.OrleansCodeGenerator is pinned to 1.3.1
 - Microsoft.Orleans.OrleansCodeGenerator.Build is pinned to 1.3.1
 - Microsoft.Orleans.TestingHost is pinned to 1.3.1
 - Microsoft.Extensions.DependencyInjection.Abstractions is pinned to 1.1.1
 - Microsoft.Extensions.DependencyInjection is pinned to 1.1.1
 - Newtonsoft.Json 9.0.1
 - Nito.AsyncEx 4.0.1
 - System.Threading.Tasks.Dataflow 4.8.0
 - System.ComponentModel.Annotations 4.4.1
 - Castle.Core 4.2.1
 - NLog 4.4.12
 - ZooKeeperNetEx 3.4.10.1
[...]

Expected behavior

NLog package should consistently be resolved to version 4.4.12.

Actual behavior

NLog package is sometimes downgraded to 4.4.6.

Known workarounds

Run paket update multiple times until the correct versions are resolved.

[matthid]

Reported this to NuGet directly: https://github.com/NuGet/NuGetGallery/issues/5431

[Allon-Guralnek]

Looks okay now, closing. Thanks everyone!