Using PackageReference in classic CSPROJ project files (.NET Framework 4.8).

Given the following dependency structure:

Solution (.sln)

    Project A (.csproj)

        Microsoft.Identity.Client 4.61.3 (Top-Level NUGET Reference)
            Microsoft.IdentityModel.Abstractions (>= 6.35.0) <===

    Project B (.csproj)

        Microsoft.IdentityModel.JsonWebTokens 7.6.1 (Top-Level NUGET Reference)
            Microsoft.IdentityModel.Tokens (>= 7.6.1)
                Microsoft.IdentityModel.Logging (>= 7.6.1)
                    Microsoft.IdentityModel.Abstractions (>= 7.6.1) <===
                
        Microsoft.Identity.Client 4.61.3 (Top-Level NUGET Reference)
            Microsoft.IdentityModel.Abstractions (>= 6.35.0) <===

The version of Microsoft.IdentityModel.Abstractions which is present in the output directory after building, seems to differ depending on the build order:

• If Project B is compiled last, it is version 7.6.1. At runtime, no error occurs, and the version numbers of all Microsoft.IdentityModel.*-Assemblys in the output directory match (7.6.1.50617).
• If Project A is compiled last, it is version 6.35.0.
  In this case, at runtime an error occurs, because version 6.35.0 does not satisfy the requirements of Microsoft.IdentityModel.JsonWebTokens 7.6.1:
  “Could not load file or assembly ‘Microsoft.IdentityModel.Abstractions, Version 7.6.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35’ or one of it’s dependencies. The loaded assembly’s manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)

Is this to be expected?

What would be the best way to resolve this?

1. Downgrade reference to Microsoft.IdentityModel.JsonWebTokens in Project B to 6.35.0
2. Add a top-level reference to Microsoft.IdentityModel.JsonWebTokens 7.6.1 to Project A even though Project A does not make any usage of it?
3. Adding a BindingRedirect to App.config?
4. Better options?