Thanks all for contributing to my understanding the rules of how dotnet restore works

I found out that I could find the dependencies to specific versions of packages by examining the Project.assets.json file and doing so in a json editor it became clear what was causing the issue.

• Microsoft.EntityFrameworkCore.Design - Version="9.0.3"
  has a dependency to

  • Microsoft.CodeAnalysis.Workspaces.MSBuild - Version="4.8.0"
    that has a dependency to

    • System.text.json  - Version="7.0.3"
      that has a vulnerability