Hosted NuGet rewrites and restores packages.lock.json with LF and no BOM, so a CRLF lock is rewritten whole #1068

[agent] Filed by the October 7 architecture audit campaign (ecosystems). Register: arch-audit register.

Kind: bug. Source: audit B59 (new finding), register E85.

Problem: hosted rewrite_nuget (redirect/mod.rs#L5676) and the upstream NuGet restore (upstream/nuget.rs#L338) write packages.lock.json with serialize_json (#L435): to_string_pretty plus LF, no BOM, indent or EOL preservation. Every other hosted JSON writer uses serialize_json_like/JsonLayout, and vendored NuGet splices bytes so revert is byte-exact.

Symptoms: #623 (BOM lock refused). Impact: on Windows, where dotnet writes CRLF locks, a hosted scan and its rollback rewrite every line, so diffs are whole-file and rollback is not byte-exact. Low priority per the maintainer's ecosystem triage.

Proposed change: route both NuGet writers through serialize_json_like with a BOM-tolerant parse; delete the hosted serialize_json.

Size and scope: redirect/mod.rs, upstream/nuget.rs; under 50 lines.

Acceptance criteria:

• A CRLF (and a BOM) packages.lock.json round-trips scan → rollback byte-exact.
• Hosted NuGet goldens unchanged for LF input.

Dependencies: none. Fixes the writer half of #623.

Generated by Claude Code

Backlog review — 2026-10-08

Closed as not planned following backlog review.

This is the NuGet writer formatting/BOM-preservation half. Keep #623 for the separate BOM reader refusal; do not conflate the cosmetic writer issue with that real functional bug.