Directory.Packages.props

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <!-- false is already the default but we are explicit about it. -->
    <!-- Pinning versions of transitive deps is not a good idea for us -->
    <!-- This option promotes a transitive dependency to a top-level dependency implicitly whenever a PackageVersion is present. -->
    <!-- In turn, that means we could end up building against a newer dependency version, but not specifying it in nuspec -->
    <!-- Even when using MSBuild packaging rather than nuspec packaging, we will have many extra dependencies, potentially unnecessarily. -->
    <!-- It's also hard to control where it's intentional or not when using MSBuild packaging. -->
    <!-- Whenever we want to use a newer version of a transitive dependency, it has to be explicit -->
    <!-- It also needs to be added to nuspec manually (for projects that use nuspec) so that the new version flows to consumers -->
    <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <PropertyGroup Label="Product dependencies">
    <!-- AspireHostingTestingVersion is consumed by the build and baked into the shipped MSTest.Sdk
         template. It MUST be kept in sync with the literal Aspire.Hosting.Testing PackageVersion
         declared near the bottom of this file (the one Dependabot updates). The
         _ValidateBundledSdkFeatureVersions target (in Directory.Build.targets) fails the build if
         the two drift apart. -->
    <AspireHostingTestingVersion>13.4.6</AspireHostingTestingVersion>
    <MicrosoftBuildVersion>17.11.48</MicrosoftBuildVersion>
    <MicrosoftCodeAnalysisVersion>3.11.0</MicrosoftCodeAnalysisVersion>
    <MicrosoftCodeAnalysisVersionForTests>4.10.0</MicrosoftCodeAnalysisVersionForTests>
    <MicrosoftCodeAnalysisVersionForSourceGen>4.8.0</MicrosoftCodeAnalysisVersionForSourceGen>
    <!-- Microsoft.CodeAnalysis.PublicApiAnalyzers / .BannedApiAnalyzers.
         Kept on a 5.x release for the RS0017/RS0026/RS0036 fixes that testfx's public-API
         surface tracking depends on (the old 3.3.4 stable from 2022 lacks them).
         Tracking context: https://github.com/microsoft/testfx/issues/9091 (Task 5). -->
    <MicrosoftCodeAnalysisPublicApiAnalyzersVersion>5.6.0</MicrosoftCodeAnalysisPublicApiAnalyzersVersion>
    <MicrosoftCodeAnalysisBannedApiAnalyzersVersion>$(MicrosoftCodeAnalysisPublicApiAnalyzersVersion)</MicrosoftCodeAnalysisBannedApiAnalyzersVersion>
    <!-- UWP and WinUI dependencies -->
    <MicrosoftNETCoreUniversalWindowsPlatformVersion>6.2.14</MicrosoftNETCoreUniversalWindowsPlatformVersion>
    <!-- Test Platform, .NET Test SDK and Object Model  -->
    <MicrosoftNETTestSdkVersion>18.4.0</MicrosoftNETTestSdkVersion>
    <!-- MicrosoftPlaywrightVersion is consumed by the build and baked into the shipped MSTest.Sdk
         template. It MUST be kept in sync with the literal Microsoft.Playwright.MSTest.v4
         PackageVersion declared near the bottom of this file (the one Dependabot updates). The
         _ValidateBundledSdkFeatureVersions target (in Directory.Build.targets) fails the build if
         the two drift apart. -->
    <MicrosoftPlaywrightVersion>1.60.0</MicrosoftPlaywrightVersion>
    <MicrosoftTestingExtensionsFakesVersion>18.1.1</MicrosoftTestingExtensionsFakesVersion>
    <!-- Microsoft.Testing.Internal.Framework is an internal-only NuGet (consumed by tests that
         opt into UseInternalTestFramework via TestFramework.ForTestingMSTest); there is no public
         stable release on nuget.org. Promote when the internal feed ships a non-preview version.
         Tracking context: https://github.com/microsoft/testfx/issues/9091 (Task 5). -->
    <MicrosoftTestingInternalFrameworkVersion>1.5.0-preview.24577.4</MicrosoftTestingInternalFrameworkVersion>
    <SystemThreadingTasksExtensionsVersion>4.5.4</SystemThreadingTasksExtensionsVersion>
    <!-- System.Memory flows in transitively (via System.Reflection.Metadata / System.Collections.Immutable)
         at 4.5.5, whose .NETFramework assembly version is 4.0.1.2. We pin it explicitly to 4.6.3
         (assembly 4.0.5.0) so the .NETFramework adapter assemblies reference 4.0.5.0. Hosts that unify
         System.Memory to 4.0.5.0 (e.g. Visual Studio) and run the adapter without applying a binding
         redirect (the VSTest test host uses its own config) cannot otherwise load the 4.0.1.2 reference. -->
    <SystemMemoryVersion>4.6.3</SystemMemoryVersion>
  </PropertyGroup>
  <PropertyGroup Label="Test dependencies">
    <MicrosoftCodeAnalysisAnalyzerTestingVersion>1.1.3-beta1.24423.1</MicrosoftCodeAnalysisAnalyzerTestingVersion>
  </PropertyGroup>
  <ItemGroup Label="Analyzers">
    <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="$(MicrosoftCodeAnalysisBannedApiAnalyzersVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="$(MicrosoftCodeAnalysisPublicApiAnalyzersVersion)" />
    <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.14.15" />
    <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
  </ItemGroup>
  <ItemGroup Label="Product dependencies">
    <!-- If this gets updated, please revise if the explicit dependency on System.Diagnostics.DiagnosticSource is still needed -->
    <PackageVersion Include="Microsoft.ApplicationInsights" Version="2.23.0" />
    <!-- This comes transitvely via Microsoft.ApplicationInsights, but we want to upgrade it because 5.0.0 is not maintained -->
    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="6.0.0" />
    <PackageVersion Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis" Version="$(MicrosoftCodeAnalysisVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.6.0" />
    <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="$(MicrosoftCodeAnalysisVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="$(MicrosoftCodeAnalysisVersion)" />
    <PackageVersion Include="Microsoft.Diagnostics.NETCore.Client" Version="0.2.607501" />
    <PackageVersion Include="Microsoft.Extensions.AI" Version="9.10.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="9.10.0-preview.1.25513.3" />
    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.4" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="9.0.4" />
    <PackageVersion Include="Azure.AI.OpenAI" Version="2.1.0" />
    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="$(MicrosoftTestingExtensionsCodeCoverageVersion)" />
    <PackageVersion Include="Microsoft.TestPlatform.ObjectModel" Version="$(MicrosoftNETTestSdkVersion)" />
    <PackageVersion Include="Microsoft.TestPlatform.TranslationLayer" Version="$(MicrosoftNETTestSdkVersion)" />
    <PackageVersion Include="Microsoft.TestPlatform.Filter.Source" Version="18.8.0-preview-26276-01" />
    <PackageVersion Include="Microsoft.Win32.Registry" Version="5.0.0" />
    <PackageVersion Include="Microsoft.WindowsAppSDK" Version="1.8.251003001" />
    <PackageVersion Include="OpenTelemetry" Version="1.15.3" />
    <PackageVersion Include="System.Memory" Version="$(SystemMemoryVersion)" />
    <PackageVersion Include="System.Text.Json" Version="10.0.8" />
    <PackageVersion Include="System.Threading.Tasks.Extensions" Version="$(SystemThreadingTasksExtensionsVersion)" />
  </ItemGroup>
  <ItemGroup Label="Test dependencies">
    <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
    <PackageVersion Include="FSharp.Core" Version="11.0.100" />
    <PackageVersion Include="NUnit" Version="4.6.0" />
    <PackageVersion Include="NUnit3TestAdapter" Version="6.2.0" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeFix.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeRefactoring.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic.Analyzer.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic.CodeFix.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic.CodeRefactoring.Testing" Version="$(MicrosoftCodeAnalysisAnalyzerTestingVersion)" />
    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.4" />
    <!-- Third-party (community) package that brings xUnit.Combinatorial-style [CombinatorialData] support to
         MSTest. Used by the acceptance tests to replace bespoke build-matrix DynamicData helpers. -->
    <PackageVersion Include="Combinatorial.MSTest" Version="2.0.0" />
    <PackageVersion Include="Microsoft.TestPlatform" Version="$(MicrosoftNETTestSdkVersion)" />
    <!-- Previously pinned to 4.18.4 to avoid SponsorLink (4.20.0–4.20.x); resolved in 4.20.72 -->
    <PackageVersion Include="Moq" Version="4.20.72" />
    <PackageVersion Include="MSBuild.StructuredLogger" Version="2.3.178" />
    <PackageVersion Include="MSTest.Analyzers" Version="$(MSTestVersion)" />
    <PackageVersion Include="MSTest.TestAdapter" Version="$(MSTestVersion)" />
    <PackageVersion Include="MSTest.TestFramework" Version="$(MSTestVersion)" />
    <PackageVersion Include="Microsoft.Testing.Platform.MSBuild" Version="$(MicrosoftTestingPlatformVersion)" />
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
    <PackageVersion Include="Polly" Version="8.6.6" />
    <PackageVersion Include="Polly.Contrib.WaitAndRetry" Version="1.1.1" />
    <PackageVersion Include="StreamJsonRpc" Version="2.25.29" />
    <!--
      Nerdbank.MessagePack and MessagePack both come transitively via StreamJsonRpc, but we pin them
      here to pick up versions that fix security vulnerabilities in the transitive versions shipped
      by StreamJsonRpc.

      IMPORTANT: Central Package Management only pins the version when a project actually declares a
      <PackageReference> for the package. Any project that references StreamJsonRpc (directly or via
      a ProjectReference chain) must ALSO add explicit <PackageReference Include="Nerdbank.MessagePack" />
      AND <PackageReference Include="MessagePack" /> entries, otherwise the transitive (vulnerable)
      versions get restored. See PR #9120 / #9124 for context.
    -->
    <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.4" />
    <PackageVersion Include="MessagePack" Version="3.1.7" />
    <PackageVersion Include="StrongNamer" Version="0.2.5" />
    <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
    <PackageVersion Include="System.Management" Version="9.0.4" />
    <PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
  </ItemGroup>
  <!--
    Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
    templates) and are not otherwise consumed by a restored project, so that Dependabot can
    discover and update them. They are referenced only inside the SDK feature targets
    (Sdk/Features/*.targets, which Dependabot doesn't restore); their only Dependabot-visible
    reference from a repo project is the inert anchor described in condition 2 below.

    Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
    silently stops the updates:

      1. The version MUST be a literal here (not an MSBuild property such as
         $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
         PackageVersion whose Version is an MSBuild property interpolation.
         See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.

      2. The package MUST be referenced by a project via a PackageReference that Dependabot reads:
         Dependabot only updates a CPM PackageVersion that is actually referenced by a project;
         an "orphan" PackageVersion (declared here but referenced nowhere) is ignored. Because
         these packages are only baked into the shipped SDK templates (Sdk/Features/*.targets)
         and never referenced by a built project, we add inert anchor references in
         test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj.
         The anchor MUST be a PackageReference (ExcludeAssets="all" is fine - it only stops the
         package's assets from flowing into the project; it does NOT hide the reference from
         Dependabot, which reads the PackageReference XML node, not the asset-flow rules). It must
         NOT be a PackageDownload: Dependabot does not read PackageDownload items at all
         (dependabot/dependabot-core#2502), so a PackageDownload anchor is invisible to it. Using a
         PackageDownload as the anchor is exactly why Playwright silently stopped updating (see
         #9362 / #9452); the PackageReference anchor is what makes the bumps flow.

    Each literal version is duplicated as the matching *Version property (defined near the top of
    this file) which is the value actually consumed by the build and baked into the MSTest.Sdk
    template (see MSTest.Sdk.csproj). The two cannot be unified because the consuming property must
    be a plain scalar (an item transform such as @(PackageVersion->...) stored in a property is not
    expanded and breaks string concatenation, e.g. MSB4012), while Dependabot needs the literal on
    the PackageVersion. The _ValidateBundledSdkFeatureVersions target (in Directory.Build.targets)
    fails the build if the property and the PackageVersion ever drift apart (e.g. after Dependabot
    bumps only the PackageVersion), so the duplication can never ship out of sync.
    -->
  <ItemGroup Label="Declared by MSTest.Sdk but not used directly">
    <PackageVersion Include="Aspire.Hosting.Testing" Version="13.4.6" />
    <PackageVersion Include="Microsoft.Playwright.MSTest.v4" Version="1.60.0" />
  </ItemGroup>
</Project>