|
4 | 4 | <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally> |
5 | 5 | <OTelLatestStableVer>1.9.0</OTelLatestStableVer> |
6 | 6 |
|
| 7 | + <!-- |
| 8 | + This is typically the latest annual release of .NET. Use this wherever |
| 9 | + possible and only deviate (use a specific version) when a package has a |
| 10 | + more specific patch which must be reference directly. |
| 11 | + --> |
| 12 | + <LatestRuntimeOutOfBandVer>9.0.0-rc.1.24431.7</LatestRuntimeOutOfBandVer> |
| 13 | + |
7 | 14 | <!-- Mitigate https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485. --> |
8 | 15 | <SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer> |
9 | 16 | <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer> |
|
15 | 22 | vulnerability in the NuGet packages that are published from this repository. |
16 | 23 | --> |
17 | 24 | <ItemGroup> |
18 | | - <PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" /> |
19 | | - <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" /> |
20 | | - <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" /> |
21 | | - <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="[2.1.1,6.0)" /> |
22 | | - <PackageVersion Include="Microsoft.AspNetCore.Http.Features" Version="[2.1.1,6.0)" /> |
23 | | - |
24 | 25 | <!-- |
25 | 26 | Typically, for the Microsoft.Extensions.* packages relating to DI Abstractions, Hosting Abstractions, and Logging, |
26 | 27 | the latest stable version should be used because: |
|
30 | 31 | 3) Since version 3.1.0, the .NET runtime team is holding a high bar for backward compatibility on |
31 | 32 | these packages even during major version bumps, so compatibility is not a concern here. |
32 | 33 | --> |
| 34 | + <PackageVersion Include="Microsoft.Extensions.Configuration" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 35 | + <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 36 | + <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 37 | + <PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 38 | + <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 39 | + <PackageVersion Include="Microsoft.Extensions.Logging" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 40 | + <PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 41 | + <PackageVersion Include="Microsoft.Extensions.Options" Version="$(LatestRuntimeOutOfBandVer)" /> |
33 | 42 |
|
34 | | - <PackageVersion Include="Microsoft.Extensions.Configuration" Version="9.0.0-rc.1.24431.7" /> |
35 | | - <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="9.0.0-rc.1.24431.7" /> |
36 | | - <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0-rc.1.24431.7" /> |
37 | | - <PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="9.0.0-rc.1.24431.7" /> |
38 | | - <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.0-rc.1.24431.7" /> |
39 | | - <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.0-rc.1.24431.7" /> |
40 | | - <PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="9.0.0-rc.1.24431.7" /> |
41 | | - <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.0-rc.1.24431.7" /> |
42 | | - |
| 43 | + <!-- |
| 44 | + OTel packages always point to latest stable release. |
| 45 | + --> |
43 | 46 | <PackageVersion Include="OpenTelemetry" Version="[$(OTelLatestStableVer),2.0)" /> |
44 | 47 | <PackageVersion Include="OpenTelemetry.Api" Version="[$(OTelLatestStableVer),2.0)" /> |
45 | 48 | <PackageVersion Include="OpenTelemetry.Api.ProviderBuilderExtensions" Version="[$(OTelLatestStableVer),2.0)" /> |
|
50 | 53 |
|
51 | 54 | <!-- |
52 | 55 | Typically, the latest stable version of System.Diagnostics.DiagnosticSource should be used here because: |
53 | | - 1) Each major version bump will have some new OpenTelemetry API capabilities (e.g. .NET 6 introduced Meter |
54 | | - API, .NET 7 added UpDownCounter, .NET 8 is adding Meter/Instrument level attributes support, .NET 9 might |
55 | | - add Advice/Hint API) that the OpenTelemetry components rely on. |
| 56 | + 1) Each major version bump will likely have some new OpenTelemetry capabilities (e.g. .NET 6 introduced Meter |
| 57 | + API, .NET 7 added UpDownCounter, .NET 8 added Meter/Instrument level attributes support, .NET 9 added |
| 58 | + Advice/Hint API, etc.). |
56 | 59 | 2) Each minor version bump is normally security hotfixes or critical bug fixes. |
57 | 60 | 3) The .NET runtime team provides extra backward compatibility guarantee to System.Diagnostics.DiagnosticSource |
58 | 61 | even during major version bumps, so compatibility is not a concern here. |
59 | 62 | --> |
60 | | - <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.0-rc.1.24431.7" /> |
| 63 | + <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 64 | + |
| 65 | + <!-- |
| 66 | + We use conservative versions of these packages where an upgrade might |
| 67 | + introduce breaking changes. |
| 68 | + --> |
| 69 | + <PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" /> |
| 70 | + <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" /> |
| 71 | + <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" /> |
61 | 72 | </ItemGroup> |
62 | 73 |
|
63 | 74 | <ItemGroup> |
|
92 | 103 | <PackageVersion Include="Microsoft.CSharp" Version="[4.7.0]" /> |
93 | 104 | <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="[3.11.0-beta1.23525.2]" /> |
94 | 105 | <PackageVersion Include="Microsoft.Coyote" Version="1.7.11" /> |
95 | | - <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="[9.0.0-rc.1.24431.7,)" /> |
96 | | - <PackageVersion Include="Microsoft.Extensions.Hosting" Version="[9.0.0-rc.1.24431.7,)" /> |
97 | | - <PackageVersion Include="Microsoft.Extensions.Http" Version="[9.0.0-rc.1.24431.7,)" /> |
98 | | - <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="[9.0.0-rc.1.24431.7,)" /> |
| 106 | + <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 107 | + <PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 108 | + <PackageVersion Include="Microsoft.Extensions.Http" Version="$(LatestRuntimeOutOfBandVer)" /> |
| 109 | + <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" /> |
99 | 110 | <PackageVersion Include="Microsoft.Extensions.Telemetry.Abstractions" Version="[9.0.0-preview.8.24460.1,)" /> |
100 | 111 | <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="[1.0.3,2.0)" /> |
101 | 112 | <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.11.0,18.0.0)" /> |
|
0 commit comments