128 lines
7.9 KiB
XML
128 lines
7.9 KiB
XML
<Project>
|
|
|
|
<PropertyGroup>
|
|
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
|
|
<OTelLatestStableVer>1.12.0</OTelLatestStableVer>
|
|
|
|
<!--
|
|
This is typically the latest annual release of .NET. Use this wherever
|
|
possible and only deviate (use a specific version) when a package has a
|
|
more specific patch which must be reference directly.
|
|
-->
|
|
<LatestRuntimeOutOfBandVer>9.0.0</LatestRuntimeOutOfBandVer>
|
|
|
|
<!-- Mitigate https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485. -->
|
|
<SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
|
|
<SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer>
|
|
</PropertyGroup>
|
|
|
|
<!--
|
|
This section covers packages that are directly referenced by the NuGet packages published from this repository.
|
|
Any security vulnerability in these packages or their downstream dependencies will be considered as a security
|
|
vulnerability in the NuGet packages that are published from this repository.
|
|
-->
|
|
<ItemGroup>
|
|
<!--
|
|
Typically, for the Microsoft.Extensions.* packages relating to DI Abstractions, Hosting Abstractions, and Logging,
|
|
the latest stable version should be used because:
|
|
1) Each major version bump will have some new API capabilities (e.g.For Logging, .NET 6 introduced compile-time logging
|
|
source generation, .NET 8 introduced automatic event id generation).
|
|
2) Each minor version bump is normally security hotfixes or critical bug fixes.
|
|
3) Since version 3.1.0, the .NET runtime team is holding a high bar for backward compatibility on
|
|
these packages even during major version bumps, so compatibility is not a concern here.
|
|
-->
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
|
|
<!--
|
|
OTel packages always point to latest stable release.
|
|
-->
|
|
<PackageVersion Include="OpenTelemetry" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Api" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Api.ProviderBuilderExtensions" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Extensions.Propagators" Version="[$(OTelLatestStableVer),2.0)" />
|
|
<PackageVersion Include="OpenTracing" Version="[0.12.1,0.13)" />
|
|
|
|
<!--
|
|
Typically, the latest stable version of System.Diagnostics.DiagnosticSource should be used here because:
|
|
1) Each major version bump will likely have some new OpenTelemetry capabilities (e.g. .NET 6 introduced Meter
|
|
API, .NET 7 added UpDownCounter, .NET 8 added Meter/Instrument level attributes support, .NET 9 added
|
|
Advice/Hint API, etc.).
|
|
2) Each minor version bump is normally security hotfixes or critical bug fixes.
|
|
3) The .NET runtime team provides extra backward compatibility guarantee to System.Diagnostics.DiagnosticSource
|
|
even during major version bumps, so compatibility is not a concern here.
|
|
-->
|
|
<PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!--
|
|
Note: See TargetFrameworksRequiringSystemTextJsonDirectReference for the
|
|
list of targets where System.Text.Json direct reference is applied.
|
|
-->
|
|
|
|
<!--
|
|
We use conservative versions of these packages for older runtimes where
|
|
an upgrade might introduce breaking changes. For example see:
|
|
https://devblogs.microsoft.com/dotnet/system-text-json-in-dotnet-7/#breaking-changes.
|
|
-->
|
|
<PackageVersion Include="System.Text.Encodings.Web" Version="4.7.2" />
|
|
<PackageVersion Include="System.Text.Json" Version="4.7.2" />
|
|
|
|
<!-- Newer NETCoreApp runtimes need to be redirected to safe versions. -->
|
|
<PackageVersion Update="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
|
|
<PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
|
|
</ItemGroup>
|
|
|
|
<!--
|
|
This section covers packages that are **not** directly referenced by the NuGet packages published from this repository.
|
|
These packages are referenced as "PrivateAssets" or used in tests/examples.
|
|
-->
|
|
<ItemGroup>
|
|
<PackageVersion Include="BenchmarkDotNet" Version="[0.13.12,0.14)" />
|
|
<PackageVersion Include="CommandLineParser" Version="[2.9.1,3.0)" />
|
|
<PackageVersion Include="Grpc.AspNetCore" Version="[2.59.0,3.0)" />
|
|
<PackageVersion Include="Grpc.AspNetCore.Server" Version="[2.59.0, 3.0)" />
|
|
<PackageVersion Include="Grpc.Tools" Version="[2.59.0,3.0)" />
|
|
<PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" />
|
|
<PackageVersion Include="Grpc" Version="[2.44.0,3.0)" />
|
|
<PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" />
|
|
<PackageVersion Include="Microsoft.CSharp" Version="[4.7.0]" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="[3.11.0-beta1.23525.2]" />
|
|
<PackageVersion Include="Microsoft.Coyote" Version="1.7.11" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Http" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Telemetry.Abstractions" Version="[9.0.0,)" />
|
|
<PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="[1.0.3,2.0)" />
|
|
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.13.0,18.0.0)" />
|
|
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="[8.0.0,9.0)" />
|
|
<PackageVersion Include="MinVer" Version="[5.0.0,6.0)" />
|
|
<PackageVersion Include="NuGet.Versioning" Version="6.11.0" />
|
|
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="[1.9.0,2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Instrumentation.GrpcNetClient" Version="[1.9.0-beta.1,2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="[1.9.0,2.0)" />
|
|
<PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="[1.9.0,2.0)" />
|
|
<PackageVersion Include="RabbitMQ.Client" Version="[6.8.1,7.0)" />
|
|
<PackageVersion Include="StyleCop.Analyzers" Version="[1.2.0-beta.556,2.0)" />
|
|
<PackageVersion Include="Swashbuckle.AspNetCore" Version="[6.7.3,)" />
|
|
<PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
|
|
<PackageVersion Include="xunit" Version="[2.9.3,3.0)" />
|
|
<PackageVersion Include="xunit.runner.visualstudio" Version="[2.8.2,3.0)" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.8" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.0" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|