Skip to content

Update dependency versions #84952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
333fred merged 7 commits into from
Aug 26, 2026
+11 −8
Merged

Update dependency versions #84952

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
274fd29
Update vulnerable NuGet and MessagePack dependencies
333fred Aug 18, 2026
578c5d4
Update ASP.NET Core test runtime packages
333fred Aug 18, 2026
7c31ea1
Update Visual Studio app-local runtime packages
333fred Aug 18, 2026
dde0ee0
Pin Nerdbank.MessagePack to patched version
333fred Aug 18, 2026
612ea36
Merge branch 'main' into update-deps
333fred Aug 19, 2026
ec0d676
Merge branch 'main' into update-deps
333fred Aug 21, 2026
525b805
Pin crossgen to 10.0.1
333fred Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions eng/Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@

We should try to keep this version in sync with the version of app-local runtime in VS.
-->
<MicrosoftNetCoreAppRuntimePackagesVersion>10.0.1</MicrosoftNetCoreAppRuntimePackagesVersion>
<MicrosoftWindowsDesktopAppRuntimePackagesVersion>10.0.1</MicrosoftWindowsDesktopAppRuntimePackagesVersion>
<MicrosoftNetCoreAppRuntimePackagesVersion>10.0.11</MicrosoftNetCoreAppRuntimePackagesVersion>
<MicrosoftWindowsDesktopAppRuntimePackagesVersion>10.0.11</MicrosoftWindowsDesktopAppRuntimePackagesVersion>
<_xunitVersion>2.9.2</_xunitVersion>
<SqliteVersion>2.1.6</SqliteVersion>
<!-- HumanizerVersion is referenced from the Text.Analyzers.Package.csproj -->
Expand Down Expand Up @@ -134,6 +134,7 @@
<PackageVersion Include="Microsoft.VisualStudio.Utilities" Version="18.9.918" />
<PackageVersion Include="Microsoft.VisualStudio.Utilities.Internal" Version="16.3.90" />
<PackageVersion Include="Nerdbank.Streams" Version="2.13.16" />
<PackageVersion Include="Nerdbank.MessagePack" Version="1.2.34" />

@333fred 333fred Aug 18, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: this comes from Microsoft.VisualStudio.Composition, which isn't updated until 18.9.39. VS 18.9.1 does not ship with 18.9.39 of that package, so I opted for a transitive pin instead, as VS itself appears to do.

@ViktorHofer ViktorHofer Aug 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a comment next to the entry to make that clear. Ideally nuget would help us highlight transitive only pins which could then later be removed again.

<PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
<PackageVersion Include="StreamJsonRpc" Version="2.26.10" />
<PackageVersion Include="MessagePack" Version="2.5.302" />
Expand All @@ -153,15 +154,17 @@

<PackageVersion Include="Microsoft.NETCore.App.Runtime.win-arm64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
<PackageVersion Include="Microsoft.NETCore.App.Runtime.win-x64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
<PackageVersion Include="Microsoft.NETCore.App.crossgen2.win-x64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
<!-- Pin to 10.0.1 because versions 10.0.2 and later remove READYTORUN_FLAG_SKIP_TYPE_VALIDATION
from our binaries, causing additional JIT compilation in VS. -->
<PackageVersion Include="Microsoft.NETCore.App.crossgen2.win-x64" Version="10.0.1" />
<PackageVersion Include="Microsoft.WindowsDesktop.App.Runtime.win-arm64" Version="$(MicrosoftWindowsDesktopAppRuntimePackagesVersion)" />
<PackageVersion Include="Microsoft.WindowsDesktop.App.Runtime.win-x64" Version="$(MicrosoftWindowsDesktopAppRuntimePackagesVersion)" />

<!--
Language Server
-->
<PackageVersion Include="Microsoft.VisualStudio.LanguageServer.Client.Implementation" Version="17.10.72-preview" />
<PackageVersion Include="NuGet.ProjectModel" Version="6.14.0" />
<PackageVersion Include="NuGet.ProjectModel" Version="6.14.3" />
<PackageVersion Include="Microsoft.TestPlatform.TranslationLayer" Version="$(MicrosoftNETTestSdkVersion)" />
<PackageVersion Include="Microsoft.TestPlatform.ObjectModel" Version="$(MicrosoftNETTestSdkVersion)" />

Expand Down
2 changes: 1 addition & 1 deletion src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
<PackageReference Include="Microsoft.Build" />
<PackageReference Include="Microsoft.Build.Tasks.Core" />
<PackageReference Include="Basic.CompilerLog.Util" />
<PackageReference Include="MessagePack" VersionOverride="3.1.4" />
<PackageReference Include="MessagePack" VersionOverride="3.1.7" />

@jasonmalinowski jasonmalinowski Aug 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we have a VersionOverride here?

@JoeRobich JoeRobich Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Packages.props has <PackageVersion Include="MessagePack" Version="2.5.302" /> which seems to get updated as part of the VS SDK updates

@333fred 333fred Aug 19, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And Basic.CompilerLog.Util comes with 3.1.4.

</ItemGroup>
<ItemGroup>
<Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
Expand Down
4 changes: 2 additions & 2 deletions src/Razor/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Basic.Reference.Assemblies.AspNet80" Version="$(_BasicReferenceAssembliesVersion)" />
<PackageVersion Include="Microsoft.AspNetCore.App.Ref" Version="10.0.1" />
<PackageVersion Include="Microsoft.AspNetCore.App.Runtime.$(NetCoreSDKRuntimeIdentifier)" Version="10.0.1" />
<PackageVersion Include="Microsoft.AspNetCore.App.Ref" Version="10.0.11" />
<PackageVersion Include="Microsoft.AspNetCore.App.Runtime.$(NetCoreSDKRuntimeIdentifier)" Version="10.0.11" />
<PackageVersion Include="Microsoft.CodeAnalysis.Analyzer.Testing" Version="$(MicrosoftCodeAnalysisTestingVersion)" />
<PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="$(_MicrosoftExtensionsPackageVersion)" />
<PackageVersion Include="Microsoft.NET.Sdk.Razor" Version="11.0.100-preview.4.26215.114" />
Expand Down
2 changes: 1 addition & 1 deletion src/Tools/Replay/Replay.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
<PackageReference Include="Mono.Options" />
<PackageReference Include="MSBuild.StructuredLogger" />
<PackageReference Include="Basic.CompilerLog.Util" />
<PackageReference Include="MessagePack" VersionOverride="3.1.4" />
<PackageReference Include="MessagePack" VersionOverride="3.1.7" />
<PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Condition="'$(TargetFramework)' == 'net472'" />
</ItemGroup>

Expand Down