allow compilation with vs2026 and cleanup some nuget packages

[sensslen]

Summary by CodeRabbit

• Chores

  • Updated build tooling and package references to align with newer .NET releases, replacing older packaging deps with a consolidated project-model package.
  • Split and refined framework-specific build settings and added a legacy toolset placeholder for native project templates.
  • Bumped logging dependency for browser-targeted builds.

• Tests

  • Upgraded the test framework to a newer stable version for improved reliability.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The PR updates multiple project files: in src/NuGetUtility/NuGetUtility.csproj it replaces NuGet.Commands and NuGet.Packaging with NuGet.ProjectModel, removes the net6.0 Microsoft.Build runtime-excluded ItemGroup, separates target-framework ItemGroups so net9.0 uses Microsoft.Build 17., adds net10.0 with Microsoft.Build 18.0., and updates the net472 Microsoft.Build reference to 18.0.*. Test projects bump TUnit from 1.1.10 to 1.2.11. Two C++ test project files remove per-configuration PlatformToolset entries and add an unconditional empty LegacyPlatformToolset property.

Possibly related PRs

• allow compilation with vs2026 and cleanup some nuget packages #339: Makes the same csproj changes in src/NuGetUtility/NuGetUtility.csproj (replace NuGet.Commands/NuGet.Packaging with NuGet.ProjectModel and update Microsoft.Build groupings/versions).
• update to release .net10 #336: Prepares for .NET 10 by updating NuGet/Microsoft.Build package references and framework-specific dependency handling in src/NuGetUtility/NuGetUtility.csproj.
• Add .NET 10 target framework support #325: Reworks target framework ItemGroups and adjusts Microsoft.Build package versions in src/NuGetUtility/NuGetUtility.csproj.

Pre-merge checks and finishing touches

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: updating dependencies to support VS2026 compilation (Microsoft.Build versions, net10.0 target framework, toolset updates) and consolidating NuGet packages (replacing NuGet.Commands/Packaging with NuGet.ProjectModel).

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7b7bf63 and 362f929.

📒 Files selected for processing (6)

• src/NuGetUtility/NuGetUtility.csproj (1 hunks)
• tests/NuGetUtility.UrlToLicenseMapping.Test/NuGetUtility.UrlToLicenseMapping.Test.csproj (1 hunks)
• tests/SPDXLicenseMatcher.Test/SPDXLicenseMatcher.Test.csproj (1 hunks)
• tests/targets/EmptyCppProject/EmptyCppProject.vcxproj (1 hunks)
• tests/targets/MultiTargetProjectWithDifferentDependencies/MultiTargetProjectWithDifferentDependencies.csproj (1 hunks)
• tests/targets/SimpleCppProject/SimpleCppProject.vcxproj (1 hunks)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (2)

tests/targets/EmptyCppProject/EmptyCppProject.vcxproj (1)

51-53: LegacyPlatformToolset placeholder looks good; optional clarity improvement

Adding an unconditional <LegacyPlatformToolset /> keeps the test project free from a hard-coded PlatformToolset while still exposing a property for tooling/tests, which is reasonable. If this is intentionally only for test infrastructure, consider adding a brief XML comment or Label to make that purpose explicit for future maintainers, but it’s not required.

src/NuGetUtility/NuGetUtility.csproj (1)

31-37: Microsoft.Build per‑TFM setup aligns with VS2026 goals; consider pinning net9.0 version

Using Microsoft.Build 17.* for net9.0 and 18.0.* for net10.0/net472 is consistent with the expected MSBuild major versions for newer VS releases and should help with VS2026 compatibility. One minor nit: net8.0 is pinned to 17.11.* while net9.0 floats on 17.*; if you care about deterministic restores/builds, you might want to pin net9.0 to a specific 17.x (likely the same as net8.0, or whatever VS2026 mandates) to avoid surprises as new 17.x versions ship. If you intentionally want net9.0 to float, maybe add a brief comment to document that choice.

Also, please verify that Microsoft.Build 18.0.* on net472 matches the MSBuild version actually installed with VS2026 on your build agents.

Also applies to: 39-42

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d436441 and 7b7bf63.

📒 Files selected for processing (5)

• src/NuGetUtility/NuGetUtility.csproj (1 hunks)
• tests/NuGetUtility.UrlToLicenseMapping.Test/NuGetUtility.UrlToLicenseMapping.Test.csproj (1 hunks)
• tests/SPDXLicenseMatcher.Test/SPDXLicenseMatcher.Test.csproj (1 hunks)
• tests/targets/EmptyCppProject/EmptyCppProject.vcxproj (1 hunks)
• tests/targets/SimpleCppProject/SimpleCppProject.vcxproj (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (3)

• tests/SPDXLicenseMatcher.Test/SPDXLicenseMatcher.Test.csproj
• tests/NuGetUtility.UrlToLicenseMapping.Test/NuGetUtility.UrlToLicenseMapping.Test.csproj
• tests/targets/SimpleCppProject/SimpleCppProject.vcxproj

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (16)

• GitHub Check: test_windows (net10.0)
• GitHub Check: check_licenses_net472 (App)
• GitHub Check: check_licenses_net472 (ProjectWithReferenceContainingFileLicense)
• GitHub Check: check_licenses_net472 (ProjectWithReferenceContainingLicenseExpression)
• GitHub Check: test_windows (net8.0)
• GitHub Check: check_version_command_net472
• GitHub Check: check_licenses_net472 (Tests)
• GitHub Check: test_windows (net9.0)
• GitHub Check: test_windows (net472)
• GitHub Check: test_url_to_license_mapping
• GitHub Check: test (macos-latest, net9.0)
• GitHub Check: test (macos-latest, net10.0)
• GitHub Check: test (macos-latest, net8.0)
• GitHub Check: test_file_license_matching (ubuntu-latest)
• GitHub Check: test_file_license_matching (macos-latest)
• GitHub Check: test_file_license_matching (windows-latest)

🔇 Additional comments (1)

src/NuGetUtility/NuGetUtility.csproj (1)

23-23: NuGet.Packaging dependency removed but still used in code—compilation will fail

The NuGet.Packaging package has been removed from the project file, but at least 7 source files still actively import and use types from it:

• LicenseMetadata.cs: uses NuGet.Packaging.LicenseType, NuGet.Packaging.LicenseMetadata
• WrappedPackageMetadata.cs: uses NuGet.Packaging
• WindowsPackagesConfigReader.cs: uses NuGet.Packaging.PackagesConfigReader
• GlobalPackagesFolderUtility.cs: uses NuGet.Packaging.Core.PackageIdentity
• CachingPackageMetadataResource.cs: uses NuGet.Packaging.Core.PackageIdentity
• WrappedPackageDownloader.cs: uses NuGet.Packaging.IPackageDownloader
• CachingFindPackageByIdResource.cs: uses NuGet.Packaging.Core.PackageIdentity, NuGet.Packaging.IPackageDownloader

Either restore the NuGet.Packaging package reference, or refactor the code to eliminate the dependency.

⛔ Skipped due to learnings

Learnt from: sensslen
Repo: sensslen/nuget-license PR: 327
File: .github/workflows/release.yml:38-38
Timestamp: 2025-11-07T21:33:27.230Z
Learning: In the release workflow (.github/workflows/release.yml), the test assembly pattern `NuGet*.Test.dll` intentionally excludes SPDXLicenseMatcher.Test.dll from the release workflow tests.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud