Directory.Packages.props

<Project>

  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <OTelLatestStableVer>1.11.2</OTelLatestStableVer>

    <!--
        This is typically the latest annual release of .NET. Use this wherever
        possible and only deviate (use a specific version) when a package has a
        more specific patch which must be reference directly.
    -->
    <LatestRuntimeOutOfBandVer>9.0.0</LatestRuntimeOutOfBandVer>

    <!-- Mitigate https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485. -->
    <SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
    <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer>
  </PropertyGroup>

  <!--
      This section covers packages that are directly referenced by the NuGet packages published from this repository.
      Any security vulnerability in these packages or their downstream dependencies will be considered as a security
      vulnerability in the NuGet packages that are published from this repository.
  -->
  <ItemGroup>
    <!--
        Typically, for the Microsoft.Extensions.* packages relating to DI Abstractions, Hosting Abstractions, and Logging,
        the latest stable version should be used because:
        1) Each major version bump will have some new API capabilities (e.g.For Logging, .NET 6 introduced compile-time logging
          source generation, .NET 8 introduced automatic event id generation).
        2) Each minor version bump is normally security hotfixes or critical bug fixes.
        3) Since version 3.1.0, the .NET runtime team is holding a high bar for backward compatibility on
          these packages even during major version bumps, so compatibility is not a concern here.
    -->
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="$(LatestRuntimeOutOfBandVer)" />

    <!--
        OTel packages always point to latest stable release.
    -->
    <PackageVersion Include="OpenTelemetry" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTelemetry.Api" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTelemetry.Api.ProviderBuilderExtensions" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTelemetry.Extensions.Propagators" Version="[$(OTelLatestStableVer),2.0)" />
    <PackageVersion Include="OpenTracing" Version="[0.12.1,0.13)" />

    <!--
        Typically, the latest stable version of System.Diagnostics.DiagnosticSource should be used here because:
        1) Each major version bump will likely have some new OpenTelemetry capabilities (e.g. .NET 6 introduced Meter
          API, .NET 7 added UpDownCounter, .NET 8 added Meter/Instrument level attributes support, .NET 9 added
          Advice/Hint API, etc.).
        2) Each minor version bump is normally security hotfixes or critical bug fixes.
        3) The .NET runtime team provides extra backward compatibility guarantee to System.Diagnostics.DiagnosticSource
          even during major version bumps, so compatibility is not a concern here.
    -->
    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="$(LatestRuntimeOutOfBandVer)" />

    <!--
        We use conservative versions of these packages where an upgrade might
        introduce breaking changes.
    -->
    <PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" />
    <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" />
    <PackageVersion Include="Grpc.Core" Version="[2.44.0,3.0)" />
    <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" />
  </ItemGroup>

  <ItemGroup>
    <!--
        Note: See TargetFrameworksRequiringSystemTextJsonDirectReference for the
        list of targets where System.Text.Json direct reference is applied.
    -->

    <!--
        We use conservative versions of these packages for older runtimes where
        an upgrade might introduce breaking changes. For example see:
        https://devblogs.microsoft.com/dotnet/system-text-json-in-dotnet-7/#breaking-changes.
    -->
    <PackageVersion Include="System.Text.Encodings.Web" Version="4.7.2" />
    <PackageVersion Include="System.Text.Json" Version="4.7.2" />

    <!-- Newer NETCoreApp runtimes need to be redirected to safe versions. -->
    <PackageVersion Update="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
    <PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
  </ItemGroup>

  <!--
      This section covers packages that are **not** directly referenced by the NuGet packages published from this repository.
      These packages are referenced as "PrivateAssets" or used in tests/examples.
  -->
  <ItemGroup>
    <PackageVersion Include="BenchmarkDotNet" Version="[0.13.12,0.14)" />
    <PackageVersion Include="CommandLineParser" Version="[2.9.1,3.0)" />
    <PackageVersion Include="Grpc.AspNetCore" Version="[2.59.0,3.0)" />
    <PackageVersion Include="Grpc.AspNetCore.Server" Version="[2.59.0, 3.0)" />
    <PackageVersion Include="Grpc.Tools" Version="[2.59.0,3.0)" />
    <PackageVersion Include="Microsoft.CSharp" Version="[4.7.0]" />
    <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="[3.11.0-beta1.23525.2]" />
    <PackageVersion Include="Microsoft.Coyote" Version="1.7.11" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
    <PackageVersion Include="Microsoft.Extensions.Telemetry.Abstractions" Version="[9.0.0,)" />
    <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="[1.0.3,2.0)" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.13.0,18.0.0)" />
    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="[8.0.0,9.0)" />
    <PackageVersion Include="MinVer" Version="[5.0.0,6.0)" />
    <PackageVersion Include="NuGet.Versioning" Version="6.11.0" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="[1.9.0,2.0)" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.GrpcNetClient" Version="[1.9.0-beta.1,2.0)" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="[1.9.0,2.0)" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="[1.9.0,2.0)" />
    <PackageVersion Include="RabbitMQ.Client" Version="[6.8.1,7.0)" />
    <PackageVersion Include="StyleCop.Analyzers" Version="[1.2.0-beta.556,2.0)" />
    <PackageVersion Include="Swashbuckle.AspNetCore" Version="[6.7.3,)" />
    <PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
    <PackageVersion Include="xunit" Version="[2.9.3,3.0)" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="[2.8.2,3.0)" />
  </ItemGroup>

  <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.8" />
  </ItemGroup>

  <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.0" />
  </ItemGroup>

</Project>