Skip to content

Conversation

@seantleonard
Copy link
Contributor

@seantleonard seantleonard commented Nov 3, 2022

Why make this change?

Package management is messy and tedious where we have variables to set version numbers of packages. We then need to manually update package versions to reference those variables in all .csproj files. When a package needs an update, it reverts the variable in the .csproj file to a version number requiring us to go and manually update the version number again.

Security review preparation requires us to document and track all OSS components, containers, and code. We must also demonstrate that dependencies are currently approved by Microsoft OSS for use in our project.

To address this, having a central location to easily update and manage package dependencies is desirable.

What is this change?

  • Data API Builder's Visual Studio solution (.sln) now uses NuGet’s Central Package Management | Microsoft Learn to centrally manage dependencies across the solution’s projects. A single new file, Directory.Packages.props is placed at the root of the solution, setting MSBuild property ManagePackageVersionsCentrally to true, so that:
    • One file is responsible for defining the dependency versions used across projects.
    • Package version numbers should no longer be defined in .csproj files and have been removed.
    • Version numbers no longer defined as variables that are unable to be auto-updated by NuGet package manager.

Requirements

The feature is available across all NuGet integrated tooling.

How was this tested?

  • Solution builds after cleaning.
  • Running dotnet restore succeeds without errors. Version number must NOT be defined in individual .csproj files.

Sample Files

Directory.Packages.props file

  <ItemGroup>
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.1" />
  </ItemGroup>

.csproj file

<ItemGroup>
    <PackageReference Include="Newtonsoft.Json" />
</ItemGroup>

Copy link
Contributor

@severussundar severussundar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@seantleonard seantleonard enabled auto-merge (squash) November 7, 2022 17:32
@seantleonard seantleonard merged commit f9f7f53 into main Nov 7, 2022
@seantleonard seantleonard deleted the dev/seleonar/dotNet6_update branch November 7, 2022 17:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fundamentals: Simplify dependency management - upgrade from out of support package versions

5 participants