Skip to content

Remove obsolete transitive NuGet overrides from typespec-vs #10824

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 5 commits into
base: main
Choose a base branch
from
+7 −12
Open

Remove obsolete transitive NuGet overrides from typespec-vs #10824

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2864a3f
Initial plan
Copilot May 28, 2026
39440b9
Remove obsolete vs-extension package overrides
Copilot May 28, 2026
4d6e325
Add typespec-vs changelog entry
Copilot May 28, 2026
776ad89
Use Chronus change file for typespec-vs
Copilot May 28, 2026
fc0d818
Merge branch 'main' into copilot/remove-unnecessary-nuget-package
timotheeguerin May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .chronus/changes/copilot-remove-unnecessary-nuget-package-2026-4-28-12-59-38.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
changeKind: fix
packages:
- typespec-vs
---

Remove obsolete explicit Visual Studio transitive NuGet package overrides.
12 changes: 0 additions & 12 deletions packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,6 @@
Link="TextMate/typespec.tmLanguage" />
<Content Update="@(Content)" IncludeInVSIX="true" CopyToOutputDirectory="PreserveNewest" />
<Reference Include="System.ComponentModel.Composition" />
<!-- The 'MessagePack' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.SDK', 'Microsoft.VisualStudio.Workspace' and 'Microsoft.VisualStudio.VSIntegration' -->
Copy link
Copy Markdown
Contributor

@RodgeFu RodgeFu May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but I don't see change to these nuget packages using the removed ones. They should be upgrade to a new version to use a security issue free dependency, shouldn't it?

Copy link
Copy Markdown
Member

@timotheeguerin timotheeguerin May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't that fail the CI if it did? did we maybe upgrade those version separately but never cleaned up?
@copilot can you investigate and check if that is the case, do we also need to upgrade the other packages?

Copy link
Copy Markdown
Member

@timotheeguerin timotheeguerin May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot can you answer the question

Copy link
Copy Markdown
Contributor Author

Copilot AI May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked the resolved graph with dotnet restore Microsoft.TypeSpec.VS.sln, dotnet list src/Microsoft.TypeSpec.VS.csproj package --include-transitive, and --vulnerable. The removed packages are still brought in transitively at the same resolved versions (MessagePack 2.5.192, Microsoft.VisualStudio.Composition 17.13.41, Microsoft.VisualStudio.Shell.15.0 17.14.40264), and NuGet reports no vulnerable packages for this project. So this looks like a cleanup of old explicit overrides after the upstream Visual Studio package set had already been updated, not a missing upgrade in this PR.

<!-- Have to add it explicitly here because the version used by 'Microsoft.VisualStudio...' report vulnerabilities now -->
<!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version having 'MessagePack' updated to vulnerability free version-->
<PackageReference Include="MessagePack" Version="2.5.192" />
<PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.2" />
<Content Include="Icons\logo.png">
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
Expand All @@ -47,16 +43,8 @@
</Content>
</ItemGroup>
<ItemGroup>
<!-- The 'Microsoft.VisualStudio.Composition' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace' -->
<!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace" will report warning NU1603 because its desired version not found and higher version will be used -->
<!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
<PackageReference Include="Microsoft.VisualStudio.Composition" Version="17.13.41" />
<!-- Use 17.0.x or latest 16.x if no 17.0.x for compatible API-->
<PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.14.40265" ExcludeAssets="Runtime" />
<!-- The 'Microsoft.VisualStudio.Shell.15.0' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace.VSIntegration' -->
<!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace.VSIntegration" will report warning NU1603 because its desired version not found and higher version will be used -->
<!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
<PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.14.40264" />
<PackageReference Include="Microsoft.VisualStudio.Workspace" Version="17.12.19" ExcludeAssets="Runtime" />
<PackageReference Include="Microsoft.VisualStudio.Workspace.VSIntegration" Version="17.12.19" ExcludeAssets="Runtime" />
<!-- https://github.com/advisories/GHSA-w3q9-fxm7-j8fq -->
Expand Down
Loading