mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-21 09:06:37 +08:00
romanett
f061c2d7da
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Klaus Landsdorf <kl@iniationware.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
207 lines
14 KiB
XML
207 lines
14 KiB
XML
<Project>
|
|
<!-- Roslyn API versions the analyzers and source generators are built against.
|
|
The central pins below track the newest of them so that the primary
|
|
analyzer variants and the projects that test them resolve identically. -->
|
|
<Import Project="roslyn.props" />
|
|
<PropertyGroup>
|
|
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
|
|
<!-- Pin transitive package versions so PackageVersion entries below force the
|
|
resolved version everywhere they appear in the dependency graph, even when
|
|
no project declares a direct PackageReference. Used to remediate transitive
|
|
NU1903 vulnerabilities (System.Net.Http 4.3.0, System.Text.RegularExpressions
|
|
4.3.0) pulled in by Microsoft.AspNetCore.* 2.3.x on net8.0/net9.0. -->
|
|
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
|
|
</PropertyGroup>
|
|
<ItemGroup>
|
|
<PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
|
|
<PackageVersion Include="BitFaster.Caching" Version="2.6.1" />
|
|
<PackageVersion Include="BouncyCastle.Cryptography" Version="2.7.0" />
|
|
<PackageVersion Include="Confluent.Kafka" Version="2.15.1" />
|
|
<PackageVersion Include="coverlet.collector" Version="10.0.1" />
|
|
<PackageVersion Include="Crdt" Version="1.1.2" />
|
|
<PackageVersion Include="Crdt.Transport" Version="1.1.2" />
|
|
<PackageVersion Include="Dekaf" Version="1.21.1" />
|
|
<PackageVersion Include="RaftCs" Version="1.1.2" />
|
|
<PackageVersion Include="RaftCs.Transport" Version="1.1.2" />
|
|
<PackageVersion Include="RaftCs.Transport.NanoMsg" Version="1.1.2" />
|
|
<PackageVersion Include="RaftCs.Storage.File" Version="1.1.2" />
|
|
<PackageVersion Include="EmbedIO" Version="3.5.2" />
|
|
<PackageVersion Include="JsonSchema.Net" Version="9.4.0" />
|
|
<PackageVersion Include="Makaretu.Dns.Multicast" Version="0.27.0" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Connections.Abstractions" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Hosting" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Http" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Server.Kestrel.Https" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.WebSockets" Version="2.3.13" />
|
|
<PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
|
|
<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="$(RoslynApiVersionVS2026)" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="$(RoslynApiVersionVS2026)" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="$(RoslynApiVersionVS2026)" />
|
|
<PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="$(RoslynApiVersionVS2026)" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Diagnostics" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0" />
|
|
<PackageVersion Include="ModelContextProtocol" Version="2.2.0" />
|
|
<PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
|
|
<PackageVersion Include="ModelContextProtocol.Core" Version="2.2.0" />
|
|
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
|
|
<PackageVersion Include="Microsoft.SourceLink.AzureRepos.Git" Version="10.0.401" />
|
|
<!-- AI Model Management. Microsoft.Extensions.AI is the inference
|
|
abstraction: IChatClient is the contract that reaches a hosted service
|
|
and an on-device runtime alike, which is the property the specification
|
|
asserts about where inference runs. It pins System.Text.Json 10.0.12,
|
|
the version this repository already centralises on, so it costs nothing
|
|
to take. No cloud-vendor SDK is referenced anywhere: workload identity
|
|
is read from the token the platform projects, which is the mechanism
|
|
every platform implements underneath its own SDK. -->
|
|
<PackageVersion Include="Microsoft.Extensions.AI" Version="10.10.0" />
|
|
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.401" />
|
|
<PackageVersion Include="System.CommandLine" Version="2.0.12" />
|
|
<PackageVersion Include="Microsoft.VisualStudio.DiagnosticsHub.BenchmarkDotNetDiagnosers" Version="18.7.37220.1" />
|
|
<PackageVersion Include="Moq" Version="4.20.72" />
|
|
<PackageVersion Include="TUnit" Version="1.69.0" />
|
|
<PackageVersion Include="Nerdbank.GitVersioning" Version="3.10.94" />
|
|
<PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
|
|
<!--
|
|
PacketDotNet and SharpPcap are native-code dependencies of
|
|
Opc.Ua.Core.Diagnostics, Opc.Ua.PubSub.Diagnostics and (for the
|
|
opt-in WithPcap() backend, net8.0+ only) Opc.Ua.PubSub.Eth. They
|
|
dynamically load libpcap on Linux/macOS and Npcap on Windows. Per
|
|
SDL native-code policy:
|
|
- Versions are pinned (no floating range)
|
|
- SBOM tracking is required for every release
|
|
- Subscribe to upstream CVE feeds:
|
|
* https://github.com/dotpcap/sharppcap/security/advisories
|
|
* https://github.com/dotpcap/packetnet/security/advisories
|
|
- Review monthly; bump within 30 days for HIGH/CRITICAL CVEs
|
|
-->
|
|
<PackageVersion Include="PacketDotNet" Version="1.4.8" />
|
|
<PackageVersion Include="Pkcs11Interop" Version="5.3.0" />
|
|
<PackageVersion Include="SharpPcap" Version="6.3.1" />
|
|
<PackageVersion Include="NUnit" Version="4.6.1" />
|
|
<PackageVersion Include="NUnit.Analyzers" Version="4.15.0" />
|
|
<PackageVersion Include="NUnit.Console" Version="3.22.0" />
|
|
<PackageVersion Include="NUnit3TestAdapter" Version="6.3.0" />
|
|
<PackageVersion Include="ObjectLayoutInspector" Version="0.2.0" />
|
|
<PackageVersion Include="PolySharp" Version="1.16.0" />
|
|
<PackageVersion Include="Roslynator.Analyzers" Version="5.0.0" />
|
|
<PackageVersion Include="Roslynator.Formatting.Analyzers" Version="5.0.0" />
|
|
<PackageVersion Include="SharpFuzz" Version="2.3.0" />
|
|
<!-- Transitive vulnerability pin (consumed via Testcontainers.*):
|
|
- SSH.NET 2026.0.0 fixes GHSA-q939-rpr3-3284 -->
|
|
<PackageVersion Include="SSH.NET" Version="2026.0.0" />
|
|
<PackageVersion Include="Serilog" Version="4.4.0" />
|
|
<PackageVersion Include="Testcontainers" Version="4.15.0" />
|
|
<PackageVersion Include="Testcontainers.Kafka" Version="4.15.0" />
|
|
<PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
|
|
<PackageVersion Include="Serilog.Extensions.Logging" Version="10.0.0" />
|
|
<PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
|
|
<PackageVersion Include="Serilog.Sinks.Debug" Version="3.0.0" />
|
|
<PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
|
|
<PackageVersion Include="System.Buffers" Version="4.6.1" />
|
|
<PackageVersion Include="System.Composition.AttributedModel" Version="10.0.12" />
|
|
<PackageVersion Include="System.Runtime.CompilerServices.Unsafe" Version="6.1.2" />
|
|
<PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="10.0.12" />
|
|
<PackageVersion Include="System.Memory" Version="4.6.3" />
|
|
<PackageVersion Include="System.Formats.Asn1" Version="10.0.12" />
|
|
<PackageVersion Include="System.IO.Compression" Version="4.3.0" />
|
|
<PackageVersion Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
|
|
<!-- Transitive vulnerability pins (consumed via Microsoft.AspNetCore.* 2.3.x on
|
|
net8.0/net9.0 - default transitives are 4.3.0 with NU1903):
|
|
- System.Net.Http 4.3.4 fixes GHSA-7jgj-8wvc-jh57
|
|
- System.Text.RegularExpressions 4.3.1 fixes GHSA-cmhx-cq75-c4mj -->
|
|
<PackageVersion Include="System.Net.Http" Version="4.3.4" />
|
|
<PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
|
|
<PackageVersion Include="System.Collections.Immutable" Version="$(RoslynRuntimeVersion)" />
|
|
<PackageVersion Include="System.Reflection.Metadata" Version="$(RoslynRuntimeVersion)" />
|
|
<PackageVersion Include="System.Text.Json" Version="10.0.12" />
|
|
<PackageVersion Include="System.Private.Uri" Version="4.3.2" />
|
|
<PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
|
|
<PackageVersion Include="System.Security.Cryptography.Cng" Version="5.0.0" />
|
|
<PackageVersion Include="System.Threading.Channels" Version="10.0.12" />
|
|
<PackageVersion Include="System.Threading.RateLimiting" Version="10.0.12" />
|
|
<PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.6.3" />
|
|
</ItemGroup>
|
|
<!-- OpenUSD rendering stack, consumed by the optional
|
|
tools/Opc.Ua.OpenUsd.Connector.Viewer assembly that backs the connector's
|
|
view option, and by src/Opc.Ua.Vision.OpenUsd which renders the
|
|
Vision server's simulated camera views offscreen via Silk (D3D12/Vulkan).
|
|
Published on nuget.org. The runtime packages ship win-x64, linux-x64 and
|
|
osx-arm64; the RID-agnostic metapackages resolve the correct native asset
|
|
per RID, so no RID-conditional reference is required. All of these move
|
|
together because the managed and RID-specific runtime packages have to
|
|
match; a partial bump fails when the natives load rather than when the
|
|
solution builds. -->
|
|
<ItemGroup>
|
|
<PackageVersion Include="OpenUsd" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Viewer" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Rendering" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Rendering.Silk" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Rendering.Silk.D3D12" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Rendering.Silk.Vulkan" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Runtime.Core" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="OpenUsd.Runtime.Imaging" Version="0.14.0-alpha" />
|
|
<PackageVersion Include="Avalonia" Version="12.1.3" />
|
|
<PackageVersion Include="Avalonia.Desktop" Version="12.1.3" />
|
|
</ItemGroup>
|
|
<!-- MQTTnet 5.x dropped net48 support. Per-TFM pinning is
|
|
required because CentralPackageTransitivePinningEnabled lets the central pin
|
|
win over PubSub's VersionOverride for transitive consumers (e.g. samples
|
|
that ProjectReference Opc.Ua.PubSub). See src/Opc.Ua.PubSub/Opc.Ua.PubSub.csproj. -->
|
|
<ItemGroup Condition="'$(TargetFramework)' == 'net48'">
|
|
<PackageVersion Include="MQTTnet" Version="4.3.7.1207" />
|
|
</ItemGroup>
|
|
<ItemGroup Condition="'$(TargetFramework)' != 'net48'">
|
|
<PackageVersion Include="MQTTnet" Version="5.2.0.1603" />
|
|
<PackageVersion Include="MQTTnet.Server" Version="5.2.0.1603" />
|
|
</ItemGroup>
|
|
<!-- ASP.NET Core packages that ship one band per .NET major. Unlike the
|
|
Microsoft.Extensions.* packages above, these have no netstandard2.0 asset and
|
|
no roll-forward across majors: a net8.0 project cannot consume the 10.0.x
|
|
band. The consumers (src/Opc.Ua.Bindings.Https and
|
|
tests/Opc.Ua.Bindings.Https.WebApi.Tests) build for net8.0, net9.0 and
|
|
net10.0, so the version has to follow $(TargetFramework) rather than being a
|
|
single pin held down to the oldest supported band.
|
|
|
|
The net10.0 group is the fallback so that a TFM this file does not enumerate
|
|
- a future net11.0 - still resolves a version. -->
|
|
<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="8.0.31" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.31" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.31" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.31" />
|
|
</ItemGroup>
|
|
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="9.0.20" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.20" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.20" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.20" />
|
|
</ItemGroup>
|
|
<ItemGroup Condition="'$(TargetFramework)' != 'net8.0' AND '$(TargetFramework)' != 'net9.0'">
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.12" />
|
|
</ItemGroup>
|
|
</Project>
|