Directory.Packages.props

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>

    <MicrosoftCodeAnalysisPublicApiAnalyzersVersion Condition="'$(MicrosoftCodeAnalysisPublicApiAnalyzersVersion)' == ''">3.3.4</MicrosoftCodeAnalysisPublicApiAnalyzersVersion>
    <NewtonsoftJsonPackageVersion Condition="'$(NewtonsoftJsonPackageVersion)' == ''">13.0.3</NewtonsoftJsonPackageVersion>
    <SystemFormatsAsn1PackageVersion Condition="'$(SystemFormatsAsn1PackageVersion)' == ''">8.0.2</SystemFormatsAsn1PackageVersion>

    <!-- Read docs/updating-packages.md before updating System.Text.Json's version -->
    <SystemTextJsonVersion Condition="'$(SystemTextJsonVersion)' == ''">8.0.5</SystemTextJsonVersion>
    <SystemCommandLineVersion Condition="'$(SystemCommandLineVersion)' == ''">2.0.0-beta7.25374.102</SystemCommandLineVersion>
    <MSTestPackageVersion>3.4.3</MSTestPackageVersion>
  </PropertyGroup>

  <PropertyGroup>
    <MicrosoftBuildVersion Condition="'$(MicrosoftBuildVersion)' == '' and '$(DotNetBuildSourceOnly)' == 'true'">17.12.50</MicrosoftBuildVersion>
    <!-- Read docs/updating-packages.md before updating MSBuild's version -->
    <MicrosoftBuildVersion Condition="'$(MicrosoftBuildVersion)' == ''">17.11.48</MicrosoftBuildVersion>
  </PropertyGroup>

    <!-- Overridden by source build to ensure the same version is used across products, do not remove these properties -->
    <!-- For each property in this group, there is an appropriate package dependency in eng/Version.Details.xml -->
    <!-- All .NET package dependencies have to use proper version property names -->
  <PropertyGroup>
    <MicrosoftExtensionsFileProvidersAbstractionsPackageVersion Condition="'$(MicrosoftExtensionsFileProvidersAbstractionsPackageVersion)' == ''">6.0.0</MicrosoftExtensionsFileProvidersAbstractionsPackageVersion>
    <MicrosoftExtensionsFileSystemGlobbingPackageVersion Condition="'$(MicrosoftExtensionsFileSystemGlobbingPackageVersion)' == ''">6.0.0</MicrosoftExtensionsFileSystemGlobbingPackageVersion>
    <MicrosoftWebXdtPackageVersion Condition="'$(MicrosoftWebXdtPackageVersion)' == ''">3.2.0</MicrosoftWebXdtPackageVersion>
    <SystemComponentModelCompositionPackageVersion Condition="'$(SystemComponentModelCompositionPackageVersion)' == ''">4.5.0</SystemComponentModelCompositionPackageVersion>
    <SystemMemoryPackageVersion Condition="'$(SystemMemoryPackageVersion)' == ''">4.6.3</SystemMemoryPackageVersion>
    <SystemSecurityCryptographyPkcsVersion Condition="'$(SystemSecurityCryptographyPkcsVersion)' == ''">8.0.1</SystemSecurityCryptographyPkcsVersion>
    <SystemSecurityCryptographyProtectedDataVersion Condition="'$(SystemSecurityCryptographyProtectedDataVersion)' == ''">8.0.0</SystemSecurityCryptographyProtectedDataVersion>
    <MicrosoftDotNetXliffTasksVersion Condition="'$(MicrosoftDotNetXliffTasksVersion)' == ''">10.0.0-beta.25260.104</MicrosoftDotNetXliffTasksVersion>
  </PropertyGroup>

  <ItemGroup>
    <PackageVersion Include="AwesomeAssertions" Version="8.1.0" />
    <PackageVersion Include="ILRepack" Version="2.0.42" />
    <PackageVersion Include="Lucene.Net" Version="3.0.3" />
    <PackageVersion Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.Build.Artifacts" Version="4.2.0" />
    <PackageVersion Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.Build.Locator" Version="1.5.5" />
    <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.CodeAnalysis" Version="4.3.1" />
    <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="4.3.1" />
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.3.1" />
    <PackageVersion Include="Microsoft.CodeAnalysis.Features" Version="4.3.1" />
    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="4.3.1" />
    <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
    <PackageVersion Include="Microsoft.DataAI.NuGetRecommender.Contracts" Version="2.1.0" />
    <PackageVersion Include="Microsoft.DotNet.Build.Tasks.Feed" Version="10.0.0-beta.25401.1" />
    <PackageVersion Include="Microsoft.DotNet.Maestro.Tasks" Version="1.1.0-beta.24415.2" />
    <PackageVersion Include="Microsoft.DotNet.XliffTasks" Version="$(MicrosoftDotNetXliffTasksVersion)" />
    <PackageVersion Include="Microsoft.DotNet.SignTool" Version="10.0.0-beta.25367.5" />
    <PackageVersion Include="Microsoft.Extensions.CommandLineUtils.Sources" Version="3.0.0-preview6.19253.5" />
    <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="$(MicrosoftExtensionsFileProvidersAbstractionsPackageVersion)" />
    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="$(MicrosoftExtensionsFileSystemGlobbingPackageVersion)" />
    <PackageVersion Include="Microsoft.Internal.VisualStudio.Shell.Framework" Version="17.10.40173" />
    <PackageVersion Include="Microsoft.NET.StringTools" Version="$(MicrosoftBuildVersion)" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
    <PackageVersion Include="Microsoft.PowerShell.3.ReferenceAssemblies" Version="1.0.0" />
    <!-- Microsoft.TeamFoundationServer.ExtendedClient has vulnerable dependencies Microsoft.IdentityModel.JsonWebTokens and System.IdentityModel.Tokens.Jwt . When it's upgraded, try removing the pinned packages -->
    <PackageVersion Include="Microsoft.TeamFoundationServer.ExtendedClient" Version="16.153.0" />
    <PackageVersion Include="Microsoft.Test.Apex.VisualStudio" Version="18.0.0-preview-1-10723-180" />
    <PackageVersion Include="Microsoft.TestPlatform.Portable" Version="17.1.0" />
    <PackageVersion Include="Microsoft.VisualStudio.LanguageServices" Version="4.3.1" />
    <PackageVersion Include="Microsoft.VisualStudio.Markdown.Platform" Version="17.14.76-preview" />
    <PackageVersion Include="Microsoft.VisualStudio.ProjectSystem" Version="17.4.221-pre" />
    <PackageVersion Include="Microsoft.VisualStudio.ProjectSystem.Managed.VS" Version="17.2.0-beta1-20502-01" />
    <PackageVersion Include="Microsoft.VisualStudio.ProjectSystem.VS" Version="17.4.221-pre" />
    <PackageVersion Include="Microsoft.VisualStudio.SDK" Version="18.0.2345-preview.1" />
    <PackageVersion Include="Microsoft.VisualStudio.Sdk.TestFramework.Xunit" Version="17.11.8" />
    <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Interop" Version="3.4.2244" />
    <PackageVersion Include="Microsoft.VisualStudio.Shell.Styles" Version="18.0.2345-preview.1" />
    <PackageVersion Include="Microsoft.VisualStudio.TemplateWizardInterface" Version="17.10.40170" />
    <PackageVersion Include="Microsoft.VSSDK.BuildTools" Version="17.14.2094" />
    <PackageVersion Include="Microsoft.Web.Xdt" Version="$(MicrosoftWebXdtPackageVersion)" />
    <PackageVersion Include="Moq" Version="4.18.1" />
    <PackageVersion Include="MSTest.TestAdapter" Version="$(MSTestPackageVersion)" />
    <PackageVersion Include="MSTest.TestFramework" Version="$(MSTestPackageVersion)" />
    <PackageVersion Include="Newtonsoft.Json" Version="$(NewtonsoftJsonPackageVersion)" />
    <PackageVersion Include="NuGet.Client.EndToEnd.TestData" Version="1.0.0" />
    <PackageVersion Include="NuGet.Core" Version="2.14.0-rtm-832" />
    <PackageVersion Include="NuGetValidator" version="2.1.1" />
    <PackageVersion Include="SharpZipLib" Version="1.4.2" />
    <PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
    <PackageVersion Include="System.CommandLine" Version="$(SystemCommandLineVersion)" />
    <PackageVersion Include="System.ComponentModel.Composition" Version="$(SystemComponentModelCompositionPackageVersion)" />
    <PackageVersion Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1PackageVersion)" />
    <PackageVersion Include="System.Memory" Version="$(SystemMemoryPackageVersion)" />
    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="$(SystemSecurityCryptographyPkcsVersion)" />
    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="$(SystemSecurityCryptographyProtectedDataVersion)" />
    <PackageVersion Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
    <!--
      The Microsoft.VisualStudio.SDK metapackage brings in System.Threading.Tasks.Dataflow 4.11.1 (assembly version 4.9.5.0).
      However, our MSBuild integration tests use Microsoft.Build 16.8.0, which requires System.Threading.Tasks.Dataflow 4.9.0 (assembly version 4.9.3.0).
      To resolve runtime assembly binding failures, we'll downgrade the package from 4.11.1 to 4.9.0.
    -->
    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="4.9.0" />
    <PackageVersion Include="VsWebSite.Interop" Version="17.10.40173" />
    <PackageVersion Include="xunit" Version="2.9.0" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />
    <PackageVersion Include="Xunit.StaFact" Version="1.1.11" />
  </ItemGroup>

  <!--
    These PackageVersions are only used to resolve transitive packages with known vulnerabilities.
    Once the packages depending on these packages are upgraded, these PackageVersions can be removed.
  -->
  <ItemGroup>
    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="5.7.0" />
    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="5.7.0" />
  </ItemGroup>

  <!--
    Packages that provide NuGet's Visual Studio extensibility APIs should not depend on the Visual Studio SDK, to ensure
    there are no circular references in case the VS SDK itself adds our package as a dependency. Everything else, however
    should not add PackageReference on any package that is part of the VS SDK.

    These individual package versions should be equal to or less than the package version within the VS SDK that our
    customers use, otherwise they might get NU1605 or MSB3277 warnings.
  -->
  <ItemGroup Condition=" '$(MSBuildProjectFile)' == 'NuGet.VisualStudio.csproj' OR
              '$(MSBuildProjectFile)' == 'NuGet.VisualStudio.Contracts.csproj' OR
              '$(MSBuildProjectFile)' == 'NuGet.VisualStudio.Interop.csproj' OR
              '$(MSBuildProjectFile)' == 'NuGet.SolutionRestoreManager.Interop.csproj'">
    <PackageVersion Include="Microsoft.ServiceHub.Framework" Version="4.8.55" />
    <PackageVersion Include="Microsoft.VisualStudio.ComponentModelHost" Version="17.10.191" />
    <PackageVersion Update="Microsoft.VisualStudio.SDK" Version="" />
    <!-- Microsoft.VisualStudio.Shell.15.0 has vulnerable dependencies System.Text.Json. When it's upgraded, try removing the pinned packages -->
    <PackageVersion Include="Microsoft.VisualStudio.Shell.15.0" Version="18.0.2345-preview.1" />
  </ItemGroup>

  <ItemGroup>
    <GlobalPackageReference Include="Microsoft.VisualStudioEng.MicroBuild.Core" Version="1.0.0" Condition=" '$(DotNetBuildSourceOnly)' != 'true' " GeneratePathProperty="true" />
  </ItemGroup>

  <ItemGroup Condition=" '$(UsePublicApiAnalyzer)' == 'true' ">
    <GlobalPackageReference Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="$(MicrosoftCodeAnalysisPublicApiAnalyzersVersion)" />

    <None Remove="$(MSBuildProjectDirectory)\PublicAPI.Shipped.txt" />
    <None Remove="$(MSBuildProjectDirectory)\PublicAPI.Unshipped.txt" />
    <AdditionalFiles Include="$(MSBuildProjectDirectory)\PublicAPI.Shipped.txt" />
    <AdditionalFiles Include="$(MSBuildProjectDirectory)\PublicAPI.Unshipped.txt" />
  </ItemGroup>

  <ItemGroup Condition=" '$(UsePublicApiAnalyzer)' == 'perTfm' ">
    <GlobalPackageReference Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="$(MicrosoftCodeAnalysisPublicApiAnalyzersVersion)" />

    <None Remove="$(MSBuildProjectDirectory)\PublicAPI\$(TargetFramework)\PublicAPI.Shipped.txt" />
    <None Remove="$(MSBuildProjectDirectory)\PublicAPI\$(TargetFramework)\PublicAPI.Unshipped.txt" />
    <AdditionalFiles Include="$(MSBuildProjectDirectory)\PublicAPI\$(TargetFramework)\PublicAPI.Shipped.txt" />
    <AdditionalFiles Include="$(MSBuildProjectDirectory)\PublicAPI\$(TargetFramework)\PublicAPI.Unshipped.txt" />
  </ItemGroup>

  <ItemGroup Condition="'$(Shipping)' == 'true' AND '$(SkipAnalyzers)' != 'true' AND '$(DotNetBuildSourceOnly)' != 'true'">
    <GlobalPackageReference Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="3.3.4" />
    <AdditionalFiles Include="$(MSBuildThisFileDirectory)build\BannedSymbols.txt" Condition="'$(TestProject)' != 'true'" />
  </ItemGroup>

  <!-- DotNetBuildSourceOnly can only use packages that are open source -->
  <Target Name="CheckSourceBuildPackageReferences" AfterTargets="CollectPackageReferences" Condition=" '$(DotNetBuildSourceOnly)' == 'true' ">
    <ItemGroup>
      <_allowBuildFromSourcePackage Remove="@(_allowBuildFromSourcePackage)" />
      <_sourceBuildUnexpectedPackage Remove="@(_sourceBuildUnexpectedPackage)" />

      <_allowBuildFromSourcePackage Include="@(PackageReference)" Condition=" '%(PackageReference.IsImplicitlyDefined)' == 'true' " />

      <_allowBuildFromSourcePackage Include="Microsoft.Build.Framework" />
      <_allowBuildFromSourcePackage Include="Microsoft.Build.Tasks.Core" />
      <_allowBuildFromSourcePackage Include="Microsoft.Build.Utilities.Core" />
      <_allowBuildFromSourcePackage Include="Microsoft.Build" />
      <_allowBuildFromSourcePackage Include="Microsoft.CSharp" />
      <_allowBuildFromSourcePackage Include="Microsoft.DotNet.Build.Tasks.Feed" />
      <_allowBuildFromSourcePackage Include="Microsoft.DotNet.XliffTasks" />
      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.CommandLineUtils.Sources" />
      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.FileProviders.Abstractions" />
      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.FileSystemGlobbing" />
      <_allowBuildFromSourcePackage Include="Microsoft.Web.Xdt" />
      <_allowBuildFromSourcePackage Include="Newtonsoft.Json" />
      <_allowBuildFromSourcePackage Include="System.Collections.Immutable" />
      <_allowBuildFromSourcePackage Include="System.CommandLine" />
      <_allowBuildFromSourcePackage Include="System.ComponentModel.Composition" />
      <_allowBuildFromSourcePackage Include="System.Formats.Asn1" />
      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.Cng" />
      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.Pkcs" />
      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.ProtectedData" />
      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.Xml" />
      <_allowBuildFromSourcePackage Include="System.Text.Json" />

      <_sourceBuildUnexpectedPackage Include="@(PackageReference)" Exclude="@(_allowBuildFromSourcePackage)" />
    </ItemGroup>
    <Error Text="Found @(_sourceBuildUnexpectedPackage-&gt;Count()) PackageReferences not on DotNetBuildSourceOnly allow list: '@(_sourceBuildUnexpectedPackage)'" Condition=" '@(_sourceBuildUnexpectedPackage)' != '' " />
  </Target>

</Project>