Repository navigation
Enable central package transitive pinning - #69697
Merged
Merged
Conversation
Remove redundant package references, align central versions with transitive requirements, and opt Roslyn VersionOverride projects out of transitive pinning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
wtgodbe
requested review from
a team,
BrennanConroy,
SamMonoRT,
Youssef1313,
cincuranet,
davpetr,
halter73 and
rokonec
as code owners
October 7, 2026 17:23
Contributor
|
Hey @dotnet/aspnet-build, looks like this PR is something you want to take a look at. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The reported managed build does not establish repository-wide restore and packaging compatibility across platform-specific and source-build paths.
1 open finding
What changed in this PR
Enables central transitive package pinning across ASP.NET Core, reducing explicit dependency declarations while retaining project-specific version exceptions.
Changes:
- Removes 130 redundant package references.
- Updates five central package versions and opts affected Roslyn projects out of pinning.
- Suppresses three xUnit diagnostics to preserve the existing analyzer baseline.
| File | Description |
|---|---|
| src/WebEncoders/test/Microsoft.Extensions.WebEncoders.Tests.csproj | Removes Options reference. |
| src/Validation/test/Microsoft.Extensions.Validation.GeneratorTests/Microsoft.Extensions.Validation.GeneratorTests.csproj | Removes dependency-injection and Hosting references. |
| src/Validation/gen/Microsoft.Extensions.Validation.ValidationsGenerator.csproj | Disables transitive pinning. |
| src/Tools/SDK-Analyzers/Components/test/Microsoft.AspNetCore.Components.SdkAnalyzers.Tests.csproj | Removes Workspaces reference. |
| src/Tools/SDK-Analyzers/Components/src/Microsoft.AspNetCore.Components.SdkAnalyzers.csproj | Disables transitive pinning. |
| src/Tools/dotnet-user-jwts/test/dotnet-user-jwts.Tests.csproj | Removes Hosting reference. |
| src/Testing/test/Microsoft.AspNetCore.InternalTesting.Tests.csproj | Removes RuntimeInformation reference. |
| src/StaticAssets/test/Microsoft.AspNetCore.StaticAssets.Tests.csproj | Removes Hosting reference. |
| src/SignalR/server/StackExchangeRedis/test/Microsoft.AspNetCore.SignalR.StackExchangeRedis.Tests.csproj | Removes Logging reference. |
| src/SignalR/server/SignalR/test/Microsoft.AspNetCore.SignalR.Tests/Microsoft.AspNetCore.SignalR.Tests.csproj | Removes logging-provider references. |
| src/SignalR/perf/Microbenchmarks/Microsoft.AspNetCore.SignalR.Microbenchmarks.csproj | Removes Moq reference. |
| src/SignalR/common/Http.Connections/src/Microsoft.AspNetCore.Http.Connections.csproj | Removes Diagnostics reference. |
| src/Servers/Kestrel/Transport.Quic/test/Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.Tests.csproj | Removes Logging reference. |
| src/Servers/Kestrel/Transport.NamedPipes/test/Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.Tests.csproj | Removes Logging reference. |
| src/Servers/Kestrel/test/InMemory.FunctionalTests/InMemory.FunctionalTests.csproj | Removes Newtonsoft.Json reference. |
| src/Servers/Kestrel/samples/WebTransportSampleApp/WebTransportSampleApp.csproj | Removes Hosting and Console references. |
| src/Servers/Kestrel/samples/WebTransportInteractiveSampleApp/WebTransportInteractiveSampleApp.csproj | Removes Hosting and Console references. |
| src/Servers/Kestrel/Core/test/Microsoft.AspNetCore.Server.Kestrel.Core.Tests.csproj | Removes Physical file-provider reference. |
| src/Servers/Kestrel/Core/src/Microsoft.AspNetCore.Server.Kestrel.Core.csproj | Removes Configuration.Binder reference. |
| src/Servers/HttpSys/samples/TlsFeaturesObserve/TlsFeaturesObserve.csproj | Removes Hosting and Console references. |
| src/Servers/HttpSys/samples/SelfHostServer/SelfHostServer.csproj | Removes Console reference. |
| src/Security/test/AuthSamples.FunctionalTests/AuthSamples.FunctionalTests.csproj | Removes DependencyModel and Hosting references. |
| src/Security/samples/Identity.ExternalClaims/Identity.ExternalClaims.csproj | Removes configuration and logging references. |
| src/Security/samples/DynamicSchemes/DynamicSchemes.csproj | Removes configuration and logging references. |
| src/Security/perf/Microbenchmarks/Microsoft.AspNetCore.Security.Microbenchmarks.csproj | Removes dependency-injection and Logging references. |
| src/Security/CookiePolicy/test/Microsoft.AspNetCore.CookiePolicy.Test.csproj | Removes dependency-injection reference. |
| src/Security/Authorization/test/Microsoft.AspNetCore.Authorization.Test.csproj | Removes Hosting reference. |
| src/Security/Authentication/WsFederation/samples/WsFedSample/WsFedSample.csproj | Removes EnvironmentVariables reference. |
| src/Security/Authentication/samples/SocialSample/SocialSample.csproj | Removes Console reference. |
| src/Security/Authentication/OpenIdConnect/samples/MinimalOpenIdConnectSample/MinimalOpenIdConnectSample.csproj | Removes Hosting reference. |
| src/Security/Authentication/JwtBearer/samples/MinimalJwtBearerSample/MinimalJwtBearerSample.csproj | Removes Hosting reference. |
| src/Security/Authentication/Cookies/samples/CookieSessionSample/CookieSessionSample.csproj | Removes EnvironmentVariables reference. |
| src/Security/Authentication/Cookies/samples/CookieSample/CookieSample.csproj | Removes Hosting reference. |
| src/OpenApi/test/Microsoft.AspNetCore.OpenApi.Tests/Microsoft.AspNetCore.OpenApi.Tests.csproj | Removes DependencyModel reference. |
| src/OpenApi/test/Microsoft.AspNetCore.OpenApi.SourceGenerators.Tests/Microsoft.AspNetCore.OpenApi.SourceGenerators.Tests.csproj | Disables transitive pinning. |
| src/OpenApi/sample/Sample.csproj | Removes Hosting reference. |
| src/OpenApi/gen/Microsoft.AspNetCore.OpenApi.SourceGenerators.csproj | Disables transitive pinning. |
| src/Mvc/test/WebSites/SimpleWebSiteWithWebApplicationBuilderException/SimpleWebSiteWithWebApplicationBuilderException.csproj | Removes Hosting reference. |
| src/Mvc/test/WebSites/SimpleWebSiteWithWebApplicationBuilder/SimpleWebSiteWithWebApplicationBuilder.csproj | Removes Hosting reference. |
| src/Mvc/test/WebSites/FilesWebSite/FilesWebSite.csproj | Removes Configuration reference. |
| src/Mvc/test/WebSites/ErrorPageMiddlewareWebSite/ErrorPageMiddlewareWebSite.csproj | Removes Configuration reference. |
| src/Mvc/test/WebSites/BasicWebSite/BasicWebSite.csproj | Removes Hosting reference. |
| src/Mvc/test/Mvc.FunctionalTests/Microsoft.AspNetCore.Mvc.FunctionalTests.csproj | Removes DependencyModel and Hosting references. |
| src/Mvc/Mvc/src/Microsoft.AspNetCore.Mvc.csproj | Removes caching and dependency-injection references. |
| src/Mvc/Mvc.Localization/src/Microsoft.AspNetCore.Mvc.Localization.csproj | Removes dependency-injection reference. |
| src/Mvc/Mvc.Analyzers/test/Mvc.Analyzers.Test.csproj | Removes Workspaces reference. |
| src/Mvc/Mvc.Analyzers/src/Microsoft.AspNetCore.Mvc.Analyzers.csproj | Disables transitive pinning. |
| src/Middleware/WebSockets/test/ConformanceTests/Microsoft.AspNetCore.WebSockets.ConformanceTests.csproj | Removes logging references. |
| src/Middleware/Spa/SpaServices.Extensions/test/Microsoft.AspNetCore.SpaServices.Extensions.Tests.csproj | Removes Hosting reference. |
| src/Middleware/Session/samples/SessionSample.csproj | Removes UserSecrets reference. |
| src/Middleware/ResponseCaching/samples/ResponseCachingSample/ResponseCachingSample.csproj | Removes Caching.Memory reference. |
| src/Middleware/RateLimiting/samples/RateLimitingSample/RateLimitingSample.csproj | Removes Hosting reference. |
| src/Middleware/OutputCaching/samples/OutputCachingSample/OutputCachingSample.csproj | Removes Hosting reference. |
| src/Middleware/MiddlewareAnalysis/test/Microsoft.AspNetCore.MiddlewareAnalysis.Tests.csproj | Removes dependency-injection reference. |
| src/Middleware/Microsoft.AspNetCore.OutputCaching.StackExchangeRedis/test/Microsoft.AspNetCore.OutputCaching.StackExchangeRedis.Tests.csproj | Removes Hosting reference. |
| src/Middleware/Localization/test/UnitTests/Microsoft.AspNetCore.Localization.Tests.csproj | Removes dependency-injection and Logging references. |
| src/Middleware/Localization/test/FunctionalTests/Microsoft.AspNetCore.Localization.FunctionalTests.csproj | Removes logging references. |
| src/Middleware/HeaderPropagation/src/Microsoft.AspNetCore.HeaderPropagation.csproj | Removes dependency-injection reference. |
| src/Middleware/Diagnostics/test/UnitTests/Microsoft.AspNetCore.Diagnostics.Tests.csproj | Removes dependency-injection reference. |
| src/Localization/Localization/test/Microsoft.Extensions.Localization.Tests/Microsoft.Extensions.Localization.Tests.csproj | Removes dependency-injection, Logging, and Primitives references. |
| src/Identity/testassets/Identity.DefaultUI.WebSite/Identity.DefaultUI.WebSite.csproj | Removes configuration and logging references. |
| src/Identity/test/Identity.Test/Microsoft.AspNetCore.Identity.Test.csproj | Removes Options.ConfigurationExtensions reference. |
| src/Identity/test/Identity.FunctionalTests/Microsoft.AspNetCore.Identity.FunctionalTests.csproj | Removes Sqlite, DependencyModel, and Hosting references. |
| src/Identity/Specification.Tests/src/Microsoft.AspNetCore.Identity.Specification.Tests.csproj | Removes Configuration reference. |
| src/Identity/samples/IdentitySample.Mvc/IdentitySample.Mvc.csproj | Removes logging-provider references. |
| src/Identity/samples/IdentitySample.DefaultUI/IdentitySample.DefaultUI.csproj | Removes logging-provider references. |
| src/Identity/Extensions.Stores/src/Microsoft.Extensions.Identity.Stores.csproj | Removes Logging reference. |
| src/HttpClientFactory/Polly/test/Microsoft.Extensions.Http.Polly.Tests.csproj | Removes logging, Options, and Primitives references. |
| src/Http/samples/MinimalValidationSample/MinimalValidationSample.csproj | Removes Hosting reference. |
| src/Http/samples/MinimalSampleOwin/MinimalSampleOwin.csproj | Removes Hosting reference. |
| src/Http/samples/MinimalSampleFSharp/MinimalSampleFSharp.fsproj | Removes Hosting reference. |
| src/Http/samples/MinimalSample/MinimalSample.csproj | Removes Hosting reference. |
| src/Http/Routing/test/UnitTests/Microsoft.AspNetCore.Routing.Tests.csproj | Removes Hosting reference. |
| src/Http/Routing/perf/Microbenchmarks/Microsoft.AspNetCore.Routing.Microbenchmarks.csproj | Removes Diagnostics reference. |
| src/Http/Http/perf/Microbenchmarks/Microsoft.AspNetCore.Http.Microbenchmarks.csproj | Disables transitive pinning. |
| src/Http/Http.Results/test/Microsoft.AspNetCore.Http.Results.Tests.csproj | Removes Hosting reference. |
| src/Http/Http.Extensions/test/Microsoft.AspNetCore.Http.Extensions.Tests.csproj | Disables pinning; removes Hosting reference. |
| src/Http/Http.Extensions/gen/Microsoft.AspNetCore.Http.RequestDelegateGenerator/Microsoft.AspNetCore.Http.RequestDelegateGenerator.csproj | Disables transitive pinning. |
| src/Http/Http.Abstractions/test/Microsoft.AspNetCore.Http.Abstractions.Tests.csproj | Removes Hosting reference. |
| src/Hosting/WindowsServices/test/Microsoft.AspNetCore.Hosting.WindowsServices.Tests.csproj | Removes Hosting reference. |
| src/Hosting/Server.IntegrationTesting/src/Microsoft.AspNetCore.Server.IntegrationTesting.csproj | Removes logging and Serilog references. |
| src/HealthChecks/HealthChecks/test/Microsoft.Extensions.Diagnostics.HealthChecks.Tests.csproj | Removes Primitives reference. |
| src/DefaultBuilder/src/Microsoft.AspNetCore.csproj | Removes FileExtensions and Composite references. |
| src/Configuration.KeyPerFile/test/Microsoft.Extensions.Configuration.KeyPerFile.Tests.csproj | Removes Physical file-provider reference. |
| src/Components/WebAssembly/WebAssembly/src/Microsoft.AspNetCore.Components.WebAssembly.csproj | Removes Configuration.Binder reference. |
| src/Components/WebAssembly/testassets/Wasm.Prerendered.Server/Wasm.Prerendered.Server.csproj | Removes dependency-injection reference. |
| src/Components/WebAssembly/Server/test/Microsoft.AspNetCore.Components.WebAssembly.Server.Tests.csproj | Removes Hosting reference. |
| src/Components/Testing/testassets/TestApp/TestApp.csproj | Removes Hosting reference. |
| src/Components/Testing/testassets/NativeAotTestApp/NativeAotTestApp.csproj | Removes Hosting reference. |
| src/Components/Testing/src/Microsoft.AspNetCore.Components.Testing.csproj | Removes Hosting reference. |
| src/Components/Server/src/Microsoft.AspNetCore.Components.Server.csproj | Removes Logging reference. |
| src/Components/Samples/BlazorWebAppPerPage/BlazorWebAppPerPage.csproj | Removes caching, Hosting, and Logging references. |
| src/Components/Samples/BlazorWebAppGlobal/BlazorWebAppGlobal.csproj | Removes caching, Hosting, and Logging references. |
| src/Components/Endpoints/test/Microsoft.AspNetCore.Components.Endpoints.Tests.csproj | Removes Hosting reference. |
| src/Components/Analyzers/test/Microsoft.AspNetCore.Components.Analyzers.Tests.csproj | Removes Workspaces reference. |
| src/Components/Analyzers/src/Microsoft.AspNetCore.Components.Analyzers.csproj | Disables transitive pinning. |
| src/Components/AI/testassets/DojoClient/DojoClient.csproj | Removes Hosting reference. |
| src/Components/AI/testassets/AGUIDojoApi/AGUIDojoApi.csproj | Removes Hosting reference. |
| src/Analyzers/Microsoft.AspNetCore.Analyzer.Testing/src/Microsoft.AspNetCore.Analyzer.Testing.csproj | Removes Reflection.Metadata reference. |
| src/Analyzers/Analyzers/test/Microsoft.AspNetCore.Analyzers.Test.csproj | Removes Workspaces reference. |
| src/Analyzers/Analyzers/src/Microsoft.AspNetCore.Analyzers.csproj | Disables transitive pinning. |
| eng/Versions.props | Updates five central versions. |
| Directory.Packages.props | Enables central transitive pinning. |
| Directory.Build.props | Suppresses three xUnit diagnostics. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Allow the transitive System.Management dependency to select its required System.CodeDom version instead of retaining a stale central dependency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
|
Have you smoke tested a couple of the updated sample projects? Or is this not similar to when we needed to add top-level references for every transitive dependency 😆 |
BrennanConroy
approved these changes
Oct 7, 2026
Member
Author
I built all of them locally without issue (and without any changes to the produced assets.jsons) just now, so we should be good. Thanks for calling that out |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enables central package transitive pinning and removes 130 redundant PackageReferences. Aligns four central versions with current transitive requirements, leaves System.CodeDom unpinned, opts Roslyn VersionOverride projects out, and preserves the existing xUnit analyzer baseline. Validated with
./eng/build.sh --all --no-build-native --no-build-nodejs --no-build-java --no-build-installers --verbosity minimal(passed).