Update build/test dependencies

.github/workflows/build.yml

@@ -15,23 +15,19 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: recursive
         fetch-depth: 0 # GitVersioning needs deep clone
 
     - name: Set up dotnet
-      uses: actions/setup-dotnet@v2
+      uses: actions/setup-dotnet@v4
       with:
         dotnet-version: |
           6.0.x
-          7.0.x
+          8.0.x
 
-    - name: Find MSBuild
-      if: startsWith(matrix.os, 'windows')
-      uses: microsoft/[email protected]
-
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: ${{ env.NUGET_PACKAGES }}
         key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
@@ -51,12 +47,12 @@ jobs:
 
     - name: Upload Test Results
       if: failure()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: "TestResults-${{ matrix.os }}-${{ matrix.config }}"
         path: "TestResults-${{ matrix.os }}-${{ matrix.config }}"
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: matrix.config == 'Release' && startsWith(matrix.os, 'windows')
       with:
         name: packages

.github/workflows/publish.yml

@@ -11,7 +11,7 @@ jobs:
   publish:
     runs-on: windows-latest
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: packages
           name: packages

Directory.Build.props

@@ -7,6 +7,8 @@
     <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
     <PackageOutputPath>$(MSBuildThisFileDirectory)packages\$(Configuration)</PackageOutputPath>
     <EnablePackageValidation>true</EnablePackageValidation>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
   <PropertyGroup>
@@ -16,8 +18,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Nerdbank.GitVersioning" Version="3.6.133" PrivateAssets="all" />
-    <PackageReference Include="DotNet.ReproducibleBuilds" Version="1.1.1" PrivateAssets="All"/>
+    <PackageReference Include="Nerdbank.GitVersioning" PrivateAssets="all" />
+    <PackageReference Include="DotNet.ReproducibleBuilds" PrivateAssets="All"/>
   </ItemGroup>
 
   <ItemGroup>

Directory.Packages.props

@@ -0,0 +1,28 @@
+<Project>
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.7.0" />
+    <PackageVersion Include="Microsoft.Build.Locator" Version="1.7.8" />
+    <PackageVersion Include="Microsoft.Build" Version="17.3.2" />
+    <PackageVersion Include="Microsoft.Build.Framework" Version="17.3.2" />
+    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.3.2" />
+    <PackageVersion Include="System.Reflection.MetadataLoadContext" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
+    <PackageVersion Include="xunit" Version="2.9.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.146" />
+    <PackageVersion Include="DotNet.ReproducibleBuilds" Version="1.2.25" />
+    <PackageVersion Include="MessagePackAnalyzer" Version="2.5.192" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
+    <!-- limit to 6.0 so that the MSBuild task can load on .NET 6.0 -->
+    <PackageVersion Include="System.CodeDom" Version="6.0.0" />
+    <!--
+    Microsoft.NET.Test.Sdk brings in a version of NuGet.Frameworks that's older than the one used by MSBuild
+    and loads first, thereby breaking loading of MSBuild assemblies. Force-upgrade it.
+    -->
+    <PackageVersion Include="NuGet.Frameworks" Version="6.12.1" />
+    <!-- upgrade vulnerable transitive deps  -->
+    <PackageVersion Include="System.Text.Json" Version="9.0.0" />
+    <PackageVersion Include="System.Drawing.Common" Version="9.0.0" />
+
+  </ItemGroup>
+</Project>

Mono.TextTemplating.Build.Tests/MSBuildTestContext.cs

@@ -29,8 +29,10 @@ public MSBuildTestContext ([CallerMemberName] string testName = null, bool creat
 
 			var globalProps = new Dictionary<string, string> {
 				{ "ImportDirectoryBuildProps", "false" },
+				{ "ImportDirectoryBuildTargets", "false" },
 				{ "TemplatingTargetsPath", buildTargetsProjectDir },
-				{ "TextTransformTaskAssembly", buildTasksPath }
+				{ "TextTransformTaskAssembly", buildTasksPath },
+				{ "ManagePackageVersionsCentrally", "false" }
 			};
 
 			Engine = new ProjectCollection (globalProps);

Mono.TextTemplating.Build.Tests/Mono.TextTemplating.Build.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net6.0;net7.0</TargetFrameworks>
+    <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
     <TargetFrameworks Condition="$([MSBuild]::IsOSPlatform('Windows'))">net48;$(TargetFrameworks)</TargetFrameworks>
     <IsPackable>false</IsPackable>
     <DefaultItemExcludes>$(DefaultItemExcludes);TestCases\**</DefaultItemExcludes>
@@ -11,23 +11,17 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build.Locator" Version="1.6.10" />
-    <PackageReference Include="Microsoft.Build" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="Microsoft.Build.Framework" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="System.Reflection.MetadataLoadContext" Version="7.0.0" />
-    <!--
-    Microsoft.NET.Test.Sdk brings in a version of NuGet.Frameworks that's older than the one used by MSBuild
-    and loads first, thereby breaking loading of MSBuild assemblies. Force-upgrade it.
-    -->
-    <PackageReference Include="NuGet.Frameworks" Version="6.9.1" />
-    <PackageReference Include="System.Text.Json" Version="7.0.3" />
+    <PackageReference Include="Microsoft.Build.Locator" />
+    <PackageReference Include="Microsoft.Build" ExcludeAssets="runtime" />
+    <PackageReference Include="Microsoft.Build.Framework" ExcludeAssets="runtime" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" ExcludeAssets="runtime" />
+    <PackageReference Include="System.Reflection.MetadataLoadContext" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
-    <PackageReference Include="xunit" Version="2.5.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>
 
   <ItemGroup>

Mono.TextTemplating.Build/Mono.TextTemplating.Build.csproj

@@ -33,11 +33,11 @@
   <ItemGroup>
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <ProjectReference Include="..\Mono.TextTemplating\Mono.TextTemplating.csproj" PrivateAssets="all" />
-    <PackageReference Include="MessagePackAnalyzer" Version="2.5.129" PrivateAssets="all" />
-    <PackageReference Include="MessagePack" Version="2.5.129" PrivateAssets="all" />
+    <PackageReference Include="MessagePackAnalyzer" PrivateAssets="all" />
+    <PackageReference Include="MessagePack" PrivateAssets="all" />
     <!-- intentionally downlevel these so they can be loaded in older VS versions -->
-    <PackageReference Include="Microsoft.Build.Framework" Version="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
-    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
+    <PackageReference Include="Microsoft.Build.Framework" VersionOverride="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" VersionOverride="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
   </ItemGroup>
 
   <!-- https://github.com/dotnet/msbuild/issues/4751-->

Mono.TextTemplating.Roslyn/Mono.TextTemplating.Roslyn.csproj

@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.7.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <ProjectReference Include="..\Mono.TextTemplating\Mono.TextTemplating.csproj" />
   </ItemGroup>

Mono.TextTemplating.Tests/Mono.TextTemplating.Tests.csproj

@@ -13,9 +13,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
-    <PackageReference Include="xunit" Version="2.5.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>
 
   <ItemGroup>

Mono.TextTemplating/Mono.TextTemplating.csproj

@@ -2,7 +2,7 @@
   <PropertyGroup>
     <TargetFrameworks>netstandard2.0;net6.0;net472</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <NoWarn>1591;1573</NoWarn>
+    <NoWarn>$(NoWarn);1591;1573</NoWarn>
     <TFxId>$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)'))</TFxId>
     <DefineConstants Condition="'$(TFxId)'=='.NETFramework'">$(DefineConstants);FEATURE_APPDOMAINS</DefineConstants>
     <DefineConstants Condition="'$(TFxId)'=='.NETCoreApp'">$(DefineConstants);FEATURE_ASSEMBLY_LOAD_CONTEXT</DefineConstants>
@@ -21,8 +21,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <!-- limit to 6.0 so that the MSBuild task can load on .NET 6.0 -->
-    <PackageReference Include="System.CodeDom" Version="6.0.0" Condition="'$(TargetFramework)'!='net472'" />
+    <PackageReference Include="System.CodeDom" Condition="'$(TargetFramework)'!='net472'" />
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <None Include="package\Mono.TextTemplating.targets" Pack="true" PackagePath="buildTransitive\Mono.TextTemplating.targets" />
   </ItemGroup>

TextTransform/TextTransform.csproj

@@ -3,7 +3,7 @@
     <TargetFramework>net472</TargetFramework>
     <OutputType>Exe</OutputType>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <NoWarn>1591;1573</NoWarn>
+    <NoWarn>$(NoWarn);1591;1573</NoWarn>
     <PackageId>Mono.TextTemplating.Console</PackageId>
     <IsTool>True</IsTool>
     <Description>Command-line T4 text transform tool.</Description>