Adopt full dependency group + raise .NET Framework floor to net481 (release 5.5.0)#3120
Merged
Merged
Conversation
Dependabot group PR #3119 failed CI: the Microsoft.Extensions.Logging.ApplicationInsights 2.20.0 -> 2.23.0 bump marks the InstrumentationKey-based AddApplicationInsights overload [Obsolete], and Release builds treat warnings as errors, so ServiceProviderFactory could no longer compile (this also failed the npm publish job). Migrate ServiceProviderFactory to the non-obsolete AddApplicationInsights overload that accepts an Action<TelemetryConfiguration>: prefer an explicit connection string, and express a legacy instrumentation key as one so both configuration shapes route to the same ingestion. Update the sample appsettings.json to model ConnectionString. Adopt 19 of the 22 group bumps (all green under warnings-as-errors, WorkItems tests pass on net8.0 and net48). Hold four bumps that drag the modern System.* 9.x graph (Microsoft.Bcl.HashCode 6.0) or drop net461 support, which the repo's legacy target frameworks cannot absorb without a net461 -> net462+ migration: - Microsoft.Diagnostics.Tracing.TraceEvent 3.2.4 - System.Collections.Immutable 9.0.8 - System.Reflection.Metadata 9.0.8 - System.Data.SqlClient 4.9.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…lease 5.5.0 Retarget the in-solution .NET Framework projects (net461/net462/net48/net472) to net481 so the four previously-held bumps in the minor-and-patch group can be adopted, completing the takeover of Dependabot group #3119 (all 22 packages). net481 is the highest targetable .NET Framework TFM; 4.8.2 is a runtime servicing update with no distinct TFM or reference-assembly package, and code built for net481 runs on a 4.8.2 runtime. This satisfies the Microsoft-internal 4.8.2 runtime floor while remaining buildable. Held bumps now adopted: Microsoft.Diagnostics.Tracing.TraceEvent 3.2.4, System.Collections.Immutable 9.0.8, System.Reflection.Metadata 9.0.8, System.Data.SqlClient 4.9.1. The newer System.* (9.x) packages pull facade assemblies that forward System.Net.Http / System.IO.Compression types and displace the built-in framework references, and CsvHelper drags in an older Microsoft.Bcl.HashCode. Reference the framework facades explicitly and pin Microsoft.Bcl.HashCode 6.0.0 centrally in build.props for .NETFramework targets so the assembly graph unifies. Also update the packaging framework lists (scripts/Projects.psm1) and the Multitool nuspec Publish/Signing folder references from net462 to net481. The net481 floor drops support for consumers on .NET Framework < 4.8.1, a breaking change; bump the release to 5.5.0 and record the BRK in ReleaseHistory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 1, 2026
Microsoft.Json.Schema.Validation 2.3.0 tightens format: uri enforcement, which surfaces that several SARIF Uri properties (ToolComponent.DownloadUri / InformationUri, TranslationMetadata's) lack a [JsonConverter(typeof(UriConverter))] attribute and therefore serialize a raw OriginalString rather than a percent-encoded URI. This is a genuine latent gap that warrants its own focused change (take 2.3.0 + add the missing converter attributes), so hold Microsoft.Json.Pointer / Schema / Schema.Validation at 2.1.0 for this release and keep the remaining dependency-group bumps and the net481 floor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts the Dependabot minor-and-patch dependency group and raises the .NET Framework build floor to
net481. Releases v5.5.0.Changes
net481across the 10 in-solution .NET Framework projects, the packaging framework lists (scripts/Projects.psm1), and the MultitoolnuspecPublish/Signing folder references.Microsoft.Diagnostics.Tracing.TraceEvent3.2.4,System.Collections.ImmutableandSystem.Reflection.Metadata9.0.8, andSystem.Data.SqlClient4.9.1.Microsoft.Json.Pointer/Schema/Schema.Validationheld at 2.1.0 (see Adopt Microsoft.Json.* 2.3.0 and add missing UriConverter attributes to Uri properties #3121).ServiceProviderFactoryconfigures Application Insights via connection string instead of the obsolete instrumentation-key overload.src/build.props: explicitSystem.Net.Http/System.IO.Compressionfacade references and aMicrosoft.Bcl.HashCode6.0.0 pin.BRKReleaseHistory entry for the floor increase;VersionPrefixbumped.Closes #3119. Supersedes #3109.