Prepare dependencies for .NET 10 (net8-safe subset) - #2095
Draft
NickJosevski wants to merge 6 commits into
Draft
Conversation
Contributor
Appreciate the shade 🤖 |
APErebus
reviewed
Aug 4, 2026
| /// whatever newer runtime is present, so C# script steps don't additionally require the exact | ||
| /// runtime dotnet-script was built against. | ||
| /// </summary> | ||
| static Dictionary<string, string> WithDotnetRollForward(Dictionary<string, string>? environmentVars) |
Contributor
There was a problem hiding this comment.
DotNet script requires the dotnet sdk, not just the dotnet runtime, does this work for that?
APErebus
reviewed
Aug 4, 2026
| <PackageReference Include="System.ValueTuple" Version="4.5.0" /> | ||
| <PackageReference Include="Autofac" Version="4.8.0" /> | ||
| <PackageReference Include="System.ComponentModel.TypeConverter" Version="4.3.0" /> | ||
| <PackageReference Include="Autofac" Version="9.3.1" /> |
Contributor
There was a problem hiding this comment.
this seems like a huge bump... Probably need some integration testing to make sure it's all on the up and up
NickJosevski
marked this pull request as draft
August 4, 2026 06:55
zentron
reviewed
Aug 4, 2026
zentron
left a comment
zentron
left a comment
Contributor
There was a problem hiding this comment.
We need to be careful with this upgrade and confirm any breaking changes that will impact users utilizing dotnet-script.
Unfortunately in this new world the customer C# scripts will now run under whatever framework we are running Calamari itself under.
Not marked as Request Changes since this is just more a comment for caution.
The .NET 10 SDK raises NU1510 for direct references to packages the framework already provides. TreatWarningsAsErrors turns NU1510 into a build error. Removing the references now, on net8, keeps the change isolated from the framework move. Removed System.ValueTuple, System.ComponentModel.TypeConverter, System.Diagnostics.Tracing, System.IO.FileSystem, System.Runtime.InteropServices.RuntimeInformation, and the Microsoft.NETFramework.ReferenceAssemblies.net462 reference left over from #1669. System.Threading.AccessControl stays with NoWarn="NU1510". NuGet flags the package as likely unnecessary. That heuristic assumes a -windows target framework. These projects target plain net8.0 and need the package for SemaphoreSecurity. Verified: 164 warnings and 0 errors, identical to baseline. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Autofac 4.8.0 dates from 2018 and is five majors behind. Octopus Server already runs 9.3.1 on net10. Done while Calamari still targets net8. Autofac 9.3.1 resolves on net8. The DI upgrade is therefore verified against a known-good baseline instead of being entangled with the framework change. Notes for reviewers. ContainerBuilder.Update() is the headline Autofac 5 removal and was never used here. The .Update call sites in this repo belong to LibGit2Sharp. The API surface in use is mainstream and unchanged across the version range. The custom RegisterPrioritisedList<T> extension builds on Meta<T> and WithMetadata. Both APIs are stable. Verified: clean rebuild with no new warnings. 26 tests pass covering the custom registration ordering and flavour resolution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Continues the dependency work on net8 before the target framework changes. System.Linq.Async goes to 7.0.1. .NET 10 pulls System.Linq.AsyncEnumerable into the core libraries. 7.0.1 is the version Octopus Server runs against net10. Serilog collapses a three-way version spread onto 4.0.2. Microsoft.Extensions.Http and Microsoft.Extensions.Logging go to 10.0.10. System.Text.Json and System.Text.Encoding.CodePages are deliberately left alone. Both become framework-provided on net10. Both are still required on net8. Removing them now would downgrade System.Text.Json to the in-box 8.x version and lose security fixes. Verified: 165 warnings and 0 errors. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bundled dotnet-script 1.6.0 is a framework-dependent app targeting Microsoft.NETCore.App 8.0.0. Framework-dependent apps do not roll forward across a major version by default. On a machine with only .NET 10 installed dotnet-script fails to launch. Calamari itself is unaffected. Calamari ships self-contained. The failure is in the separate dotnet-script process. Setting DOTNET_ROLL_FORWARD=Major on that invocation lets dotnet-script run on whatever newer runtime is present. An explicit value already set in the environment is respected rather than overwritten. This is a customer-facing fix as much as a CI one. Without the fix a target with .NET 10 and no .NET 8 runtime cannot run C# script steps at all. SilentProcessRunner applies EnvironmentVars additively. Passing a dictionary where one was previously null does not discard the inherited environment. Not done here: upgrading the bundled dotnet-script. The 2.0.1 release zip Calamari vendors is still net8 targeted. Only the NuGet package ships a net10 build. The upgrade also changes the NuGet version dotnet-script bundles. The change invalidates the premise of UsingIsolatedAssemblyLoadContext. Verified: 10 DotnetScriptFixture tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Serilog.Extensions.Logging 8.0.0 targets Microsoft.Extensions.Logging 8.0.0. Leaving it behind after raising Microsoft.Extensions.Logging produces a version spread across the graph. Serilog.Extensions.Logging goes to 10.0.0 in Calamari.Testing. Serilog goes to 4.4.0 in Calamari.Testing, Calamari.ConsolidateCalamariPackages and Calamari.AzureWebApp.NetCoreShim. 4.4.0 is the minimum Serilog.Extensions.Logging 10.0.0 accepts. Split out of the original combined dependency commit. The vulnerability remediations in that commit are test-only and landed separately in #2094. These Serilog bumps touch Calamari.ConsolidateCalamariPackages. That project is packed and shipped. Verified: clean rebuild of source/Calamari.sln at 165 warnings and 0 errors on net8.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
NickJosevski
force-pushed
the
nj/deps-cve-test-tooling
branch
from
August 4, 2026 07:51
1b88535 to
e47255c
Compare
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 4, 2026 07:51
1af3547 to
1d13556
Compare
No code change. Kicks the TeamCity chain so we have a run to compare against once the agent starts installing the .NET 10 SDK. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
Calamari has to reach .NET 10 before .NET 8 support ends on 10 November 2026.
Every risky dependency bump is done while Calamari still targets net8. A green build on net8 proves each bump in isolation. The target framework flip then happens on a dependency graph that is already ready.
The net8 migration in #1528 landed dependency churn, build changes and the framework flip together. Attribution became impossible. Roughly 40 commits of un-attributable fixes followed.
Results
Extracts the net8-safe dependency work from #2091.
DOTNET_ROLL_FORWARD=Majoron the dotnet-script invocationThe sequencing paid off on Autofac. Five majors from 2018 to current produced zero new warnings and no code changes.
ContainerBuilder.Update()is the headline Autofac 5 removal and was never used here.The dotnet-script commit fixes a live customer bug
Worth calling out because the fix is not really about .NET 10.
Bundled dotnet-script 1.6.0 targets
Microsoft.NETCore.App 8.0.0. Framework-dependent apps do not roll forward across a major version by default. A customer whose target has only .NET 10 installed cannot run C# script steps at all. That failure exists today on net8.Calamari itself is unaffected. Calamari ships self-contained. The failure is in the separate dotnet-script process.
Reducing risk
source/Calamari.slnon net8.0 at 165 warnings and 0 errorsnj/net10-prep-depsapart frommain's advance. The split into Upgrade test dependencies carrying known vulnerabilities #2094 and this PR lost nothingDotnetScriptFixtureand the WireMock-backed fixtures pass 19 of 19CommandLocatortests pass 180 of 183. The 3 failures needpwsh.pwshis not installed on the dev machine. 52 of 64 tests in that suite fail identically onmainHow to review this PR
General quality.