Update Dependencies and Net Targets (#678)

* Update Dependencies and Net Targets

* Update Changelog.md

Author: gfs

Changelog.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.52] - 2024-12-09
+## Dependencies
+Updates Dependencies
+
+## .Net Targets
+CLI now targets .NET 8.0 and .NET 9.0, .NET 6.0/7.0 targeting removed. DevSkim Library component retains .Net Standard 2.1 support.
+
 ## [1.0.51] - 2024-12-09
 ## Fix
 Fix confidence filtering at rule level.

DevSkim-DotNet/Microsoft.DevSkim.CLI/Microsoft.DevSkim.CLI.csproj

@@ -2,7 +2,7 @@
 
 <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFrameworks>net6.0;net7.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net9.0</TargetFrameworks>
     <AssemblyName>devskim</AssemblyName>
     <StartupObject>Microsoft.DevSkim.CLI.Program</StartupObject>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
@@ -36,10 +36,13 @@
 
     <ItemGroup>
       <PackageReference Include="CommandLineParser" Version="2.9.1" />
-      <PackageReference Include="LibGit2Sharp" Version="0.29.0" />
-      <PackageReference Include="Microsoft.CST.ApplicationInspector.Logging" Version="1.9.19" />
+      <PackageReference Include="LibGit2Sharp" Version="0.31.0" />
+      <PackageReference Include="Microsoft.CST.ApplicationInspector.Logging" Version="1.9.32" />
       <PackageReference Include="Microsoft.Extensions.CommandLineUtils" Version="1.1.1" />
-      <PackageReference Include="Sarif.Sdk" Version="4.5.3" />
+      <PackageReference Include="Sarif.Sdk" Version="4.5.4" />
+      <PackageReference Update="Nerdbank.GitVersioning">
+        <Version>3.7.115</Version>
+      </PackageReference>
     </ItemGroup>
 
 </Project>

DevSkim-DotNet/Microsoft.DevSkim.LanguageProtoInterop/Microsoft.DevSkim.LanguageProtoInterop.csproj

@@ -8,6 +8,9 @@
 
 <ItemGroup>
 	<PackageReference Include="OmniSharp.Extensions.LanguageServer" Version="0.19.9" />
+	<PackageReference Update="Nerdbank.GitVersioning">
+	  <Version>3.7.115</Version>
+	</PackageReference>
 </ItemGroup>
 
 </Project>

DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/Microsoft.DevSkim.LanguageServer.csproj

@@ -5,19 +5,22 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <RootNamespace>DevSkim.LanguageServer</RootNamespace>
-    <TargetFrameworks>net6.0;net7.0;net8.0</TargetFrameworks>
+    <TargetFramework>net8.0</TargetFramework>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
     <Authors>Microsoft</Authors>
     <copyright>© Microsoft Corporation. All rights reserved.</copyright> 
   </PropertyGroup>
 
   <ItemGroup>
     <PackageReference Include="CommandLineParser" Version="2.9.1" />
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging" Version="9.0.1" />
     <PackageReference Include="OmniSharp.Extensions.LanguageServer" Version="0.19.9" />
-    <PackageReference Include="Serilog.Extensions.Logging" Version="8.0.0" />
-    <PackageReference Include="Serilog.Sinks.Debug" Version="2.0.0" />
-    <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />
+    <PackageReference Include="Serilog.Extensions.Logging" Version="9.0.0" />
+    <PackageReference Include="Serilog.Sinks.Debug" Version="3.0.0" />
+    <PackageReference Include="Serilog.Sinks.File" Version="6.0.0" />
+    <PackageReference Update="Nerdbank.GitVersioning">
+      <Version>3.7.115</Version>
+    </PackageReference>
   </ItemGroup>
 
   <ItemGroup>

DevSkim-DotNet/Microsoft.DevSkim.Tests/Microsoft.DevSkim.Tests.csproj

@@ -1,17 +1,17 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFrameworks>net6.0;net7.0;net8.0</TargetFrameworks>
+        <TargetFrameworks>net8.0;net9.0</TargetFrameworks>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
 
         <IsPackable>false</IsPackable>
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
-        <PackageReference Include="MSTest.TestAdapter" Version="3.2.2" />
-        <PackageReference Include="MSTest.TestFramework" Version="3.2.2" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+        <PackageReference Include="MSTest.TestAdapter" Version="3.7.3" />
+        <PackageReference Include="MSTest.TestFramework" Version="3.7.3" />
     </ItemGroup>
 
     <ItemGroup>

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio.SourceGenerator/Microsoft.DevSkim.VisualStudio.SourceGenerator.csproj

@@ -13,7 +13,7 @@
     </ItemGroup>
 
     <ItemGroup>
-      <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.8.0" />
+      <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.12.0" />
     </ItemGroup>
 
 </Project>

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/Microsoft.DevSkim.VisualStudio.csproj

@@ -85,17 +85,17 @@
     </None>
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
     <PackageReference Include="Microsoft.VisualStudio.LanguageServer.Client">
-      <Version>17.9.46</Version>
+      <Version>17.12.48</Version>
     </PackageReference>
     <PackageReference Include="Microsoft.VisualStudio.LanguageServer.Protocol">
       <Version>17.2.8</Version>
     </PackageReference>
-    <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.9.37000" ExcludeAssets="runtime">
+    <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.12.40392" ExcludeAssets="runtime">
       <IncludeAssets>compile; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.VSSDK.BuildTools" Version="17.9.3168">
+    <PackageReference Include="Microsoft.VSSDK.BuildTools" Version="17.12.2069">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

DevSkim-DotNet/Microsoft.DevSkim/Microsoft.DevSkim.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>netstandard2.1;net6.0;net7.0;net8.0</TargetFrameworks>    
+    <TargetFrameworks>netstandard2.1;net8.0;net9.0</TargetFrameworks>    
     <PackageId>Microsoft.CST.DevSkim</PackageId>
     <PackageVersion>0.0.0</PackageVersion>
     <PackageTags>Security Linter</PackageTags>
@@ -24,8 +24,11 @@
   </ItemGroup>
 
     <ItemGroup>
-      <PackageReference Include="Microsoft.CST.ApplicationInspector.RulesEngine" Version="1.9.19" />
+      <PackageReference Include="Microsoft.CST.ApplicationInspector.RulesEngine" Version="1.9.32" />
       <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+      <PackageReference Update="Nerdbank.GitVersioning">
+        <Version>3.7.115</Version>
+      </PackageReference>
     </ItemGroup>
 
     <ItemGroup>

DevSkim-VSCode-Plugin/package-lock.json

@@ -2,7 +2,7 @@
 <Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup>
     <PackageReference Include="Nerdbank.GitVersioning">
-      <Version>3.6.133</Version>
+      <Version>3.7.115</Version>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
   </ItemGroup>

Directory.Build.props

@@ -13,15 +13,15 @@ resources:
     - repository: templates
       type: git
       name: SecurityEngineering/OSS-Tools-Pipeline-Templates
-      ref: refs/tags/v2.0.0
+      ref: refs/tags/v2.0.1
     - repository: 1esPipelines
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
       ref: refs/tags/release
 
 variables:
   BuildConfiguration: 'Release'
-  DotnetVersion: '8.0.x'
+  DotnetVersion: '9.0.x'
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
@@ -36,15 +36,15 @@ extends:
       - template: dotnet-test-job.yml@templates
         parameters:
           jobName: 'dotnet_test_windows'
-          dotnetVersions: ['6.0.x','7.0.x','8.0.x']
+          dotnetVersions: ['8.0.x','9.0.x']
           projectPath: 'DevSkim-DotNet/Microsoft.DevSkim.Tests/Microsoft.DevSkim.Tests.csproj'
           poolName: MSSecurity-1ES-Build-Agents-Pool
           poolImage: MSSecurity-1ES-Windows-2022
           poolOs: windows
       - template: dotnet-test-job.yml@templates
         parameters:
           jobName: 'dotnet_test_ubuntu'
-          dotnetVersions: ['6.0.x','7.0.x','8.0.x']
+          dotnetVersions: ['8.0.x','9.0.x']
           poolName: MSSecurity-1ES-Build-Agents-Pool
           poolImage: MSSecurity-1ES-Ubuntu-2204
           poolOs: linux

Pipelines/cli/devskim-cli-pr.yml

@@ -7,15 +7,15 @@ resources:
     - repository: templates
       type: git
       name: Data/OSS-Tools-Pipeline-Templates
-      ref: refs/tags/v2.0.0
+      ref: refs/tags/v2.0.1
     - repository: 1esPipelines
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
       ref: refs/tags/release
 
 variables:
   BuildConfiguration: 'Release'
-  DotnetVersion: '8.0.x'
+  DotnetVersion: '9.0.x'
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
@@ -35,15 +35,15 @@ extends:
       - template: dotnet-test-job.yml@templates
         parameters:
           jobName: 'dotnet_test_windows'
-          dotnetVersions: ['6.0.x','7.0.x','8.0.x']
+          dotnetVersions: ['8.0.x','9.0.x']
           projectPath: 'DevSkim-DotNet/Microsoft.DevSkim.Tests/Microsoft.DevSkim.Tests.csproj'
           poolName: MSSecurity-1ES-Build-Agents-Pool
           poolImage: MSSecurity-1ES-Windows-2022
           poolOs: windows
       - template: dotnet-test-job.yml@templates
         parameters:
           jobName: 'dotnet_test_ubuntu'
-          dotnetVersions: ['6.0.x','7.0.x','8.0.x']
+          dotnetVersions: ['8.0.x','9.0.x']
           poolName: MSSecurity-1ES-Build-Agents-Pool
           poolImage: MSSecurity-1ES-Ubuntu-2204
           poolOs: linux

Pipelines/cli/devskim-cli-release.yml

@@ -13,7 +13,7 @@ resources:
     - repository: templates
       type: git
       name: SecurityEngineering/OSS-Tools-Pipeline-Templates
-      ref: refs/tags/v2.0.0
+      ref: refs/tags/v2.0.1
     - repository: 1esPipelines
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
@@ -46,14 +46,11 @@ extends:
           extraArtifactLocation: 'extension'
           preBuild:
           - template: nbgv-set-version-steps.yml@templates
-          # Workaround: Using the .NET 8 SDK doesn't install the right version of MSBuild for .NET 8
-          #   Using the .NET 7 SDK doesn't include the .NET 8 SDK so it can't build the project
-          #   Install both for now until the right version of MSBuild is included with .NET 8
           - task: UseDotNet@2
-            displayName: Install Dotnet 7 SDK
+            displayName: Install Dotnet 9 SDK
             inputs:
               packageType: 'sdk'
-              version: '7.0.x'
+              version: '9.0.x'
           onEnd:
           - task: PowerShell@2
             displayName: Mkdir for Extension

Pipelines/vs/devskim-visualstudio-pr.yml

@@ -7,7 +7,7 @@ resources:
     - repository: templates
       type: git
       name: Data/OSS-Tools-Pipeline-Templates
-      ref: refs/tags/v2.0.0
+      ref: refs/tags/v2.0.1
     - repository: 1esPipelines
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
@@ -45,14 +45,11 @@ extends:
           extraArtifactLocation: 'extension'
           preBuild:
           - template: nbgv-set-version-steps.yml@templates
-          # Workaround: Using the .NET 8 SDK doesn't install the right version of MSBuild for .NET 8
-          #   Using the .NET 7 SDK doesn't include the .NET 8 SDK so it can't build the project
-          #   Install both for now until the right version of MSBuild is included with .NET 8
           - task: UseDotNet@2
-            displayName: Install Dotnet 7 SDK
+            displayName: Install Dotnet 9 SDK
             inputs:
               packageType: 'sdk'
-              version: '7.0.x'
+              version: '9.0.x'
           onEnd:
           - task: PowerShell@2
             displayName: Mkdir for Extension

Pipelines/vs/devskim-visualstudio-release.yml

@@ -43,6 +43,11 @@ extends:
           inputs:
             packageType: 'sdk'
             version: '8.0.x'
+        - task: UseDotNet@2
+          displayName: Install Dotnet SDK
+          inputs:
+            packageType: 'sdk'
+            version: '9.0.x'
         - task: Npm@1
           displayName: Build VS Code Plugin
           inputs:

Pipelines/vscode/devskim-vscode-pr.yml

@@ -7,7 +7,7 @@ resources:
     - repository: templates
       type: git
       name: Data/OSS-Tools-Pipeline-Templates
-      ref: refs/tags/v2.0.0
+      ref: refs/tags/v2.0.1
     - repository: 1esPipelines
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
@@ -42,6 +42,11 @@ extends:
           inputs:
             packageType: 'sdk'
             version: '8.0.x'
+        - task: UseDotNet@2
+          displayName: Install Dotnet SDK
+          inputs:
+            packageType: 'sdk'
+            version: '9.0.x'
         - task: Npm@1
           displayName: Build VS Code Plugin
           inputs: