build(deps): centralize NuGet package versions

.github/workflows/ci.yml

@@ -41,6 +41,7 @@ jobs:
               - 'src/PlanViewer.Web/**'
               - 'server/PlanShare/**'
               - 'src/Directory.Build.props'
+              - 'Directory.Packages.props'
               - 'tests/**'
               - 'PlanViewer.sln'
               - 'global.json'
@@ -52,7 +53,9 @@ jobs:
         with:
           dotnet-version: 10.0.x
           cache: true
-          cache-dependency-path: '**/*.csproj'
+          cache-dependency-path: |
+            **/*.csproj
+            Directory.Packages.props
 
       - name: Install WASM workload
         if: steps.filter.outputs.code == 'true'

.github/workflows/deploy-planshare.yml

@@ -8,6 +8,7 @@ on:
     branches: [main]
     paths:
       - 'server/PlanShare/**'
+      - 'Directory.Packages.props'
       - '.github/workflows/deploy-planshare.yml'
   workflow_dispatch:
 

.github/workflows/deploy-web.yml

@@ -7,6 +7,7 @@ on:
       - 'src/PlanViewer.Core/**'
       - 'src/PlanViewer.Web/**'
       - 'src/Directory.Build.props'
+      - 'Directory.Packages.props'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
 

Directory.Packages.props

@@ -0,0 +1,46 @@
+<Project>
+  <!-- NuGet package versions are managed centrally for src/, tests/, and server/. -->
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageVersion Include="Avalonia" Version="12.1.3" />
+    <PackageVersion Include="Avalonia.AvaloniaEdit" Version="12.0.0" />
+    <PackageVersion Include="Avalonia.Controls.DataGrid" Version="12.1.2" />
+    <PackageVersion Include="Avalonia.Desktop" Version="12.1.3" />
+    <PackageVersion Include="Avalonia.Fonts.Inter" Version="12.1.3" />
+    <PackageVersion Include="Avalonia.Headless" Version="12.1.3" />
+    <PackageVersion Include="Avalonia.Themes.Fluent" Version="12.1.3" />
+    <PackageVersion Include="AvaloniaEdit.TextMate" Version="12.0.0" />
+    <PackageVersion Include="BlackwellSystems.Gcf" Version="1.0.0" />
+    <PackageVersion Include="coverlet.collector" Version="10.1.0" />
+    <PackageVersion Include="Meziantou.Framework.Win32.CredentialManager" Version="3.0.4" />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.1.0" />
+    <PackageVersion Include="Microsoft.Data.SqlClient.Extensions.Azure" Version="7.1.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
+    <!-- The SDK manages this package implicitly for the installer; only the legacy
+         SSMS project has an explicit reference that needs a central version. -->
+    <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" Condition="'$(MSBuildProjectName)' == 'PlanViewer.Ssms'" />
+    <PackageVersion Include="Microsoft.SqlServer.TransactSql.ScriptDom" Version="180.117.0" />
+    <PackageVersion Include="Microsoft.Testing.Extensions.HangDump" Version="2.4.1" />
+    <PackageVersion Include="Microsoft.VisualStudio.SDK" Version="17.14.40265" />
+    <PackageVersion Include="Microsoft.VSSDK.BuildTools" Version="17.14.2142" />
+    <PackageVersion Include="ModelContextProtocol" Version="2.2.0" />
+    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
+    <PackageVersion Include="Repl" Version="0.11.0" />
+    <PackageVersion Include="Repl.Mcp" Version="0.11.0" />
+    <PackageVersion Include="Repl.Testing" Version="0.11.0" />
+    <PackageVersion Include="ScottPlot.Avalonia" Version="5.1.59" />
+    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
+    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
+    <PackageVersion Include="System.CommandLine" Version="2.0.12" />
+    <PackageVersion Include="TextMateSharp.Grammars" Version="2.0.4" />
+    <PackageVersion Include="Velopack" Version="1.2.0" />
+    <PackageVersion Include="xunit.v3" Version="4.0.1" />
+  </ItemGroup>
+</Project>

server/PlanShare/PlanShare.csproj

@@ -7,15 +7,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Data.Sqlite" />
     <!-- Direct ref pins the native SQLite on the current SQLitePCLRaw 3.x line.
          Originally added because Microsoft.Data.Sqlite floored SQLitePCLRaw at 2.1.11,
          whose bundled SQLite is vulnerable to CVE-2025-6965 (GHSA-2m69-gcr7-jv3q).
          As of Microsoft.Data.Sqlite 10.0.12 the floor is 2.1.12 (CVE-fixed), so this
          ref is no longer load-bearing for that CVE - kept because 3.x bundles a much
          newer SQLite (3.53.x vs 2.1.12's 3.50.x) and this is the runtime-verified
          configuration (full CRUD against the 3.x native layer). -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" />
   </ItemGroup>
 
   <!-- tests/PlanViewer.Core.Tests references this project so CI builds and tests the server -->

src/PlanViewer.App/PlanViewer.App.csproj

@@ -9,21 +9,21 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Avalonia" Version="12.1.3" />
-    <PackageReference Include="Avalonia.AvaloniaEdit" Version="12.0.0" />
-    <PackageReference Include="Avalonia.Controls.DataGrid" Version="12.1.2" />
-    <PackageReference Include="ScottPlot.Avalonia" Version="5.1.59" />
-    <PackageReference Include="Avalonia.Desktop" Version="12.1.3" />
-    <PackageReference Include="Avalonia.Themes.Fluent" Version="12.1.3" />
-    <PackageReference Include="Avalonia.Fonts.Inter" Version="12.1.3" />
-    <PackageReference Include="AvaloniaEdit.TextMate" Version="12.0.0" />
-    <PackageReference Include="BlackwellSystems.Gcf" Version="1.0.0" />
-    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="3.0.4" />
-    <PackageReference Include="ModelContextProtocol" Version="2.2.0" />
-    <PackageReference Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
-    <PackageReference Include="TextMateSharp.Grammars" Version="2.0.4" />
-    <PackageReference Include="Microsoft.SqlServer.TransactSql.ScriptDom" Version="180.117.0" />
-    <PackageReference Include="Velopack" Version="1.2.0" />
+    <PackageReference Include="Avalonia" />
+    <PackageReference Include="Avalonia.AvaloniaEdit" />
+    <PackageReference Include="Avalonia.Controls.DataGrid" />
+    <PackageReference Include="ScottPlot.Avalonia" />
+    <PackageReference Include="Avalonia.Desktop" />
+    <PackageReference Include="Avalonia.Themes.Fluent" />
+    <PackageReference Include="Avalonia.Fonts.Inter" />
+    <PackageReference Include="AvaloniaEdit.TextMate" />
+    <PackageReference Include="BlackwellSystems.Gcf" />
+    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" />
+    <PackageReference Include="ModelContextProtocol" />
+    <PackageReference Include="ModelContextProtocol.AspNetCore" />
+    <PackageReference Include="TextMateSharp.Grammars" />
+    <PackageReference Include="Microsoft.SqlServer.TransactSql.ScriptDom" />
+    <PackageReference Include="Velopack" />
 
     <!-- This pin is inert under Avalonia 12 and kept anyway. Avalonia.Skia 12.1.2 already
          requires SkiaSharp and SkiaSharp.NativeAssets.Linux 3.119.4 itself, so the pin no
@@ -37,7 +37,7 @@
          from the NoDependencies one, so the pairing with managed SkiaSharp 3.119.4 is
          intact. The pin stays because the underlying collision is unresolved and removing it
          is out of the scope of that migration, not because it prevents anything. -->
-    <PackageReference Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
+    <PackageReference Include="SkiaSharp.NativeAssets.Linux" />
   </ItemGroup>
 
   <ItemGroup>

src/PlanViewer.Cli/PlanViewer.Cli.csproj

@@ -18,9 +18,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Repl" Version="0.11.0" />
-    <PackageReference Include="Repl.Mcp" Version="0.11.0" />
-    <PackageReference Include="System.CommandLine" Version="2.0.12" />
+    <PackageReference Include="Repl" />
+    <PackageReference Include="Repl.Mcp" />
+    <PackageReference Include="System.CommandLine" />
   </ItemGroup>
 
 </Project>

src/PlanViewer.Core/PlanViewer.Core.csproj

@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.SqlClient" Version="7.1.0" />
-    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" Version="3.0.4" />
-    <PackageReference Include="Microsoft.Data.SqlClient.Extensions.Azure" Version="7.1.0" />
-    <PackageReference Include="Microsoft.SqlServer.TransactSql.ScriptDom" Version="180.117.0" />
+    <PackageReference Include="Microsoft.Data.SqlClient" />
+    <PackageReference Include="Meziantou.Framework.Win32.CredentialManager" />
+    <PackageReference Include="Microsoft.Data.SqlClient.Extensions.Azure" />
+    <PackageReference Include="Microsoft.SqlServer.TransactSql.ScriptDom" />
   </ItemGroup>
 
   <ItemGroup>

src/PlanViewer.Ssms/PlanViewer.Ssms.csproj

@@ -80,9 +80,9 @@
     <None Include="source.extension.vsixmanifest" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.14.40265" ExcludeAssets="runtime" />
-    <PackageReference Include="Microsoft.VSSDK.BuildTools" Version="17.14.2142" IncludeAssets="build;buildTransitive" />
-    <PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.VisualStudio.SDK" ExcludeAssets="runtime" />
+    <PackageReference Include="Microsoft.VSSDK.BuildTools" IncludeAssets="build;buildTransitive" />
+    <PackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" PrivateAssets="all" />
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System" />

src/PlanViewer.Web/PlanViewer.Web.csproj

@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.12" />
-    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.12" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" />
+    <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" PrivateAssets="all" />
   </ItemGroup>
 
   <!-- Linked files from PlanViewer.Core — analysis pipeline only, no SqlClient/WASM-incompatible deps -->

tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj

@@ -32,13 +32,13 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Avalonia.Headless" Version="12.1.3" />
-    <PackageReference Include="coverlet.collector" Version="10.1.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
-    <PackageReference Include="Microsoft.Testing.Extensions.HangDump" Version="2.4.1" />
-    <PackageReference Include="Repl.Testing" Version="0.11.0" />
-    <PackageReference Include="xunit.v3" Version="4.0.1" />
+    <PackageReference Include="Avalonia.Headless" />
+    <PackageReference Include="coverlet.collector" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="Microsoft.Testing.Extensions.HangDump" />
+    <PackageReference Include="Repl.Testing" />
+    <PackageReference Include="xunit.v3" />
   </ItemGroup>
 
   <ItemGroup>