Centralize NuGet package versions with Directory.Packages.props

[Copilot]

Summary

Centralized NuGet version management across src/ and tests/ to eliminate per-project version drift and align with the Phase 2 package governance requirement.

• Scope
  • Added root-level Directory.Packages.props with all unique package versions currently used by solution projects.
  • Enabled central version management via ManagePackageVersionsCentrally.
  • Removed inline Version attributes from project PackageReference entries so they resolve from the central file.
  • Dependabot nuget update target remains at root (directory: "/"), matching centralized package management.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ Feature (non-breaking change that adds functionality)
• ♻️ Refactor (no behavior change, code cleanup/restructure)
• 🧪 Tests (new or updated tests only)
• 📝 Docs (README, XML docs, comments)
• ⚙️ Infra/CI (GitHub Actions, Aspire, NuGet, deployment)
• 🔒 Security (auth, permissions, secrets, headers)
• 💥 Breaking change (existing behavior changes)

Domain Affected

• 🏗️ Architecture / domain logic / CQRS → Aragorn required
• 🔧 Backend (handlers, repositories, API endpoints, MediatR) → Sam required
• ⚛️ Frontend (Blazor components, Razor pages, CSS, JS) → Legolas required
• 🧪 Unit / bUnit / integration tests → Gimli required
• 🧪 E2E / Playwright / Aspire integration tests → Pippin required
• ⚙️ CI/CD / GitHub Actions / NuGet / Aspire AppHost → Boromir required
• 🔒 Auth0 / authorization / security-relevant changes → Gandalf required
• 📝 Docs / README / XML docs → Frodo required

Self-Review Checklist

Code Quality

• I ran dotnet build MyBlog.slnx --configuration Release — 0 errors, 0 warnings
• I ran dotnet test MyBlog.slnx --configuration Release --no-build — all pass
• No TODO/FIXME left unless tracked in a follow-up issue (link it)
• No secrets, API keys, or credentials committed

Architecture

• New handlers follow the Command/Query/Handler/Validator naming conventions
• New handlers are sealed
• Domain layer has no references to Web or Persistence.* projects
• Result<T> / ResultErrorCode used for expected failures (no exception-driven control flow)
• DTOs are records in Domain.DTOs; Models are in Domain.Models
• No DTO types embedded in Model classes

Tests

• New code has corresponding unit tests
• Integration tests use domain-specific collections ([Collection("XxxIntegration")])
• No test compares two IssueDto.Empty / CommentDto.Empty instances directly

Security (check if security-relevant)

• New endpoints have appropriate RequireAuthorization / policy applied
• No MarkupString used with user-supplied content
• No user input reflected in MongoDB queries without sanitization

Merge Readiness

• Branch is up to date with main (no merge conflicts)
• CI checks are green (do not request review while checks are pending/failing)
• PR description is complete — reviewers should not have to ask what this does

Screenshots / Evidence

<!-- Directory.Packages.props -->
<Project>
  <ItemGroup>
    <PackageVersion Include="MediatR" Version="14.1.0" />
    <PackageVersion Include="MongoDB.EntityFrameworkCore" Version="10.0.1" />
    <!-- ...all other unique package versions... -->
  </ItemGroup>
</Project>

<!-- Example csproj migration -->
<PackageReference Include="MediatR" />

Notes for Reviewers

Please focus review on:

• Completeness of Directory.Packages.props package/version coverage vs. all src/ + tests/ project references.
• Any package/version that should remain project-local (none identified).

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Centralizes NuGet package version management across the solution by introducing central package version definitions and removing per-project version declarations to prevent version drift.

Changes:

• Added root Directory.Packages.props defining all package versions used across src/ and tests/.
• Enabled central package management (ManagePackageVersionsCentrally) at the repo level.
• Removed Version="..." attributes from PackageReference entries in multiple projects.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/Unit.Tests/Unit.Tests.csproj	Removes per-reference versions so packages resolve from central versions
tests/Integration.Tests/Integration.Tests.csproj	Same migration to central versions for integration test dependencies
tests/Architecture.Tests/Architecture.Tests.csproj	Same migration to central versions for architecture test dependencies
src/Web/Web.csproj	Switches web project package refs to centrally-managed versions
src/ServiceDefaults/ServiceDefaults.csproj	Switches service defaults package refs to centrally-managed versions
src/AppHost/AppHost.csproj	Switches Aspire AppHost package refs to centrally-managed versions
Directory.Packages.props	Adds central package version declarations
Directory.Build.props	Enables MSBuild central package management globally

[Copilot]

coverlet.collector and xunit.runner.visualstudio are typically intended to be test-only dependencies and should be marked as private assets to prevent them from flowing transitively if the project is ever referenced/packed. Consider adding PrivateAssets="all" (and, for coverlet.collector, IncludeAssets="runtime; build; native; contentfiles; analyzers; buildtransitive"), similar to what you already do for coverlet.msbuild.

[Copilot]

Same as Unit.Tests: coverlet.collector and xunit.runner.visualstudio should generally be private assets. Adding PrivateAssets="all" (and appropriate IncludeAssets for coverlet) avoids accidental propagation and keeps dependency graphs cleaner.

[Copilot]

coverlet.collector and xunit.runner.visualstudio should generally be marked with PrivateAssets="all" (and coverlet IncludeAssets), consistent with typical test-project dependency hygiene and to prevent unintended transitive exposure.

[Copilot]

Consider moving (or duplicating) ManagePackageVersionsCentrally into Directory.Packages.props as well, so the “central package management” switch lives alongside the central version declarations. This can reduce confusion for future maintainers and makes the central package file more self-describing when viewed in isolation.

[Copilot]

With this file becoming the single source of truth, keeping PackageVersion entries consistently ordered (e.g., alphabetically by Include) will make future updates and diffs easier to review and reduces the chance of duplicate/missed entries as the list grows.