Prepare dependencies for .NET 10 (net8-safe subset) - #2095
Draft
NickJosevski wants to merge 3 commits into
Draft
Conversation
Contributor
Appreciate the shade 🤖 |
APErebus
reviewed
Aug 4, 2026
| /// whatever newer runtime is present, so C# script steps don't additionally require the exact | ||
| /// runtime dotnet-script was built against. | ||
| /// </summary> | ||
| static Dictionary<string, string> WithDotnetRollForward(Dictionary<string, string>? environmentVars) |
Contributor
There was a problem hiding this comment.
DotNet script requires the dotnet sdk, not just the dotnet runtime, does this work for that?
APErebus
reviewed
Aug 4, 2026
| <PackageReference Include="System.ValueTuple" Version="4.5.0" /> | ||
| <PackageReference Include="Autofac" Version="4.8.0" /> | ||
| <PackageReference Include="System.ComponentModel.TypeConverter" Version="4.3.0" /> | ||
| <PackageReference Include="Autofac" Version="9.3.1" /> |
Contributor
There was a problem hiding this comment.
this seems like a huge bump... Probably need some integration testing to make sure it's all on the up and up
NickJosevski
marked this pull request as draft
August 4, 2026 06:55
zentron
reviewed
Aug 4, 2026
zentron
left a comment
zentron
left a comment
Contributor
There was a problem hiding this comment.
We need to be careful with this upgrade and confirm any breaking changes that will impact users utilizing dotnet-script.
Unfortunately in this new world the customer C# scripts will now run under whatever framework we are running Calamari itself under.
Not marked as Request Changes since this is just more a comment for caution.
NickJosevski
force-pushed
the
nj/deps-cve-test-tooling
branch
from
August 4, 2026 07:51
1b88535 to
e47255c
Compare
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 4, 2026 07:51
1af3547 to
1d13556
Compare
This was referenced Aug 5, 2026
NickJosevski
force-pushed
the
nj/deps-cve-test-tooling
branch
from
August 6, 2026 09:05
e47255c to
af660e7
Compare
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 7, 2026 04:32
5a197ad to
a9c3d46
Compare
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 7, 2026 05:43
a9c3d46 to
4c549d7
Compare
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 10, 2026 03:56
4c549d7 to
8702b70
Compare
Calamari.csproj still referenced Microsoft.NETFramework.ReferenceAssemblies.net462. That reference has done nothing since net462 was dropped as a target framework in #1669. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Autofac 4.8.0 dates from 2018 and is five majors behind. Octopus Server already runs 9.3.1 on net10. Done while Calamari still targets net8. Autofac 9.3.1 resolves on net8. The DI upgrade is therefore verified against a known-good baseline instead of being entangled with the framework change. Notes for reviewers. ContainerBuilder.Update() is the headline Autofac 5 removal and was never used here. The .Update call sites in this repo belong to LibGit2Sharp. The API surface in use is mainstream and unchanged across the version range. The custom RegisterPrioritisedList<T> extension builds on Meta<T> and WithMetadata. Both APIs are stable. Verified: clean rebuild with no new warnings. 26 tests pass covering the custom registration ordering and flavour resolution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bundled dotnet-script 1.6.0 is a framework-dependent app targeting Microsoft.NETCore.App 8.0.0. Framework-dependent apps do not roll forward across a major version by default. On a machine with only .NET 10 installed dotnet-script fails to launch. Calamari itself is unaffected. Calamari ships self-contained. The failure is in the separate dotnet-script process. Setting DOTNET_ROLL_FORWARD=Major on that invocation lets dotnet-script run on whatever newer runtime is present. An explicit value already set in the environment is respected rather than overwritten. This is a customer-facing fix as much as a CI one. Without the fix a target with .NET 10 and no .NET 8 runtime cannot run C# script steps at all. SilentProcessRunner applies EnvironmentVars additively. Passing a dictionary where one was previously null does not discard the inherited environment. Not done here: upgrading the bundled dotnet-script. The 2.0.1 release zip Calamari vendors is still net8 targeted. Only the NuGet package ships a net10 build. The upgrade also changes the NuGet version dotnet-script bundles. The change invalidates the premise of UsingIsolatedAssemblyLoadContext. Verified: 10 DotnetScriptFixture tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
NickJosevski
force-pushed
the
nj/net10-prep-deps-v2
branch
from
August 10, 2026 04:18
8702b70 to
b5274ac
Compare
NickJosevski
added a commit
that referenced
this pull request
Aug 10, 2026
Script wrappers form an execution chain and file-format replacers are tried in sequence, so a reordering changes deployment behaviour. Nothing currently detects that: every wrapper still constructs and every command still resolves, so the existing suite stays green. Two guards, both PlatformAgnostic: ContainerOrderingFixture asserts the orderings directly. The load-bearing one is ScriptWrapperPrioritiesAreUnique — ScriptEngine sorts with OrderByDescending, which is stable, so a shared priority silently hands the tie-break to the container's collection ordering. Priorities are distinct today; the test keeps them that way. The rest pin the wrapper chain for a Kubernetes/AWS/PowerShell step, the file-format replacer order, and discoverer key uniqueness. ContainerSnapshotFixture compares a rendering of the whole container against an approved file: registrations, lifetimes, collection order, and the concrete types injected into every command. Targeted assertions only catch what someone thought of; this catches anything observable that moves, which is what makes it useful across a dependency upgrade. Re-approve with CALAMARI_APPROVE_CONTAINER_SNAPSHOT=1. The snapshot is normalised so one approved file serves every platform: the OS-chosen filesystem and certificate-store implementations collapse to placeholders, Autofac's __RegistrationOrder tick counter is dropped, and collection fields render distinct element types rather than counts. Verified against the Autofac 4.8.0 -> 9.3.1 upgrade in #2095: the snapshot fails with exactly the version line plus five registrations gaining AutoActivate (the RegisterInstance ones), and all five ordering tests still pass.
This was referenced Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
Calamari has to reach .NET 10 before .NET 8 support ends on 10 November 2026.
Every risky dependency bump is done while Calamari still targets net8. A green build on net8 proves each bump in isolation. The target framework flip (#2091) then happens on a dependency graph that is already ready.
Results
The net8-safe subset extracted from #2091. Now targets
maindirectly — #2094 and #2116 have landed, so this is three commits.Microsoft.NETFramework.ReferenceAssemblies.net462, unusedDOTNET_ROLL_FORWARD=Majoron the dotnet-script invocationThe version-alignment commits are gone.
System.Linq.Asyncwas removed outright by #2120, and the Serilog andMicrosoft.Extensions.*alignment went with it.Autofac: five majors from 2018 to current, no code changes.
ContainerBuilder.Update()is the headline Autofac 5 removal and was never used here. It does add one new warning —CS8714atCalamari.Common/Plumbing/Pipeline/Resolver.cs:17, because Autofac 9'sResolve<TService>carries anotnullconstraint thatTBehaviourdoesn't satisfy.Calamari.Commondoesn't treat warnings as errors, so it builds; worth a look if that changes.The dotnet-script commit fixes a live customer bug
Worth calling out because the fix is not really about .NET 10.
Bundled dotnet-script 1.6.0 targets
Microsoft.NETCore.App 8.0.0. Framework-dependent apps do not roll forward across a major version by default. A customer whose target has only .NET 10 installed cannot run C# script steps at all. That failure exists today on net8, andworker-tools:ubuntu.24.04is a shipping image in exactly that state.Calamari itself is unaffected. Calamari ships self-contained. The failure is in the separate dotnet-script process.
Scope: this fixes launch. It does not make dotnet-script net10-ready. A script using
#r "nuget: <framework-provided package>"still fails on net10 — dotnet-script 1.6.0 bundles NuGet.ProjectModel 6.10.0, which cannot parse thelogsarray that NU1510 adds toproject.assets.json. That needs the dotnet-script 2.0.x bump, tracked separately.Reducing risk
source/Calamari.slnon net8.0: 165 warnings, 0 errors.mainis 164; the extra one is theCS8714aboveDOTNET_ROLL_FORWARD=Majoronly engages when the requested major is absent, and picks the lowest higher major. Where an 8.x runtime exists the resolved runtime is unchanged. Every configuration this alters is one where dotnet-script fails to launch today — which also means CI agents carrying both SDK 8 and SDK 10 do not exercise itmain; no duplicatePackageReferenceacross the 42 project filesHow to review this PR
General quality.