CPM in place

.github/workflows/nuget-reference-check.yml

@@ -31,9 +31,10 @@ jobs:
           set -e
 
           # Deliberately floored to an LTS version so that redistributable libraries do not impose a
-          # high minimum on downstream consumers (see issue #328). They are by design permanently
-          # "outdated", so they are excluded from the outdated signal only - the --deprecated and
-          # --vulnerable steps below do not use this filter.
+          # high minimum on downstream consumers. The list below mirrors the floored packages
+          # declared in Directory.Packages.props - keep the two in step. They are by design
+          # permanently "outdated", so they are excluded from the outdated signal only - the
+          # --deprecated and --vulnerable steps below do not use this filter.
           IGNORE_PACKAGES="Microsoft\.NETCore\.Platforms|Microsoft\.NETCore\.Targets|Microsoft\.Extensions\.Logging\.Abstractions|Microsoft\.Extensions\.DependencyInjection\.Abstractions|System\.Collections\.Immutable|System\.IO\.Pipelines"
 
           # Full report for the workflow logs only, including transitive packages

CLAUDE.md

@@ -36,6 +36,20 @@ dotnet-coverage collect "dotnet test SysML2.NET.sln --no-build" -f xml -o covera
 
 Test framework: **NUnit** (`[TestFixture]`, `[Test]`).
 
+## Dependency management (Central Package Management)
+
+`Directory.Packages.props` at the repo root owns **every** NuGet version. A `<PackageReference>` carries `Include` only — **never `Version`**. Adding a package means adding a `<PackageVersion>` there as well.
+
+`Directory.Build.targets` at the repo root owns the rest: NuGet ignores asset metadata on `<PackageVersion>`, so `PrivateAssets` / `IncludeAssets` are centralized there via `<PackageReference Update="…" />`. It also sets `PackageIcon` / `PackageReadmeFile` and packs `cdp4-icon.png` and `README.md` for every project that does not set `IsPackable` to `false`. Neither belongs in a `.csproj`.
+
+Version policy, driven by the `netstandard2.1` target making any referenced version a floor for downstream consumers:
+
+- **Redistributable libraries** reference the lowest version providing the APIs used; stable framework abstractions stay at an **LTS floor**; serialization/crypto packages track current.
+- **Applications and `*.Tests`** track current.
+- Raise a library dependency only for (a) a required new API or (b) a CVE on that package.
+
+The floored packages are listed once in the comment block in `Directory.Packages.props` and mirrored in `IGNORE_PACKAGES` in `.github/workflows/nuget-reference-check.yml`. Change one, change the other. That filter suppresses the *outdated* signal only — `--deprecated` and `--vulnerable` stay strict on every package.
+
 ## Mandatory reading
 
 **`DEVELOPMENT_STANDARDS.md`** (repo root) governs how code is written across the whole solution — production, tests, generator, scripts. Read it before authoring code in a session where you have not already done so; do not code from memory of "typical C#" or by copying a neighbouring file, since parts of this repo predate it.

Directory.Build.targets

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<Project>
+
+    <!-- NuGet ignores asset metadata on <PackageVersion>, so it is centralized here rather than in Directory.Packages.props. -->
+    <ItemGroup>
+        <PackageReference Update="Microsoft.Sbom.Targets" PrivateAssets="all" />
+        <PackageReference Update="coverlet.collector" PrivateAssets="all" IncludeAssets="runtime; build; native; contentfiles; analyzers; buildtransitive" />
+        <PackageReference Update="coverlet.msbuild" PrivateAssets="all" IncludeAssets="runtime; build; native; contentfiles; analyzers; buildtransitive" />
+    </ItemGroup>
+
+    <PropertyGroup Condition="'$(IsPackable)' != 'false'">
+        <PackageIcon>cdp4-icon.png</PackageIcon>
+        <PackageReadmeFile>README.md</PackageReadmeFile>
+    </PropertyGroup>
+
+    <ItemGroup Condition="'$(IsPackable)' != 'false'">
+        <None Include="$(MSBuildThisFileDirectory)cdp4-icon.png" Pack="true" PackagePath="\" />
+        <None Include="$(MSBuildThisFileDirectory)README.md" Pack="true" PackagePath="\" />
+    </ItemGroup>
+
+</Project>

Directory.Packages.props

@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<Project>
+
+    <PropertyGroup>
+        <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+        <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
+    </PropertyGroup>
+
+    <!--
+        Floored packages - single source of truth. The redistributable libraries multi-target
+        netstandard2.1, where the referenced version becomes a minimum floor for every downstream
+        consumer, so these stable framework abstractions stay at an LTS version and are mirrored in
+        IGNORE_PACKAGES in .github/workflows/nuget-reference-check.yml (outdated check only):
+
+          Microsoft.Extensions.DependencyInjection.Abstractions
+          Microsoft.Extensions.Logging.Abstractions
+          System.Collections.Immutable
+          System.IO.Pipelines
+          Microsoft.NETCore.Platforms   (transitive)
+          Microsoft.NETCore.Targets     (transitive)
+
+        Raise a floored version only when a required API needs it or a CVE affects that package.
+    -->
+    <ItemGroup Label="Floored to LTS">
+        <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
+        <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.3" />
+        <PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
+        <PackageVersion Include="System.IO.Pipelines" Version="8.0.0" />
+    </ItemGroup>
+
+    <ItemGroup Label="Libraries">
+        <PackageVersion Include="BouncyCastle.Cryptography" Version="2.7.0" />
+        <PackageVersion Include="MessagePack" Version="3.1.8" />
+        <PackageVersion Include="Microsoft.Sbom.Targets" Version="4.1.5" />
+        <PackageVersion Include="System.Text.Json" Version="10.0.11" />
+    </ItemGroup>
+
+    <ItemGroup Label="Code generator">
+        <PackageVersion Include="Antlr4.Runtime.Standard" Version="4.13.1" />
+        <PackageVersion Include="Microsoft.CodeAnalysis" Version="5.9.0" />
+        <PackageVersion Include="Microsoft.OpenApi" Version="3.10.2" />
+        <PackageVersion Include="uml4net.HandleBars" Version="9.1.0" />
+        <PackageVersion Include="uml4net.Reporting" Version="9.1.0" />
+        <PackageVersion Include="uml4net.xmi.Extensions.EnterpriseArchitect" Version="9.1.0" />
+    </ItemGroup>
+
+    <ItemGroup Label="Tests">
+        <PackageVersion Include="coverlet.collector" Version="10.0.1" />
+        <PackageVersion Include="coverlet.msbuild" Version="10.0.1" />
+        <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
+        <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+        <PackageVersion Include="Moq" Version="4.20.72" />
+        <PackageVersion Include="NUnit" Version="4.6.1" />
+        <PackageVersion Include="NUnit.Console" Version="3.22.0" />
+        <PackageVersion Include="NUnit3TestAdapter" Version="6.3.0" />
+        <PackageVersion Include="Serilog" Version="4.4.0" />
+        <PackageVersion Include="Serilog.Extensions.Logging" Version="10.0.0" />
+        <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
+        <PackageVersion Include="XMLUnit.Core" Version="2.11.2" />
+    </ItemGroup>
+
+</Project>

README.md

@@ -45,6 +45,20 @@ Branch | Build Status
 Master | ![Build Status](https://github.com/STARIONGROUP/SysML2.NET/actions/workflows/CodeQuality.yml/badge.svg?branch=master)
 Development | ![Build Status](https://github.com/STARIONGROUP/SysML2.NET/actions/workflows/CodeQuality.yml/badge.svg?branch=development)
 
+## Dependency management
+
+Every NuGet version is declared once, in [Directory.Packages.props](Directory.Packages.props), using [Central Package Management](https://learn.microsoft.com/nuget/consume-packages/central-package-management). A `<PackageReference>` in a project carries `Include` only — never `Version`.
+
+[Directory.Build.targets](Directory.Build.targets) holds what `Directory.Packages.props` cannot: NuGet ignores asset metadata on `<PackageVersion>`, so the `PrivateAssets` / `IncludeAssets` of `Microsoft.Sbom.Targets`, `coverlet.collector` and `coverlet.msbuild` are centralized there through `<PackageReference Update="…" />`. The same file gives every packable project its `PackageIcon` and `PackageReadmeFile`, and packs `cdp4-icon.png` and `README.md` into the `.nupkg`; a project opts out by setting `IsPackable` to `false`.
+
+The redistributable libraries multi-target `netstandard2.1;net10.0`, so a referenced version is a **minimum floor** for every downstream consumer. The version policy follows from that:
+
+- **Libraries** (`SysML2.NET`, `SysML2.NET.Serializer.*`, `SysML2.NET.Dal`, `SysML2.NET.REST`, `SysML2.NET.Kpar`, `SysML2.NET.Extensions`, `SysML2.NET.Semantics`) reference the lowest version that provides the APIs used. Stable framework abstractions stay at an LTS floor; serialization and cryptography packages track current.
+- **Applications and test projects** track current versions.
+- A library dependency is raised only when a required new API needs it, or when a CVE affects that package.
+
+The floored packages — `Microsoft.Extensions.DependencyInjection.Abstractions`, `Microsoft.Extensions.Logging.Abstractions`, `System.Collections.Immutable`, `System.IO.Pipelines`, plus the transitive `Microsoft.NETCore.Platforms` and `Microsoft.NETCore.Targets` — are by design permanently "outdated". They are listed in `Directory.Packages.props` and mirrored in `IGNORE_PACKAGES` in [.github/workflows/nuget-reference-check.yml](.github/workflows/nuget-reference-check.yml), which suppresses the *outdated* signal only: the deprecated and vulnerable checks still cover them.
+
 ## API conventions
 
 ### 1-based positional operations

SySML2.NET.REST.Tests/SySML2.NET.REST.Tests.csproj

@@ -18,20 +18,14 @@
   </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-        <PackageReference Include="NUnit" Version="4.6.1" />
-        <PackageReference Include="NUnit.Console" Version="3.22.0" />
-        <PackageReference Include="NUnit3TestAdapter" Version="6.3.0" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" />
+        <PackageReference Include="NUnit" />
+        <PackageReference Include="NUnit.Console" />
+        <PackageReference Include="NUnit3TestAdapter" />
 
-        <PackageReference Include="coverlet.collector" Version="10.0.1">
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-            <PrivateAssets>all</PrivateAssets>
-        </PackageReference>
-        <PackageReference Include="coverlet.msbuild" Version="10.0.1">
-            <PrivateAssets>all</PrivateAssets>
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-        </PackageReference>
+        <PackageReference Include="coverlet.collector" />
+        <PackageReference Include="coverlet.msbuild" />
     </ItemGroup>
 
     <ItemGroup>

SySML2.NET.REST/SySML2.NET.REST.csproj

@@ -16,20 +16,13 @@
       <PackageReleaseNotes>
           [Update] IRestClient and RestClient aligned with the move of QueryParameters, Page and PagedResult to the SysML2.NET.PSM namespace
       </PackageReleaseNotes>
-      <PackageIcon>cdp4-icon.png</PackageIcon>
-      <PackageReadmeFile>README.md</PackageReadmeFile>
       <GenerateDocumentationFile>true</GenerateDocumentationFile>
       <GenerateSBOM>true</GenerateSBOM>
   </PropertyGroup>
 
   <ItemGroup>
     <ProjectReference Include="..\SysML2.NET.Serializer.Json\SysML2.NET.Serializer.Json.csproj" />
-    <PackageReference Include="Microsoft.Sbom.Targets" Version="4.1.5" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.Sbom.Targets" />
   </ItemGroup>
 
-    <ItemGroup>
-        <None Include="..\cdp4-icon.png" Pack="true" PackagePath="\" />
-        <None Include="..\README.md" Pack="true" PackagePath="\" />
-    </ItemGroup>
-
 </Project>

SysML2.NET.CodeGenerator.Tests/SysML2.NET.CodeGenerator.Tests.csproj

@@ -30,23 +30,17 @@
     </None>
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-    <PackageReference Include="NUnit" Version="4.6.1" />
-    <PackageReference Include="NUnit.Console" Version="3.22.0" />
-    <PackageReference Include="NUnit3TestAdapter" Version="6.3.0" />
-    <PackageReference Include="coverlet.collector" Version="10.0.1">
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
-    <PackageReference Include="coverlet.msbuild" Version="10.0.1">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-    </PackageReference>
-    <PackageReference Include="Serilog" Version="4.4.0" />
-    <PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
-    <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
-    <PackageReference Include="uml4net.Reporting" Version="9.1.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="NUnit" />
+    <PackageReference Include="NUnit.Console" />
+    <PackageReference Include="NUnit3TestAdapter" />
+    <PackageReference Include="coverlet.collector" />
+    <PackageReference Include="coverlet.msbuild" />
+    <PackageReference Include="Serilog" />
+    <PackageReference Include="Serilog.Extensions.Logging" />
+    <PackageReference Include="Serilog.Sinks.Console" />
+    <PackageReference Include="uml4net.Reporting" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\SysML2.NET.CodeGenerator\SysML2.NET.CodeGenerator.csproj" />

SysML2.NET.CodeGenerator/SysML2.NET.CodeGenerator.csproj

@@ -19,11 +19,11 @@
     <SatelliteResourceLanguages>en-US</SatelliteResourceLanguages>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Antlr4.Runtime.Standard" Version="4.13.1" />
-      <PackageReference Include="Microsoft.CodeAnalysis" Version="5.9.0" />
-      <PackageReference Include="Microsoft.OpenApi" Version="3.10.2" />
-      <PackageReference Include="uml4net.HandleBars" Version="9.1.0" />
-    <PackageReference Include="uml4net.xmi.Extensions.EnterpriseArchitect" Version="9.1.0" />
+    <PackageReference Include="Antlr4.Runtime.Standard" />
+      <PackageReference Include="Microsoft.CodeAnalysis" />
+      <PackageReference Include="Microsoft.OpenApi" />
+      <PackageReference Include="uml4net.HandleBars" />
+    <PackageReference Include="uml4net.xmi.Extensions.EnterpriseArchitect" />
   </ItemGroup>
   <ItemGroup>
     <None Update="Resources\HtmlDocs\css\bootstrap-theme.css">

SysML2.NET.Dal.Tests/SysML2.NET.Dal.Tests.csproj

@@ -18,20 +18,14 @@
   </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-        <PackageReference Include="NUnit" Version="4.6.1" />
-        <PackageReference Include="NUnit.Console" Version="3.22.0" />
-        <PackageReference Include="NUnit3TestAdapter" Version="6.3.0" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" />
+        <PackageReference Include="NUnit" />
+        <PackageReference Include="NUnit.Console" />
+        <PackageReference Include="NUnit3TestAdapter" />
 
-        <PackageReference Include="coverlet.collector" Version="10.0.1">
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-            <PrivateAssets>all</PrivateAssets>
-        </PackageReference>
-        <PackageReference Include="coverlet.msbuild" Version="10.0.1">
-            <PrivateAssets>all</PrivateAssets>
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-        </PackageReference>
+        <PackageReference Include="coverlet.collector" />
+        <PackageReference Include="coverlet.msbuild" />
     </ItemGroup>
 
     <ItemGroup>

SysML2.NET.Dal/SysML2.NET.Dal.csproj

@@ -16,21 +16,15 @@
       <PackageReleaseNotes>
           [Update] Aligned with SysML2.NET 0.24.1
       </PackageReleaseNotes>
-       <PackageIcon>cdp4-icon.png</PackageIcon>
-       <PackageReadmeFile>README.md</PackageReadmeFile>
        <GenerateDocumentationFile>true</GenerateDocumentationFile>
        <GenerateSBOM>true</GenerateSBOM>
     </PropertyGroup>
 
     <ItemGroup>
       <ProjectReference Include="..\SysML2.NET.Extensions\SysML2.NET.Extensions.csproj" />
-      <PackageReference Include="Microsoft.Sbom.Targets" Version="4.1.5" PrivateAssets="all" />
+      <PackageReference Include="Microsoft.Sbom.Targets" />
     </ItemGroup>
 
-    <ItemGroup>
-        <None Include="..\cdp4-icon.png" Pack="true" PackagePath="\" />
-        <None Include="..\README.md" Pack="true" PackagePath="\" />
-    </ItemGroup>
 
   <ItemGroup>
     <Folder Include="PIM\" />

SysML2.NET.Extensions.Tests/SysML2.NET.Extensions.Tests.csproj

@@ -18,20 +18,14 @@
   </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-        <PackageReference Include="NUnit" Version="4.6.1" />
-        <PackageReference Include="NUnit.Console" Version="3.22.0" />
-        <PackageReference Include="NUnit3TestAdapter" Version="6.3.0" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" />
+        <PackageReference Include="NUnit" />
+        <PackageReference Include="NUnit.Console" />
+        <PackageReference Include="NUnit3TestAdapter" />
 
-        <PackageReference Include="coverlet.collector" Version="10.0.1">
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-            <PrivateAssets>all</PrivateAssets>
-        </PackageReference>
-        <PackageReference Include="coverlet.msbuild" Version="10.0.1">
-            <PrivateAssets>all</PrivateAssets>
-            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-        </PackageReference>
+        <PackageReference Include="coverlet.collector" />
+        <PackageReference Include="coverlet.msbuild" />
     </ItemGroup>
 
     <ItemGroup>

SysML2.NET.Extensions/SysML2.NET.Extensions.csproj

@@ -16,20 +16,13 @@
         <PackageReleaseNotes>
             [Update] Aligned with SysML2.NET 0.24.1
         </PackageReleaseNotes>
-        <PackageIcon>cdp4-icon.png</PackageIcon>
-        <PackageReadmeFile>README.md</PackageReadmeFile>
         <GenerateDocumentationFile>true</GenerateDocumentationFile>
         <GenerateSBOM>true</GenerateSBOM>
     </PropertyGroup>
 
-    <ItemGroup>
-        <None Include="..\cdp4-icon.png" Pack="true" PackagePath="\" />
-        <None Include="..\README.md" Pack="true" PackagePath="\" />
-    </ItemGroup>
-
     <ItemGroup>
       <ProjectReference Include="..\SysML2.NET\SysML2.NET.csproj" />
-      <PackageReference Include="Microsoft.Sbom.Targets" Version="4.1.5" PrivateAssets="all" />
+      <PackageReference Include="Microsoft.Sbom.Targets" />
     </ItemGroup>
 
     <ItemGroup>