Improve Central Package Management, update dependencies and fix package validation/MSBuild warnings (#15362)

* Use version overrides for ImageSharp 2

* Move Directory.Packages.props to root, use GlobalPackageReference and replace Microsoft.CSharp with Microsoft.CodeAnalysis.CSharp

* Replace NPoco.SqlServer with NPoco and remove unused System dependencies

* Fix package validation and MSBuild warnings

* Add nuget.config and enable package source mapping

* Remove explicitly set C# language version

* Add empty Directory.Packages.props file for acceptance test

* Downgrade SixLabors.ImageSharp back to 3.0.2 because of breaking changes

* Update ImageSharp/ImageSharp.Web to 3.1.0 and use ComputeHMAC

Directory.Build.props

@@ -2,7 +2,6 @@
 <Project>
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
-    <LangVersion>11.0</LangVersion>
     <Company>Umbraco HQ</Company>
     <Authors>Umbraco</Authors>
     <Copyright>Copyright © Umbraco $([System.DateTime]::Today.ToString('yyyy'))</Copyright>
@@ -17,6 +16,7 @@
     <WarningsAsErrors>nullable</WarningsAsErrors>
     <ImplicitUsings>enable</ImplicitUsings>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
   </PropertyGroup>
 
   <!-- SourceLink -->
@@ -35,21 +35,16 @@
     <EnableStrictModeForCompatibleTfms>true</EnableStrictModeForCompatibleTfms>
   </PropertyGroup>
 
-  <ItemGroup>
+  <!-- Calculate version only once for the whole repository -->
-    <PackageReference Include="Nerdbank.GitVersioning" Version="3.6.133" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="Umbraco.Code" Version="2.0.0" PrivateAssets="all" IsImplicitlyDefined="true" />
-    <PackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" PrivateAssets="all" IsImplicitlyDefined="true" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Content Include="$(MSBuildThisFileDirectory)icon.png" Pack="true" PackagePath="" Visible="false" />
-  </ItemGroup>
-
   <PropertyGroup>
     <GitVersionBaseDirectory>$(MSBuildThisFileDirectory)</GitVersionBaseDirectory>
   </PropertyGroup>
 
+  <!-- Include icon in generated NuGet packages -->
+  <ItemGroup>
+    <Content Include="$(MSBuildThisFileDirectory)icon.png" Pack="true" PackagePath="" Visible="false" />
+  </ItemGroup>
+
   <!-- Use version range on project references (to limit on major version in generated packages) -->
   <Target Name="_GetProjectReferenceVersionRanges" AfterTargets="_GetProjectReferenceVersions">
     <ItemGroup>

Directory.Packages.props

@@ -2,8 +2,49 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <NoWarn>NU1507</NoWarn>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
+  
+  <!-- Global packages (private, build-time packages for all projects) -->
+  <ItemGroup>
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.133" />
+    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" />
+    <GlobalPackageReference Include="Umbraco.Code" Version="2.0.0" />
+    <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
+  </ItemGroup>
+  
+  <!-- Microsoft packages -->
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
+    <PackageVersion Include="System.Runtime.Caching" Version="8.0.0" />
+  </ItemGroup>
+  
+  <!-- Umbraco packages -->
+  <ItemGroup>
+    <PackageVersion Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" />
+    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
+  </ItemGroup>
+  
+  <!-- Third-party packages -->
   <ItemGroup>
     <PackageVersion Include="Asp.Versioning.Mvc" Version="7.1.0" />
     <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="7.1.0" />
@@ -14,35 +55,16 @@
     <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.6" />
     <PackageVersion Include="MailKit" Version="4.3.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="2.5.129" />
+    <PackageVersion Include="MessagePack" Version="2.5.140" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.0" />
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
     <PackageVersion Include="ncrontab" Version="3.3.3" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageVersion Include="NPoco" Version="5.7.1" />
     <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.5.0" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.0" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.0" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.0" />
     <PackageVersion Include="Serilog" Version="3.1.1" />
     <PackageVersion Include="Serilog.AspNetCore" Version="8.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
@@ -55,16 +77,20 @@
     <PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.0.2" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.0" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.0.1" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.0" />
     <PackageVersion Include="Smidge.InMemory" Version="4.3.0" />
     <PackageVersion Include="Smidge.Nuglify" Version="4.3.0" />
-    <PackageVersion Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.5.0" />
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
+  </ItemGroup>
-    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="8.0.0" />
+  
-    <PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
+  <!-- Transitive pinned versions -->
-    <PackageVersion Include="System.Reflection.Emit.Lightweight" Version="4.7.0" />
+  <ItemGroup>
-    <PackageVersion Include="System.Runtime.Caching" Version="8.0.0" />
+    <!-- NPoco.SqlServer brings in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Umbraco.CSharpTest.Net.Collections" Version="15.0.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.10.4" />
+    <!-- Umbraco.Code depends on an outdated Microsoft.CodeAnalysis.CSharp.Workspaces version-->
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+    <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
   </ItemGroup>
 </Project>

nuget.config

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <!-- Ensure all packages are pulled from NuGet -->
+    <packageSource key="nuget">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

src/Umbraco.Cms.Imaging.ImageSharp/Media/ImageSharpImageUrlGenerator.cs

@@ -130,11 +130,7 @@ public sealed class ImageSharpImageUrlGenerator : IImageUrlGenerator
         {
             var uri = QueryHelpers.AddQueryString(options.ImageUrl, queryString);
 
-            // It's important that we call the async version here.
+            var token = _requestAuthorizationUtilities.ComputeHMAC(uri, CommandHandling.Sanitize);
-            // This is because if we call the synchronous version, we ImageSharp will start a new Task ever single time.
-            // This becomes a huge problem if the site is under load, and will result in massive spikes in response time.
-            // See https://github.com/SixLabors/ImageSharp.Web/blob/main/src/ImageSharp.Web/AsyncHelper.cs#L24
-            var token = _requestAuthorizationUtilities.ComputeHMACAsync(uri, CommandHandling.Sanitize).GetAwaiter().GetResult();
             if (string.IsNullOrEmpty(token) is false)
             {
                 queryString.Add(RequestAuthorizationUtilities.TokenCommand, token);

src/Umbraco.Cms.Imaging.ImageSharp/Umbraco.Cms.Imaging.ImageSharp.csproj

@@ -2,7 +2,6 @@
   <PropertyGroup>
     <Title>Umbraco CMS - Imaging - ImageSharp</Title>
     <Description>Adds imaging support using ImageSharp/ImageSharp.Web to Umbraco CMS.</Description>
-    <EnablePackageValidation>false</EnablePackageValidation>
   </PropertyGroup>
 
   <ItemGroup>

src/Umbraco.Cms.Imaging.ImageSharp2/Umbraco.Cms.Imaging.ImageSharp2.csproj

@@ -2,12 +2,11 @@
   <PropertyGroup>
     <Title>Umbraco CMS - Imaging - ImageSharp 2</Title>
     <Description>Adds imaging support using ImageSharp/ImageSharp.Web version 2 to Umbraco CMS.</Description>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="SixLabors.ImageSharp" Version="[2.1.6, 3)" />
+    <PackageReference Include="SixLabors.ImageSharp" VersionOverride="[2.1.6, 3)" />
-    <PackageReference Include="SixLabors.ImageSharp.Web" Version="[2.0.2, 3)" />
+    <PackageReference Include="SixLabors.ImageSharp.Web" VersionOverride="[2.0.2, 3)" />
   </ItemGroup>
 
   <ItemGroup>

src/Umbraco.Cms.Targets/Umbraco.Cms.Targets.csproj

@@ -4,9 +4,6 @@
     <Description>Installs Umbraco CMS with minimal dependencies in your ASP.NET Core project.</Description>
     <IncludeBuildOutput>false</IncludeBuildOutput>
     <IncludeSymbols>false</IncludeSymbols>
-    <!-- TODO: Enable when final version is shipped (because there's currently no previous version) -->
-    <EnablePackageValidation>false</EnablePackageValidation>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>
@@ -24,7 +21,7 @@
     <NoWarn>NU5100;NU5128</NoWarn>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" PrivateAssets="all" GeneratePathProperty="true" />
+    <PackageReference Include="Umbraco.JsonSchema.Extensions" PrivateAssets="all" GeneratePathProperty="true" />
     <None Include="$(PkgUmbraco_JsonSchema_Extensions)\tasks\netstandard2.0\**" Pack="true" PackagePath="tasks\netstandard2.0" Visible="false" />
     <Content Include="$(_UmbracoCmsJsonSchemaReference)" PackagePath="" Visible="false" />
   </ItemGroup>

src/Umbraco.Cms/Umbraco.Cms.csproj

@@ -4,7 +4,6 @@
     <Description>Installs Umbraco CMS with all default dependencies in your ASP.NET Core project.</Description>
     <IncludeBuildOutput>false</IncludeBuildOutput>
     <IncludeSymbols>false</IncludeSymbols>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>

src/Umbraco.Infrastructure/Umbraco.Infrastructure.csproj

@@ -12,35 +12,31 @@
 
   <ItemGroup>
     <PackageReference Include="Examine.Core" />
-    <PackageReference Include="HtmlAgilityPack"  />
+    <PackageReference Include="HtmlAgilityPack" />
-    <PackageReference Include="MailKit"  />
+    <PackageReference Include="MailKit" />
     <PackageReference Include="Markdown" />
-    <PackageReference Include="Microsoft.CSharp" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Http" />
     <PackageReference Include="Microsoft.Extensions.Identity.Stores" />
     <PackageReference Include="MiniProfiler.Shared" />
-    <PackageReference Include="ncrontab"  />
+    <PackageReference Include="ncrontab" />
     <PackageReference Include="Newtonsoft.Json" />
-    <PackageReference Include="Serilog"  />
+    <PackageReference Include="NPoco" />
     <PackageReference Include="OpenIddict.Abstractions" />
-    <PackageReference Include="NPoco.SqlServer" />
+    <PackageReference Include="Serilog" />
-    <PackageReference Include="Serilog.Enrichers.Process"  />
+    <PackageReference Include="Serilog.Enrichers.Process" />
-    <PackageReference Include="Serilog.Enrichers.Thread"  />
+    <PackageReference Include="Serilog.Enrichers.Thread" />
     <PackageReference Include="Serilog.Expressions" />
-    <PackageReference Include="Serilog.Extensions.Hosting"  />
+    <PackageReference Include="Serilog.Extensions.Hosting" />
     <PackageReference Include="Serilog.Formatting.Compact" />
     <PackageReference Include="Serilog.Formatting.Compact.Reader" />
     <PackageReference Include="Serilog.Settings.Configuration" />
     <PackageReference Include="Serilog.Sinks.Async" />
     <PackageReference Include="Serilog.Sinks.File" />
     <PackageReference Include="Serilog.Sinks.Map" />
-    <PackageReference Include="System.IO.FileSystem.AccessControl" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" />
-    <PackageReference Include="System.Threading.Tasks.Dataflow" />
-
   </ItemGroup>
 
   <ItemGroup>

src/Umbraco.Web.UI/Umbraco.Web.UI.csproj

@@ -3,20 +3,23 @@
     <RootNamespace>Umbraco.Cms.Web.UI</RootNamespace>
     <IsPackable>false</IsPackable>
     <EnablePackageValidation>false</EnablePackageValidation>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <Import Project="..\Umbraco.Cms.Targets\buildTransitive\Umbraco.Cms.Targets.props" />
   <Import Project="..\Umbraco.Cms.Targets\buildTransitive\Umbraco.Cms.Targets.targets" />
   <ItemGroup>
     <ProjectReference Include="..\Umbraco.Cms\Umbraco.Cms.csproj" />
-    <!-- Add design/build time support for EF Core migrations -->
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
+    <!-- Add design/build time support for EF Core migrations -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" PrivateAssets="all" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <!-- Ensure the AppLocalIcu setting is the same as the referenced ICU package version and changes are also done to the template project! -->
     <!-- Opt-in to app-local ICU to ensure consistent globalization APIs across different platforms -->
-    <PackageReference Include="Microsoft.ICU.ICU4C.Runtime" Version="72.1.0.3" />
+    <PackageReference Include="Microsoft.ICU.ICU4C.Runtime" VersionOverride="72.1.0.3" />
     <RuntimeHostConfigurationOption Include="System.Globalization.AppLocalIcu" Value="72.1.0.3" Condition="$(RuntimeIdentifier.StartsWith('linux')) or $(RuntimeIdentifier.StartsWith('win')) or ('$(RuntimeIdentifier)' == '' and !$([MSBuild]::IsOSPlatform('osx')))" />
  </ItemGroup>
 

templates/Directory.Build.props

@@ -1,4 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
 <Project>
   <!-- Enable multi-level merging with src -->
-  <Import Project="$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)..\src\'))" />
+  <Import Project="$([MSBuild]::GetPathOfFileAbove(Directory.Build.props, $(MSBuildThisFileDirectory)..\src))" />
 </Project>

templates/Umbraco.Templates.csproj

@@ -9,7 +9,6 @@
     <IncludeContentInPack>true</IncludeContentInPack>
     <ContentTargetFolders>.</ContentTargetFolders>
     <NoWarn>NU5128</NoWarn>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>
@@ -44,7 +43,7 @@
 
   <!-- Update template.json files with the default UmbracoVersion value set to the current build version -->
   <ItemGroup>
-    <PackageReference Include="Umbraco.JsonSchema.Extensions" Version="0.3.0" PrivateAssets="all" />
+    <PackageReference Include="Umbraco.JsonSchema.Extensions" PrivateAssets="all" />
   </ItemGroup>
   <ItemGroup>
     <Content Update="**\.template.config\template.json" Pack="false" />

templates/UmbracoPackage/UmbracoPackage.csproj

@@ -1,14 +1,18 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
     <ContentTargetFolders>.</ContentTargetFolders>
-    <Product>UmbracoPackage</Product>
+    <RootNamespace Condition="'$(name)' != '$(name{-VALUE-FORMS-}safe_namespace)'">UmbracoPackage</RootNamespace>
+  </PropertyGroup>
+
+  <PropertyGroup>
     <PackageId>UmbracoPackage</PackageId>
+    <Product>UmbracoPackage</Product>
     <Title>UmbracoPackage</Title>
     <Description>...</Description>
     <PackageTags>umbraco plugin package</PackageTags>
-    <RootNamespace Condition="'$(name)' != '$(name{-VALUE-FORMS-}safe_namespace)'">UmbracoPackage</RootNamespace>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
   
   <ItemGroup>

templates/UmbracoProject/UmbracoProject.csproj

@@ -4,7 +4,6 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <RootNamespace Condition="'$(name)' != '$(name{-VALUE-FORMS-}safe_namespace)'">Umbraco.Cms.Web.UI</RootNamespace>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>

tests/Directory.Build.props

@@ -1,6 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
 <Project>
   <!-- Enable multi-level merging -->
-  <Import Project="$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)../'))" />
+  <Import Project="$([MSBuild]::GetPathOfFileAbove(Directory.Build.props, $(MSBuildThisFileDirectory)..))" />
 
   <PropertyGroup>
     <!-- Disable packaging and validation for test projects to fix benchmarks (that auto-generates boilerplate code) -->

tests/Directory.Packages.props

@@ -1,24 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
-  <PropertyGroup>
+  <!-- Enable multi-level merging -->
-    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  <Import Project="$([MSBuild]::GetPathOfFileAbove(Directory.Packages.props, $(MSBuildThisFileDirectory)..))" />
-    <NoWarn>NU1507</NoWarn>
-  </PropertyGroup>
   <ItemGroup>
-    <PackageVersion Include="AngleSharp" Version="0.17.1" />
+    <!-- Microsoft packages -->
+    <PackageVersion Include="BenchmarkDotNet" Version="0.13.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
+    <PackageVersion Include="System.Data.DataSetExtensions" Version="4.5.0" />
+    <PackageVersion Include="System.Data.Odbc" Version="8.0.0" />
+    <PackageVersion Include="System.Data.OleDb" Version="8.0.0" />
+    <PackageVersion Include="System.Reflection.Emit" Version="4.7.0" />
+  </ItemGroup>
+  <ItemGroup>
+    <!-- Third-party packages -->
     <PackageVersion Include="AutoFixture.AutoMoq" Version="4.18.1" />
     <PackageVersion Include="AutoFixture.NUnit3" Version="4.18.1" />
-    <PackageVersion Include="BenchmarkDotNet" Version="0.13.5" />
     <PackageVersion Include="Bogus" Version="34.0.2" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="6.0.24" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Debug" Version="7.0.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
     <PackageVersion Include="Moq" Version="4.18.4" />
     <PackageVersion Include="NUnit" Version="3.14.0" />
     <PackageVersion Include="NUnit3TestAdapter" Version="4.5.0" PrivateAssets="all" />
-    <PackageVersion Include="System.Data.DataSetExtensions" Version="4.5.0" />
-    <PackageVersion Include="System.Data.Odbc" Version="6.0.1" />
-    <PackageVersion Include="System.Data.OleDb" Version="6.0.0" />
-    <PackageVersion Include="System.Reflection.Emit" Version="4.7.0" />
   </ItemGroup>
 </Project>

tests/Umbraco.Tests.AcceptanceTest/misc/Directory.Packages.props

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+    <!--
+        Keep this empty Directory.Packages.props file to prevent inheriting from parent directories,
+        because the Windows E2E test that outputs a new Umbraco project into this directory otherwise won't build.
+    -->
+</Project>

tests/Umbraco.Tests.Benchmarks/Umbraco.Tests.Benchmarks.csproj

@@ -3,7 +3,6 @@
     <OutputType>Exe</OutputType>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <IsPackable>false</IsPackable>
-    <EnablePackageValidation>false</EnablePackageValidation>
     <GenerateProgramFile>false</GenerateProgramFile>
   </PropertyGroup>
 

tests/Umbraco.Tests.Integration/Umbraco.Tests.Integration.csproj

@@ -7,6 +7,7 @@
     <RootNamespace>Umbraco.Cms.Tests.Integration</RootNamespace>
     <IsPackable>true</IsPackable>
     <EnablePackageValidation>$(BaseEnablePackageValidation)</EnablePackageValidation>
+    <NoWarn>NU5100</NoWarn>
   </PropertyGroup>
 
   <ItemGroup>

tools/Umbraco.JsonSchema/Umbraco.JsonSchema.csproj

@@ -3,12 +3,11 @@
     <OutputType>Exe</OutputType>
     <IsPackable>false</IsPackable>
     <EnablePackageValidation>false</EnablePackageValidation>
-    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="CommandLineParser" Version="2.9.1" />
+    <PackageReference Include="CommandLineParser" VersionOverride="2.9.1" />
-    <PackageReference Include="NJsonSchema" Version="10.9.0" />
+    <PackageReference Include="NJsonSchema" VersionOverride="10.9.0" />
   </ItemGroup>
 
   <ItemGroup>

umbraco.sln

@@ -129,12 +129,13 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		.gitignore = .gitignore
 		.globalconfig = .globalconfig
 		Directory.Build.props = Directory.Build.props
+		Directory.Packages.props = Directory.Packages.props
+		global.json = global.json
 		icon.png = icon.png
 		LICENSE.md = LICENSE.md
 		umbraco.sln.DotSettings = umbraco.sln.DotSettings
+		nuget.config = nuget.config
 		version.json = version.json
-		global.json = global.json
-		src\Directory.Packages.props = src\Directory.Packages.props
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "build", "build", "{20CE9C97-9314-4A19-BCF1-D12CF49B7205}"