net8->net10

.azdo/release.yaml

@@ -54,7 +54,7 @@ extends:
           displayName: Install .NET
           inputs:
             packageType: 'sdk'
-            version: '8.0.x'
+            useGlobalJson: true
 
         # https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-security-configuration/configuration-guides/pat-burndown-guidance#workarounds-for-tasks-that-do-not-yet-support-wif-service-connection
         - task: AzureCLI@2

.devcontainer/devcontainer.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.base.schema.json",
   "name": "Component Detection",
-  "image": "mcr.microsoft.com/vscode/devcontainers/dotnet:8.0",
+  "image": "mcr.microsoft.com/devcontainers/dotnet:10.0",
   "runArgs": ["--init"],
   "extensions": [
     "eamodio.gitlens",

.editorconfig

@@ -518,6 +518,8 @@ dotnet_diagnostic.CS1591.severity = suggestion
 
 # CA2007: Consider calling ConfigureAwait on the awaited task
 dotnet_diagnostic.CA2007.severity = suggestion
+# CA1873: Avoid potentially expensive logging
+dotnet_diagnostic.CA1873.severity = suggestion
 
 # CA1062: Validate arguments of public methods
 dotnet_diagnostic.CA1062.severity = suggestion
@@ -673,6 +675,33 @@ dotnet_diagnostic.CA1311.severity = suggestion
 # CA1852: Type can be sealed
 dotnet_diagnostic.CA1852.severity = suggestion
 
+# Modernization suggestions from the newer SDK should not require unrelated rewrites.
+# IDE0040: Accessibility modifiers, now also enforced on interface members
+dotnet_diagnostic.IDE0040.severity = suggestion
+# CA1515: Consider making public types internal
+dotnet_diagnostic.CA1515.severity = suggestion
+# CA2263: Prefer a generic overload when the type is known
+dotnet_diagnostic.CA2263.severity = suggestion
+# IDE0032: Use auto property, including the C# field keyword
+dotnet_diagnostic.IDE0032.severity = suggestion
+# IDE0330: Use System.Threading.Lock
+dotnet_diagnostic.IDE0330.severity = suggestion
+# IDE0350: Simplify lambda expression
+dotnet_diagnostic.IDE0350.severity = suggestion
+# IDE0370: Remove unnecessary null-forgiving operators
+dotnet_diagnostic.IDE0370.severity = suggestion
+# IDE0028, IDE0300, IDE0306: Simplify collection initialization
+dotnet_diagnostic.IDE0028.severity = suggestion
+dotnet_diagnostic.IDE0300.severity = suggestion
+dotnet_diagnostic.IDE0306.severity = suggestion
+# CA1849, CA2024: Prefer asynchronous I/O
+dotnet_diagnostic.CA1849.severity = suggestion
+dotnet_diagnostic.CA2024.severity = suggestion
+# CA1872: Prefer Convert.ToHexStringLower
+dotnet_diagnostic.CA1872.severity = suggestion
+# CA1874: Prefer Regex.IsMatch
+dotnet_diagnostic.CA1874.severity = suggestion
+
 # CA1854: Prefer the IDictionary.TryGetValue(TKey, out TValue) method
 dotnet_diagnostic.CA1854.severity = suggestion
 

.github/copilot-instructions.md

@@ -129,7 +129,7 @@ dotnet run --project src/Microsoft.ComponentDetection/Microsoft.ComponentDetecti
 dotnet test
 
 # Run specific test project
-dotnet test test/Microsoft.ComponentDetection.Detectors.Tests/
+dotnet test --project test/Microsoft.ComponentDetection.Detectors.Tests/
 ```
 
 ### Debug Mode

.github/workflows/build.yml

@@ -41,10 +41,8 @@ jobs:
         run: dotnet build --no-restore --configuration Debug
 
       - name: Run tests
-        # The '--' separator forwards options to the Microsoft Testing Platform runner.
-        # After upgrading to .NET 10 SDK, these can be passed directly without '--'.
         # Disable the default Integration-test exclusion from test/Directory.Build.props.
-        run: dotnet test --no-build --configuration Debug -p:ExcludeIntegrationTests=false -p:TestingPlatformCommandLineArguments="--coverage --coverage-output-format cobertura"
+        run: dotnet test --no-build --configuration Debug -p:ExcludeIntegrationTests=false --coverage --coverage-output-format cobertura
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2

CONTRIBUTING.md

@@ -68,7 +68,7 @@ By default, `dotnet test` **excludes** Integration tests (configured in `test/Di
 
 To run only Integration tests locally:
 ```bash
-dotnet test -- --filter "TestCategory=Integration"
+dotnet test -p:ExcludeIntegrationTests=false --filter "TestCategory=Integration"
 ```
 
 To run everything (same as CI):

Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
   <PropertyGroup Label="Build">
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <LangVersion>latest</LangVersion>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
@@ -32,7 +32,6 @@
     <PackageReference Include="Microsoft.VisualStudio.Threading.Analyzers" PrivateAssets="all"/>
     <PackageReference Include="MinVer" PrivateAssets="all"/>
     <PackageReference Include="StyleCop.Analyzers" PrivateAssets="all"/>
-    <PackageReference Include="System.Text.Json" />
   </ItemGroup>
 
 </Project>

Directory.Packages.props

@@ -10,11 +10,11 @@
     <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
     <PackageVersion Include="AwesomeAssertions.Analyzers" Version="9.0.8" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.3" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.3" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.403" />
     <PackageVersion Include="MSBuild.StructuredLogger" Version="2.3.113" />
     <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.14.15" />
     <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="8.0.0" />
@@ -25,8 +25,8 @@
     <PackageVersion Include="MSTest.Analyzers" Version="4.1.0" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="Newtonsoft.Json.Schema" Version="4.0.1" />
-    <PackageVersion Include="NuGet.ProjectModel" Version="7.3.0" />
-    <PackageVersion Include="NuGet.Versioning" Version="7.3.0" />
+    <PackageVersion Include="NuGet.ProjectModel" Version="7.3.1" />
+    <PackageVersion Include="NuGet.Versioning" Version="7.3.1" />
     <PackageVersion Include="packageurl-dotnet" Version="2.0.0" />
     <PackageVersion Include="Polly" Version="8.6.6" />
     <PackageVersion Include="SemanticVersioning" Version="2.0.2" />
@@ -50,6 +50,6 @@
     <PackageVersion Include="Faker.net" Version="2.0.163" />
     <PackageVersion Include="Valleysoft.DockerfileModel" Version="1.2.0" />
     <!-- Fix security alerts -->
-    <PackageVersion Include="System.Formats.Asn1" Version="9.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
   </ItemGroup>
 </Project>

Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0-cbl-mariner2.0@sha256:a26c5bf4c47186df2fd290b74a2512d9830796d98b644fb12857b57a5244507d AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0-azurelinux3.0@sha256:ffd76bb46785445d2d029809009d35b522619b97df88c0abaa05d549db697b43 AS build
 WORKDIR /app
 COPY . .
 RUN dotnet publish -c Release -o out \
@@ -10,7 +10,7 @@ RUN dotnet publish -c Release -o out \
     -p:PublishSingleFile=true \
     ./src/Microsoft.ComponentDetection
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-cbl-mariner2.0@sha256:addba165ed9637fc02c63e9f66913deb7125dac90b5ca7d3f89d6d084c23f09b AS runtime
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-azurelinux3.0@sha256:d33971c79f36e1d539de998823ae930bf085c4e9812c4cdebd9a1571e300fdb3 AS runtime
 WORKDIR /app
 COPY --from=build /app/out ./
 

README.md

@@ -66,7 +66,7 @@ For a complete feature overview refer to [feature-overview.md](docs/feature-over
 
 ## Getting Started
 
-To clone and run this application, you'll need [Git](https://git-scm.com) and [.NET 8](https://aka.ms/download-dotnet) installed on your computer. From your command line:
+To clone and run this application, you'll need [Git](https://git-scm.com) and the [.NET SDK](https://aka.ms/download-dotnet) specified in [global.json](global.json) installed on your computer. From your command line:
 
 ```bash
 # Clone this repository

global.json

@@ -1,9 +1,12 @@
 {
 	"sdk": {
-		"version": "8.0.418",
+		"version": "10.0.403",
 		"rollForward": "latestFeature"
 	},
 	"msbuild-sdks": {
 		"MSTest.Sdk": "4.1.0"
+	},
+	"test": {
+		"runner": "Microsoft.Testing.Platform"
 	}
 }

src/Microsoft.ComponentDetection.Common/LazyComponentStream.cs

@@ -43,7 +43,7 @@ private byte[] SafeOpenFile()
             using var fs = this.fileInfo.OpenRead();
 
             var buffer = new byte[this.fileInfo.Length];
-            fs.Read(buffer, 0, (int)this.fileInfo.Length);
+            fs.ReadExactly(buffer);
 
             return buffer;
         }

src/Microsoft.ComponentDetection.Common/Microsoft.ComponentDetection.Common.csproj

@@ -14,7 +14,6 @@
         <PackageReference Include="Docker.DotNet" />
         <PackageReference Include="Microsoft.Extensions.Logging" />
         <PackageReference Include="System.Reactive" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
     </ItemGroup>
 
     <ItemGroup Label="Package References">

src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj

@@ -15,6 +15,7 @@
     <PackageReference Include="packageurl-dotnet" />
     <PackageReference Include="System.Memory" />
     <PackageReference Include="System.Reactive" />
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="System.Threading.Tasks.Dataflow" />
   </ItemGroup>
 </Project>

src/Microsoft.ComponentDetection.Detectors/Microsoft.ComponentDetection.Detectors.csproj

@@ -22,12 +22,11 @@
         <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
         <PackageReference Include="Newtonsoft.Json" />
         <PackageReference Include="System.Reactive" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="Tomlyn.Signed" />
         <PackageReference Include="Valleysoft.DockerfileModel" />
 
         <!-- Fix alerts -->
-        <PackageReference Include="System.Formats.Asn1" />
+        <PackageReference Include="System.Security.Cryptography.Pkcs" />
     </ItemGroup>
 
     <ItemGroup Label="Package References">

src/Microsoft.ComponentDetection.Orchestrator/Microsoft.ComponentDetection.Orchestrator.csproj

@@ -18,7 +18,6 @@
         <PackageReference Include="Spectre.Console" />
         <PackageReference Include="Spectre.Console.Cli" />
         <PackageReference Include="Spectre.Console.Cli.Extensions.DependencyInjection" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="System.Reactive" />
     </ItemGroup>
 

src/Microsoft.ComponentDetection/Microsoft.ComponentDetection.csproj

@@ -17,7 +17,6 @@
       <PackageReference Include="Serilog.Sinks.Map" />
       <PackageReference Include="Spectre.Console.Cli" />
       <PackageReference Include="Spectre.Console.Cli.Extensions.DependencyInjection" />
-      <PackageReference Include="System.Threading.Tasks.Dataflow" />
     </ItemGroup>
 
     <ItemGroup Label="Package References">

test/Directory.Build.props

@@ -4,8 +4,6 @@
 
   <PropertyGroup>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <!-- Shows the failed test output inline when using 'dotnet test' with Microsoft Testing Platform. -->
-    <TestingPlatformShowTestsFailure>true</TestingPlatformShowTestsFailure>
     <!-- Exclude slow integration tests by default. Set ExcludeIntegrationTests=false to run the full suite. -->
     <ExcludeIntegrationTests Condition="'$(ExcludeIntegrationTests)' == ''">true</ExcludeIntegrationTests>
     <TestingPlatformCommandLineArguments Condition="'$(ExcludeIntegrationTests)' == 'true'">$(TestingPlatformCommandLineArguments) --filter TestCategory!=Integration</TestingPlatformCommandLineArguments>

test/Microsoft.ComponentDetection.Common.Tests/LazyComponentStreamTests.cs

@@ -12,6 +12,31 @@ namespace Microsoft.ComponentDetection.Common.Tests;
 [TestCategory("Governance/ComponentDetection")]
 public class LazyComponentStreamTests
 {
+    [TestMethod]
+    public void LazyComponentStreamReadsEntireFile()
+    {
+        var fileContent = new byte[(128 * 1024) + 1];
+        fileContent[0] = 1;
+        fileContent[^1] = 2;
+        var tmpFile = Path.GetTempFileName();
+
+        try
+        {
+            File.WriteAllBytes(tmpFile, fileContent);
+            var lcs = new LazyComponentStream(new FileInfo(tmpFile), "test", Mock.Of<ILogger>());
+
+            using var stream = lcs.Stream;
+            using var actual = new MemoryStream();
+            stream.CopyTo(actual);
+
+            actual.ToArray().Should().Equal(fileContent);
+        }
+        finally
+        {
+            File.Delete(tmpFile);
+        }
+    }
+
     [TestMethod]
     public void LazyComponentStreamWorks()
     {

test/Microsoft.ComponentDetection.Common.Tests/Microsoft.ComponentDetection.Common.Tests.csproj

@@ -8,7 +8,6 @@
       <PackageReference Include="Docker.DotNet" />
       <PackageReference Include="AwesomeAssertions.Analyzers" PrivateAssets="all" />
       <PackageReference Include="Microsoft.Extensions.Logging" />
-      <PackageReference Include="System.Threading.Tasks.Dataflow" />
     </ItemGroup>
 
     <ItemGroup>

test/Microsoft.ComponentDetection.Contracts.Tests/Microsoft.ComponentDetection.Contracts.Tests.csproj

@@ -7,7 +7,6 @@
     <ItemGroup Label="Package References">
         <PackageReference Include="Microsoft.Extensions.Logging" />
         <PackageReference Include="System.Reactive" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="packageurl-dotnet" />
         <PackageReference Include="AwesomeAssertions.Analyzers" PrivateAssets="all" />
     </ItemGroup>

test/Microsoft.ComponentDetection.Detectors.Tests/Microsoft.ComponentDetection.Detectors.Tests.csproj

@@ -13,7 +13,6 @@
         <PackageReference Include="NuGet.Versioning" />
         <PackageReference Include="SemanticVersioning" />
         <PackageReference Include="System.Reactive" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="packageurl-dotnet" />
         <PackageReference Include="Tomlyn.Signed" />
         <PackageReference Include="YamlDotNet" />

test/Microsoft.ComponentDetection.Detectors.Tests/nuget/BinLogProcessorTests.cs

@@ -300,7 +300,7 @@ public async Task MultipleProjectsInSameBuild_ExtractsAll()
         WriteFile(projectBDir, "ProjectB.csproj", projectBContent);
 
         // Create a solution to build both projects in a single binlog
-        await RunDotNetAsync(solutionDir, "new sln --name MultiProject");
+        await RunDotNetAsync(solutionDir, "new sln --format sln --name MultiProject");
         await RunDotNetAsync(solutionDir, $"sln add \"{Path.Combine(projectADir, "ProjectA.csproj")}\"");
         await RunDotNetAsync(solutionDir, $"sln add \"{Path.Combine(projectBDir, "ProjectB.csproj")}\"");
         var binlogPath = Path.Combine(solutionDir, "build.binlog");
@@ -1219,10 +1219,9 @@ public async Task TargetItemUpdateLimitation_UpdateNotVisibleInBinlog()
     }
 
     [TestMethod]
-    public async Task TargetAddsItemButPropertyInvisible_ItemCapturedPropertyNot()
+    public async Task TargetAddsItemAndChangesProperty_BothCaptured()
     {
-        // A single target modifies both a property and adds an item.
-        // Property changes in targets are invisible, but item additions are visible.
+        // MSBuild 18 reports target-level property changes as well as item additions.
         var projectDir = Path.Combine(this.testDir, "ComboPropsItems");
         Directory.CreateDirectory(projectDir);
 
@@ -1254,10 +1253,9 @@ public async Task TargetAddsItemButPropertyInvisible_ItemCapturedPropertyNot()
             p.ProjectPath != null &&
             p.ProjectPath.EndsWith("ComboPropsItems.csproj", StringComparison.OrdinalIgnoreCase));
 
-        // Property change in target is invisible (stays at evaluation value)
         projectInfo.IsTestProject.Should().Be(
-            false,
-            "target-level property changes are not visible in binlog events");
+            true,
+            "target-level property changes are visible in MSBuild 18 binlog events");
         projectInfo.PackageReference.Should().ContainKey("Newtonsoft.Json");
 
         // Item addition in target IS captured via TaskParameter events
@@ -1347,11 +1345,10 @@ public async Task GlobalPropertyAndTargetOverride_TargetWins()
             p.ProjectPath != null &&
             p.ProjectPath.EndsWith("GlobalAndTarget.csproj", StringComparison.OrdinalIgnoreCase));
 
-        // Note: Global properties cannot be overridden by targets in MSBuild.
-        // The global property wins. This tests that we correctly capture this MSBuild behavior.
+        // MSBuild 18 reports the target's reassignment of the initially global property.
         projectInfo.SelfContained.Should().Be(
-            false,
-            "global properties cannot be overridden by targets in MSBuild");
+            true,
+            "target-level property reassignments are captured from MSBuild 18 binlogs");
     }
 
     [TestMethod]

test/Microsoft.ComponentDetection.Orchestrator.Tests/Microsoft.ComponentDetection.Orchestrator.Tests.csproj

@@ -10,7 +10,6 @@
         <PackageReference Include="Serilog" />
         <PackageReference Include="Spectre.Console.Cli" />
         <PackageReference Include="Spectre.Console.Testing" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="AwesomeAssertions.Analyzers" PrivateAssets="all" />
     </ItemGroup>
 

test/Microsoft.ComponentDetection.Orchestrator.Tests/Services/DetectorProcessingServiceTests.cs

@@ -235,7 +235,7 @@ public async Task ProcessDetectorsAsync_ExperimentalDetectorsDoNotReturnComponen
         experimentalDetectorRecord.IsExperimental.Should().BeTrue();
 
         // We should have all components except the ones that came from our experimental detector
-        this.GetDiscoveredComponentsFromDetectorProcessingResult(results).Should().HaveCount(records.Sum(x => x.DetectedComponentCount ?? 0) - experimentalDetectorRecord.DetectedComponentCount ?? 0);
+        this.GetDiscoveredComponentsFromDetectorProcessingResult(results).Should().HaveCount((records.Sum(x => x.DetectedComponentCount ?? 0) - experimentalDetectorRecord.DetectedComponentCount) ?? 0);
         this.GetDiscoveredComponentsFromDetectorProcessingResult(results)
             .Select(x => x.Component as NuGetComponent)
             .Where(x => x != null)

test/Microsoft.ComponentDetection.TestsUtilities/Microsoft.ComponentDetection.TestsUtilities.csproj

@@ -12,7 +12,6 @@
       <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
       <PackageReference Include="Microsoft.Extensions.Logging" />
       <PackageReference Include="System.Reactive" />
-      <PackageReference Include="System.Threading.Tasks.Dataflow" />
     </ItemGroup>
 
 </Project>

test/Microsoft.ComponentDetection.VerificationTests/Microsoft.ComponentDetection.VerificationTests.csproj

@@ -13,7 +13,6 @@
         <PackageReference Include="Microsoft.Extensions.Logging" />
         <PackageReference Include="Newtonsoft.Json.Schema" />
         <PackageReference Include="packageurl-dotnet" />
-        <PackageReference Include="System.Threading.Tasks.Dataflow" />
     </ItemGroup>
 
     <ItemGroup>