Version.props

<Project>
    <!-- Centralized semantic version properties -->
    <PropertyGroup>
        <!-- Major.Minor.Patch — synced manually before each release; CI overrides at pack time
             via -p:Version=${tag}, so this only affects local `dotnet pack` output. Keep in sync
             with the latest tag to avoid producing stale-versioned packages locally. -->
        <VersionPrefix>5.4.0</VersionPrefix>

        <!-- Pre-release suffix (e.g., -beta1, -ci.123) -->
        <VersionSuffix></VersionSuffix>

        <!-- Effective Version -->
        <Version Condition="'$(Version)' == '' and '$(VersionSuffix)' == ''">$(VersionPrefix)</Version>
        <Version Condition="'$(Version)' == '' and '$(VersionSuffix)' != ''">$(VersionPrefix)-$(VersionSuffix)</Version>

        <!-- Derived versions -->
        <PackageVersion>$(Version)</PackageVersion>
        <AssemblyVersion>$(VersionPrefix).0</AssemblyVersion>
        <FileVersion>$(Version)</FileVersion>
        <InformationalVersion>$(Version)</InformationalVersion>
    </PropertyGroup>

    <!-- Dependency versions -->
    <PropertyGroup>
        <MeziantouAnalyzerVersion>3.0.117</MeziantouAnalyzerVersion>
        <ANcpLuaRoslynUtilitiesVersion>2.2.29</ANcpLuaRoslynUtilitiesVersion>
        <!-- Override the SDK-default analyzer version. ANcpLua.NET.Sdk injects ANcpLua.Analyzers via
             GlobalPackageReference Version="$(ANcpLuaAnalyzersVersion)"; Version.props imports after the SDK
             default so this wins. 2.0.2 gates AL1204-AL1219 to projects referencing ANcpLua.Roslyn.Utilities. -->
        <ANcpLuaAnalyzersVersion>2.0.2</ANcpLuaAnalyzersVersion>
        <MicrosoftCodeAnalysisAnalyzersVersion>5.3.0</MicrosoftCodeAnalysisAnalyzersVersion>
        <MicrosoftCodeAnalysisCSharpVersion>5.3.0</MicrosoftCodeAnalysisCSharpVersion>
        <MicrosoftSbomTargetsVersion>4.1.5</MicrosoftSbomTargetsVersion>
        <ErrorProneNETCoreAnalyzersVersion>0.8.2-beta.1</ErrorProneNETCoreAnalyzersVersion>
        <ErrorProneNETStructsVersion>0.6.1-beta.1</ErrorProneNETStructsVersion>
        <RoslynatorAnalyzersVersion>4.15.0</RoslynatorAnalyzersVersion>
        <JonSkeetRoslynAnalyzersVersion>1.0.0-beta.7</JonSkeetRoslynAnalyzersVersion>
        <MicrosoftSourceLinkGitHubVersion>10.0.300</MicrosoftSourceLinkGitHubVersion>
        <MicrosoftBclHashCodeVersion>6.0.0</MicrosoftBclHashCodeVersion>
        <VerifyXunitV3Version>31.20.0</VerifyXunitV3Version>
        <MicrosoftCodeAnalysisTestingVersion>1.1.3</MicrosoftCodeAnalysisTestingVersion>
        <XunitV3MtpV2Version>3.2.2</XunitV3MtpV2Version>
        <MicrosoftAspNetCoreOpenApiVersion>10.0.9</MicrosoftAspNetCoreOpenApiVersion>
        <!-- Transitive pin: Microsoft.AspNetCore.OpenApi 10.0.9 pulls in Microsoft.OpenApi 2.0.0, which is
             vulnerable to CVE-2026-49451 (GHSA-v5pm-xwqc-g5wc, stack overflow on circular schema refs).
             Patched in the 2.x line at 2.7.5; pin to the latest 2.x to satisfy NU1903 (warnings-as-errors)
             while staying API-compatible with AspNetCore.OpenApi 10.x. Remove once the ASP.NET package
             references a patched Microsoft.OpenApi transitively. -->
        <MicrosoftOpenApiVersion>2.9.0</MicrosoftOpenApiVersion>
        <MicrosoftAspNetCoreMvcTestingVersion>10.0.8</MicrosoftAspNetCoreMvcTestingVersion>
        <MicrosoftAspNetCoreTestHostVersion>10.0.8</MicrosoftAspNetCoreTestHostVersion>
        <AspVersioningHttpVersion>10.0.0</AspVersioningHttpVersion>
    </PropertyGroup>
</Project>