Nuget Package Update

[martindevans]

Updated all nuget packages except for AspNetCore.Mvc>Razor.RuntimeCompilation which would require dotnet10

@zsogitbe review request. This is a more conservative replacement for #1357.

[martindevans]

(Same package conflict as the other PR, still working on that) fixed 🤞

[zsogitbe]

I have checked it quickly Martin and I think that we will run into some compilation issues because some packages are Net10 (<PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.4.0" />, <PackageReference Include="System.Numerics.Tensors" Version="10.0.5" />, <PackageReference Include="System.Text.Json" Version="10.0.3" />) and others are Net8 (<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.24" />). I am seeing a lot of such items.

Semantic Kernel will probably also cause some issues <PackageReference Include="Microsoft.SemanticKernel.Abstractions" Version="1.73.0" />. Especially, because they have just completely replaced KernelMemory with a partially implemented new version (I do not find this a very good idea, but we cannot do anything about it).

I think that we should be careful with versioning and only update when it is really needed. One update may cause a lot of issues upstream in any module or example. This was the reason for my original remark.

[martindevans]

The 10.x in the package versions does not necessarily correspond to .net10 support only. For example here is the support matrix for System.Text.Json v10.0.5:

• net8
• net9
• net10
• netstandard2
• net462

Nuget wouldn't even let me install it if it didn't support the versions we're targetting!

Microsoft.SemanticKernel.Abstractions

I don't really know anything about SemanticKernel/KernelMemory tbh. I just upgraded the versions and fixed any breakage (there was none this time). What's the issue?

I think that we should be careful with versioning and only update when it is really needed. One update may cause a lot of issues upstream in any module or example. This was the reason for my original remark.

Definitely a fair policy. However, one of the packages originally had a vulnerability warning which was the motivation to update. Obviously I could update just that one package this time, but there is that incoming .NET8 deprecation cliff which will force a wider upgrade eventually.

[zsogitbe]

I completely trust whatever you decide. I just wanted to highlight the pain points I regularly encounter, especially around package version updates - I’m always cautious with those.

Regarding SemanticKernel and KernelMemory: they have indeed restarted KernelMemory from scratch, and the new KM² (KernelMemory v2) is now a very minimal, experimental research project with no stability or compatibility guarantees. It’s being rebuilt with a different architecture and technology stack, so I don’t expect it to remain compatible with SemanticKernel at all.

I know this is already a problem or will become one soon, but I can’t pinpoint the exact version where incompatibility starts. If I were in your position, I wouldn’t update SemanticKernel for now. Someone will need to evaluate what we want to keep going forward.

[martindevans]

Thanks for the info on SM/KM, that's good to know. For now I think I'll back out of the updates for those two packages and go ahead with the others, that seems like the safest approach.

We'll have to evaluate in a couple of months what the state of SM/KM is and if we need to create entirely new integration packages (or possibly drop the integrations altogether - they don't see much development activity).