[jbogard]

Summary

• Adds Directory.Packages.props with ManagePackageVersionsCentrally; removes Version from every PackageReference.
• Public dependencies of the AutoMapper package are grouped and commented separately. Their versions become the nuspec minimums, so bumping one is a consumer-facing change.
• CentralPackageTransitivePinningEnabled is intentionally off, so test-only pins (the System.Security.Cryptography.Pkcs security pin for SqlClient) can't get promoted into the shipped package's dependencies.
• nuget.config now does <clear /> + nuget.org only. The dnceng dotnet-eng feed was only needed for the commented-out Microsoft.DotNet.ApiCompat reference, which is removed. Keeping an explicit single-source config makes restores independent of machine-level feeds and avoids NU1507, which TreatWarningsAsErrors would turn into a restore failure.
• No versions changed.

Verification

• dotnet build AutoMapper.slnx -c Release: 0 warnings, 0 errors
• Packed AutoMapper before/after: nuspec <dependencies> are identical across all TFMs
• Unit tests 1288/1288, DI tests 33/33, integration tests 133/133 (net10.0, macOS)
• Pkcs still resolves to 10.0.13 in IntegrationTests

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T20:54:39.393983Z	7a7b302	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the central package management migration.

No open issues 🎉

What changed in this PR

Moves AutoMapper’s package versions into central package management while preserving existing versions and public dependency minimums.

Changes:

• Adds Directory.Packages.props, grouping public dependencies separately from build, test, and sample dependencies.
• Removes inline package versions while retaining framework conditions, private assets, and the integration-test security pin.
• Restricts package sources to nuget.org and removes the commented-out ApiCompat reference.

File	Description
src/​UnitTests/​AutoMapper.UnitTests.csproj	Uses centrally managed test dependency versions.
src/​TestApp/​TestApp.csproj	Uses the central dependency injection version.
src/​IntegrationTests/​AutoMapper.IntegrationTests.csproj	Uses central versions, retaining the explicit Pkcs reference.
src/​AutoMapper/​AutoMapper.csproj	Uses central versions while preserving framework conditions and private assets.
src/​AutoMapper.DI.Tests/​AutoMapper.DI.Tests.csproj	Uses centrally managed test dependency versions.
nuget.config	Clears inherited sources and explicitly selects nuget.org.
Directory.Packages.props	Enables central package management and declares existing versions.
AutoMapper.slnx	Adds the central package file to solution items.

_{Review effort: Balanced}