[PM-39513] chore: Pin library project versions to 0.0.1

[justindbaur]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39513

Follow-up to the churn seen in #8179 (Bump version to 2026.8.0).

📔 Objective

Every project's <Version> is recorded in each consumer's packages.lock.json, so bumping
<Version> in the root Directory.Build.props rewrites ~60 of the 77 lock files on every
release. This pins projects that are only ever consumed as libraries to 0.0.1 so those
entries stop moving, extending the pattern already established in
src/Libraries/Directory.Build.props to the libraries living outside that folder.

15 projects pinned

• src/: Core, HttpExtensions, Infrastructure.Dapper, Infrastructure.EntityFramework, SharedWeb, Pam.Domain
• bitwarden_license/src/: Commercial.Core, Commercial.Infrastructure.EntityFramework
• util/: Migrator, MySqlMigrations, PostgresMigrations, SqliteMigrations, RustSdk, Seeder
• test/: Common

Impact

Measured by pointing Directory.Build.props at a throwaway next version and running
dotnet restore --force-evaluate:

	lock files touched by a version bump
before	60 / 77
after	11 / 77

Pam.Domain was the single biggest contributor — unpinned, it alone accounted for 40 files,
because both Infrastructure.Dapper and Infrastructure.EntityFramework reference it and it
therefore leaks into nearly every closure.

The remaining 11 are integration-test projects that legitimately reference Identity, Api,
or Pam. That is the floor without pinning the deployable services themselves.

Why this is safe

Nothing reports these assemblies' versions. MapVersionEndpoint() resolves
IBitwardenEnvironment.Version, which reads the entry assembly's
AssemblyInformationalVersionAttribute — and every deployable service (Api, Identity, Admin,
Events, EventsProcessor, Icons, Notifications, Billing, Sso, Scim, SeederApi, Pam) is left
unpinned. Admin's self-hosted "installed version" panel uses the same accessor. None of these
projects are packed or pushed to a feed, and none are strong-named.

Note on test/Migrator.Test/packages.lock.json

This is the one lock file whose diff is not purely the version pin. It was committed stale in
#8143 (added 2026-08-17, a week after the 2026-08-10 bump) and still referenced 2026.7.2
plus older Microsoft.Extensions.* patch versions. --force-evaluate corrected it. The other
59 lock files contain version-pin changes only.

📸 Screenshots

N/A — build configuration only.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the addition of <Version>0.0.1</Version> to 15 library-only projects across src/, bitwarden_license/src/, util/, and test/, plus the 60 regenerated packages.lock.json files. Verified that no code path reads these assemblies' versions (IBitwardenEnvironment.Version is the only version surface, and every entry-point service remains unpinned), that no project is packed, signed, or resolved by assembly-qualified name, and that repository-management.yml only rewrites the root Directory.Build.props. Confirmed the lock file diffs contain nothing but the 2026.8.0 → 0.0.1 project-version pin, with the sole exception of test/Migrator.Test/packages.lock.json — matching the PR description's stale-lock explanation. The approach extends the existing convention in src/Libraries/Directory.Build.props, and HttpExtensions.Test correctly needs no lock update since a direct project reference is recorded without a version range.

Code Review Details

No findings.

Notes for the reviewer (not findings):

• The test/Migrator.Test lock corrections resolve real drift: Stripe.net 48.5.0 → 52.1.0 (matching Core.csproj's [52.1.0] pin), Microsoft.Extensions.* 10.0.8/10.0.9 → 10.0.10, System.Configuration.ConfigurationManager 8.0.0 → 9.0.0, and the previously missing serilogfilelogging project entry. These are lock-file-only and bring the file in line with the manifests already on main.
• CI was still in progress at review time; the dotnet restore --locked-mode and Docker build jobs are the real verification that no consumer lock file was missed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.57%. Comparing base (fc5ea9a) to head (2205637).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8238      +/-   ##
==========================================
+ Coverage   63.28%   68.57%   +5.28%     
==========================================
  Files        2401     2401              
  Lines      104003   104043      +40     
  Branches     9417     9426       +9     
==========================================
+ Hits        65817    71344    +5527     
+ Misses      35930    30341    -5589     
- Partials     2256     2358     +102     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.