- Add Directory.Packages.props (CPM): all package versions centralized,
remove Version attributes from every PackageReference
- Add Directory.Build.props: shared TargetFramework/Nullable/ImplicitUsings
- Drop redundant per-project RootNamespace/AssemblyName (default = project name)
and stale NuGet metadata (PackageId/Version/Authors/RepositoryUrl)
- Bump Microsoft.OpenApi to 2.9.0 (CVE-2026-49451, was transitive 2.0.0);
add explicit reference in Musify.Api which uses it directly
- Add repo-scoped nuget.config pinning nuget.org for reproducible restore
Build: 0 warnings, 0 errors.