`packages update` and the migrate-cpm props merge strip the UTF-8 BOM from every csproj/props they rewrite

[matt-edmondson]

What's wrong

KtsuTools.Packages/PackagesService.cs reads project files with File.ReadAllTextAsync, which drops the byte-order mark. It writes them back with File.WriteAllTextAsync, whose default is UTF-8 without a BOM. This happens in:

• UpdatePackageVersionInFileAsync, around L404, used by packages update;
• MergePackagesPropsAsync, around L533, used by packages migrate-cpm when a Directory.Packages.props already exists.

SerializeLikeOriginal restores the XML declaration and line endings, but not the encoding preamble.

Reproduced at HEAD 3908181. A csproj beginning EF BB BF 3C 50 72 … (BOM + <Pr) starts with 3C 50 72 after UpdatePackageVersionInFileAsync(path, "X", "2.0.0").

Why it matters

#194 was fixed so that project files are written back "as they were". Visual Studio creates csproj and props files with a BOM by default, so every packages update run still produces a whole-file encoding change in the diff alongside the one-line version bump.

Related issues:

• packages migrate-cpm drops the XML declaration and converts CRLF to LF in every csproj, and misses <Version> child elements #213 covers migrate-cpm's csproj rewrite losing the declaration and CRLF, but doesn't mention the BOM or these two code paths.
• merge strips BOMs and corrupts non-UTF-8 files in every file it rewrites #209 is the same BOM problem in the merge subcommand.

Suggested fix

Detect the encoding when reading and write back with the same one. For example, read with a StreamReader(detectEncodingFromByteOrderMarks: true) and keep CurrentEncoding, or check for the 3-byte preamble and write with new UTF8Encoding(encoderShouldEmitUTF8Identifier: hadBom). A shared helper could serve #213 and #209 too.

Acceptance criteria

• A csproj with a BOM and CRLF line endings, run through packages update, is byte-identical afterwards apart from the changed Version attribute.
• The same holds for a Directory.Packages.props merged by migrate-cpm.
• Files without a BOM stay without one.

[matt-edmondson]

Triage

• Category: Bug

• Priority: Low. Nothing is corrupted and builds are unaffected. The cost is a whole-file encoding change in the diff on every packages update or props merge, which is noisy but easy to revert.

• Area: KtsuTools.Packages/PackagesService.cs (UpdatePackageVersionInFileAsync, MergePackagesPropsAsync).

• Suggested assignment: Packages module maintainer.

• Related, not duplicates:

  • merge strips BOMs and corrupts non-UTF-8 files in every file it rewrites #209 is the same BOM loss in merge.
  • packages migrate-cpm drops the XML declaration and converts CRLF to LF in every csproj, and misses <Version> child elements #213 is migrate-cpm's csproj rewrite losing the declaration and CRLF.

  One encoding-preserving read/write helper would fix all three, so they are worth doing together.

• Duplicates / in progress: None found. The open PRs (Bump the ktsu group with 11 updates #227, Bump Spectre.Console, Spectre.Console.Ansi and Spectre.Console.Cli #228) are dependency bumps.

---

Generated by Claude Code