backend/Directory.Packages.props
Rama main · réplica de lectura del repositorio original.
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.1" />
<!-- The only prerelease pin in the repository. AddEFMigrations is the sole supported way to run dotnet-ef against
the orchestration on Aspire 13: the aspire exec command that earlier versions offered no longer exists, and the
package ships no stable build. It is referenced by AppHost alone, so nothing it carries reaches a deployed
assembly. -->
<PackageVersion Include="Aspire.Hosting.EntityFrameworkCore" Version="13.6.1-preview.1.26506.6" />
<PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.6.1" />
<PackageVersion Include="Aspire.Hosting.Testing" Version="13.6.1" />
<!-- The Valkey hosting integration, which is what lets a developer's orchestration and the integration suite start
the RESP server the client signal backplane crosses. Referenced by AppHost alone, so nothing it carries reaches
a deployed assembly; what a deployment runs beside MailFathom is the server rather than this package. -->
<PackageVersion Include="Aspire.Hosting.Valkey" Version="13.6.1" />
<PackageVersion Include="Aspire.Npgsql.EntityFrameworkCore.PostgreSQL" Version="13.6.1" />
<!-- The non-interactive Microsoft Entra credentials an Azure OpenAI endpoint is reached with where no key exists to
provision. Referenced by AI alone, and only for the four credential types a background service can hold; the
chain is composed explicitly rather than through DefaultAzureCredential, which would reach a developer tool. -->
<PackageVersion Include="Azure.Identity" Version="1.21.0" />
<!-- The client an S3-compatible endpoint is reached over, chosen on shape by ADR 0017 § 8. Referenced by
Infrastructure alone, so every Amazon type stays inside the object-storage adapter. It declares exactly one
dependency, AWSSDK.Core below, which is the second half of the same decision: the alternative clients each
brought a stack this repository takes nowhere else. Both are Apache-2.0 and both carry a row in
THIRD_PARTY_LICENSES.md. -->
<PackageVersion Include="AWSSDK.S3" Version="4.0.104.3" />
<!-- The runtime behind AWSSDK.S3 rather than a dependency of MailFathom's own: the credential, the endpoint, the
signer, and the client configuration are its types. Pinned directly for the reason MimeKit is — the version the
code compiles against is decided here instead of inherited from another package's dependency range — and it
carries no package dependencies of its own on the net8.0 assets .NET 10 resolves. -->
<PackageVersion Include="AWSSDK.Core" Version="4.0.102.10" />
<PackageVersion Include="System.CommandLine" Version="2.0.12" />
<!-- What draws the command's output: the tables its listings are laid out in, and the colour that tells a failure
from a result. Referenced by Cli alone. It brings Spectre.Console.Ansi with it, which is the same project under
the same licence, so both carry a row in THIRD_PARTY_LICENSES.md. Both are trimmable and the trimmed publish is
what proves it, since nothing a pull request runs reaches one. -->
<PackageVersion Include="Spectre.Console" Version="0.57.2" />
<!-- DPAPI, which the base class library does not carry: it ships as this package rather than in the shared
framework, because it exists on one platform. The command uses it to bind its credential key to the current
Windows user, and guards the call with a runtime platform check, so a Linux build carries it and never enters
it. -->
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
<!-- The YAML parser and emitter. Referenced by Host, which reads a provisioned configuration file written in YAML,
and by Cli, which offers a YAML view of a document it opens in the operator's editor. Both use only the
event-level parser and emitter in YamlDotNet.Core, never the reflection-based serializer, which is what keeps
the trimmed command free of it. MIT, no package dependencies, and a row in THIRD_PARTY_LICENSES.md. -->
<PackageVersion Include="YamlDotNet" Version="18.1.0" />
<!-- The throughput harness `backend/tests/Benchmarks` reports with, and nothing else: it is referenced by that project
alone, ships nowhere, and gates nothing. Its `net8.0` assets are what .NET 10 resolves, and it recognizes
net10.0 as a runtime of its own. It brings sixteen transitive packages with it, every one of them recorded in
THIRD_PARTY_LICENSES.md beside it. -->
<PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
<PackageVersion Include="coverlet.MTP" Version="10.1.0" />
<!-- The generator behind the property tests, which state an invariant once and let generated inputs hunt for the
counterexample an example test cannot reach. It carries no dependency of its own and couples to no test
framework — a property is an ordinary [Fact] calling into it — so it costs one assembly in three unit-test
projects and changes nothing about how the suite is discovered or run. -->
<PackageVersion Include="CsCheck" Version="4.9.1" />
<!-- The HTML parser both readings of a message body run on. It used to arrive only behind HtmlSanitizer, which
is why the pin below notes that a direct reference was not foreclosed; backend/src/Infrastructure now holds a
parsed document to reduce into the client's MailDocument, so the version the code compiles against is decided
here rather than inherited from a dependency range. The two are held together deliberately: HtmlSanitizer
declares AngleSharp as a range, and a version resolved for the sanitizer that differed from the one this
reduction compiled against would be two readings of one body by two parsers, which is the thing the whole
projection exists to avoid. MIT, and recorded in THIRD_PARTY_LICENSES.md as a direct dependency. -->
<PackageVersion Include="AngleSharp" Version="1.8.4" />
<!-- The CSS object model the sanitizing policy names. It arrived transitively behind HtmlSanitizer and is pinned
directly for the same reason AngleSharp above is: the self-contained representation states which at-rules a
message may keep, and CssRuleType is that library's type rather than the sanitizer's. A version resolved for
the sanitizer that differed from the one this policy compiled against would decide the at-rule set somewhere
other than here. The pin sits above the floor HtmlSanitizer declares, as the parser's does, so the version in
the closure is the one named here. MIT, and recorded in THIRD_PARTY_LICENSES.md as a direct dependency. -->
<PackageVersion Include="AngleSharp.Css" Version="1.1.2" />
<!-- Declares AngleSharp and AngleSharp.Css as floors, both MIT and both pinned directly above at or past them. The
9.1 line replaced the exact AngleSharp pin the 9.0 line carried, which is what let the direct reference above
be taken, and AngleSharp publishes a net10.0 target of its own. -->
<PackageVersion Include="HtmlSanitizer" Version="9.2.1039" />
<!-- The DNS client the local DKIM verification resolves published keys with. The platform offers no TXT lookup at
all — System.Net.Dns resolves addresses and nothing else — so the alternative was a hand-written resolver
parsing untrusted wire data. It is Apache-2.0, carries no dependencies of its own on its net8.0 target, and
reads the operating system's own resolver configuration rather than naming a nameserver of its own. -->
<PackageVersion Include="DnsClient" Version="1.8.0" />
<!-- MimeKit brings this in transitively, and MailFathom compiles against it: the DKIM key locator names the key type
MimeKit's locator contract returns, an account's OpenPGP signing key is read with its parser, message
signature verification calls its CMS, OCSP, CRL, and OpenPGP readers, and an organization's Ed25519 signing key
is generated with it. Pinned directly for the reason MimeKit itself is: a version the code compiles against is
decided here rather than inherited from another package's dependency range. -->
<PackageVersion Include="BouncyCastle.Cryptography" Version="2.7.0" />
<PackageVersion Include="MailKit" Version="4.18.1" />
<PackageVersion Include="MimeKit" Version="4.18.1" />
<!-- MimeKit brings this in transitively at 10.0.0, inside the range two .NET denial-of-service advisories cover.
Pinned at the fixed release so the version every mail project resolves is decided here rather than by
MimeKit's dependency floor. -->
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
<!-- The iCalendar (RFC 5545) reader an imported `.ics` file is parsed by. The base class library carries none, and
the format is exactly the kind nobody hand-rolls safely: lines are folded at 75 octets, values escape their own
separators, every property carries parameters, and a date names a zone, a UTC instant, or neither. Referenced
by Infrastructure alone, so every Ical.Net type stays inside the reader under Calendar/ and the application
sees entries of MailFathom's own. It brings NodaTime with it, which is its zone database and is named nowhere
in this repository; both are recorded in THIRD_PARTY_LICENSES.md. -->
<PackageVersion Include="Ical.Net" Version="5.2.3" />
<PackageVersion Include="Microsoft.Agents.AI" Version="1.24.0" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
<!-- The OpenAPI document generator, which ships outside the shared framework. It builds the HTTP contract from the
routes the host already mapped rather than from a second description somebody keeps in step. Referenced by Host
alone, where the document is registered only when the environment is Development. -->
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
<!-- The SignalR backplane, which ships outside the shared framework the hub itself is part of. It is what carries a
client signal from the replica that raised it to the replica holding that client's connection, and it is
registered only where a deployment declared a RESP endpoint to carry it over — so a single-replica deployment
restores it and connects to nothing. Referenced by Host alone. -->
<PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.12" />
<!-- The backplane brings this in transitively at 2.5.302, below the release that fixes a buffer-limit advisory against
nested arrays. Pinned at the fixed release so the version the host resolves is decided here rather than by the
backplane's dependency floor. -->
<PackageVersion Include="MessagePack" Version="2.5.303" />
<!-- The .NET SignalR client, referenced by the integration suite alone: the claim that a signal crosses replicas is
only observable from a connection somebody is holding, and holding one means speaking the hub protocol over a
real WebSocket. Nothing under backend/src references it — the client a deployment serves is the browser's
@microsoft/signalr, pinned in the client workspace. -->
<PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.13" />
<!-- The OpenAPI object model, brought in transitively by the generator above and pinned directly for the reason
BouncyCastle.Cryptography is: the document and operation transformers name its types, so the version this
repository compiles against is decided here rather than inherited from another package's dependency range.
That range is also the ceiling: the generator declares [2.12.0, 3.0.0), so this pin moves inside the 2.x line
and takes the next major when the generator does. A 3.x version here fails the restore with NU1608. -->
<PackageVersion Include="Microsoft.OpenApi" Version="2.12.2" />
<PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.401" />
<PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="18.12.1" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.AI" Version="10.11.0" />
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0" />
<PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.11.0" />
<PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.11.0" />
<!-- The agent evaluation suite under backend/tests/Evaluations and nothing else. The family ships a release line of
its own beside Microsoft.Extensions.AI, and the Agent Framework brings the core package with it, so these move
together with those two pins or not at all. NLP is not taken: no scenario scores an answer against reference
text, and the package publishes previews only. Safety is not taken either: it needs the Microsoft Foundry
evaluation service, and nothing here runs on Azure. -->
<PackageVersion Include="Microsoft.Extensions.AI.Evaluation" Version="10.11.0" />
<PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.11.0" />
<PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.11.0" />
<!-- One client library reaches both supported providers. Azure OpenAI's v1 data plane is OpenAI-compatible, so an
Azure deployment is this client pointed at `<resource>/openai/v1/`, which is what Microsoft's own current
guidance shows; Azure.AI.OpenAI would be a second client construction and has published no stable release
since 2.1.0. -->
<PackageVersion Include="OpenAI" Version="2.14.0" />
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
<PackageVersion Include="Microsoft.Security.Utilities.Core" Version="1.21.0" />
<PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.10.0" />
<PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.19.1" />
<PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.19.1" />
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.19.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.19.0" />
<PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.19.0" />
<PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
<!-- The expression language a mail rule's condition is written in, taken as the package that carries the
asynchronous evaluator because a fact resolves through I/O. Referenced by Infrastructure alone, where the
parser, the validating walk, and the evaluator live. Its graph is wider than the package name suggests —
NCalc.Core, NCalc.Parser, and NCalc.Domain, plus Parlot and ExtendedNumerics.BigDecimal — so every one of
them carries a row of its own in THIRD_PARTY_LICENSES.md, and Parlot is not under the same licence as the
rest. ADR 0010 records why an expression language is admissible here at all and what the closed environment
around it has to guarantee. -->
<PackageVersion Include="NCalc" Version="7.2.0" />
<PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
<!-- The PDF reader an attachment's text is extracted with. Referenced by Infrastructure alone, so every PdfPig type
stays inside the adapter under Documents/ and the application port sees characters and a closed set of reasons.
It declares no package dependency at all on the net8.0 assets .NET 10 resolves, which is most of why it was
chosen over the alternatives: the three Office Open XML formats are read by the base class library here, so
this is the only parser the register has to admit. Apache-2.0, and it carries a row in
THIRD_PARTY_LICENSES.md. -->
<PackageVersion Include="PdfPig" Version="0.1.16" />
<PackageVersion Include="NSubstitute" Version="6.2.0" />
<PackageVersion Include="Roslynator.Analyzers" Version="5.0.1" />
<PackageVersion Include="Roslynator.CodeAnalysis.Analyzers" Version="5.0.1" />
<PackageVersion Include="Roslynator.Formatting.Analyzers" Version="5.0.1" />
<PackageVersion Include="Pgvector.EntityFrameworkCore" Version="0.3.0" />
<PackageVersion Include="Polly.Core" Version="8.8.0" />
<PackageVersion Include="Polly.Extensions" Version="8.8.0" />
<PackageVersion Include="Polly.RateLimiting" Version="8.8.0" />
<PackageVersion Include="System.Threading.RateLimiting" Version="10.0.12" />
<!-- The API explorer the generated document is read in. It carries no package dependency of its own and serves its
own script bundle out of the assembly, so a running instance fetches nothing from a content delivery network.
Referenced by Host alone, and mapped only when the environment is Development — the assembly is redistributed
with the image either way, which is why THIRD_PARTY_LICENSES.md records it among the shipped components. -->
<PackageVersion Include="Scalar.AspNetCore" Version="2.18.0" />
<!-- The boundary rules that read compiled intermediate language rather than assembly metadata, referenced by
Boundaries.UnitTests alone. The pin is the xUnit v3 integration, which carries the analyzer itself and with it
Mono.Cecil, the reader that makes a method body visible at all, plus Newtonsoft.Json, JetBrains.Annotations,
CycleDetection, and System.ValueTuple. Seven packages for one test project is the whole cost of the
mechanism, and THIRD_PARTY_LICENSES.md records every one of them. -->
<PackageVersion Include="TngTech.ArchUnitNET.xUnitV3" Version="0.13.4" />
<PackageVersion Include="xRetry.v3" Version="1.0.0" />
<PackageVersion Include="xunit.analyzers" Version="2.2.0" />
<PackageVersion Include="xunit.v3.mtp-v2" Version="4.0.2" />
</ItemGroup>
</Project>