MMLib.Alvo/Directory.Packages.props at 0455e9a7a8fb0e66a4a11362e63016df172165d0 · Burgyn/MMLib.Alvo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
<Project>

  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <!-- Microsoft.EntityFrameworkCore.Sqlite 10.0.0 transitively drags in
         SQLitePCLRaw.lib.e_sqlite3 2.1.11, which carries a known-high NuGet
         audit advisory (GHSA-2m69-gcr7-jv3q, CVE-2025-6965, a SQLite memory
         corruption issue fixed upstream in SQLite 3.50.2). Central transitive
         pinning lets the explicit SQLitePCLRaw.lib.e_sqlite3 PackageVersion
         below win over that transitive version without a direct package
         reference in any project. -->
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>

  <ItemGroup>
    <PackageVersion Include="xunit.v3" Version="3.2.2" />
    <!-- The full xunit.v3 package requires OutputType=Exe (it carries the
         in-process runner); MMLib.Alvo.Testing is a class library that only
         declares [Fact] test methods for downstream Exe test projects to
         inherit, so it takes the attribute/extensibility surface alone. -->
    <PackageVersion Include="xunit.v3.extensibility.core" Version="3.2.2" />
    <PackageVersion Include="Corvus.Json.Validator" Version="5.3.2" />
    <!-- Corvus.Json.SourceGenerator + Corvus.Json.ExtendedTypes replace JsonSchema.Net (whose 9.x
         line carries a maintenance-fee EULA on top of MIT) as the descriptor schema-pass
         validator: Apache-2.0, build-time source generation only (no runtime Roslyn, no
         PreserveCompilationContext), used by core MMLib.Alvo. -->
    <PackageVersion Include="Corvus.Json.SourceGenerator" Version="5.3.2" />
    <PackageVersion Include="Corvus.Json.ExtendedTypes" Version="5.3.2" />
    <PackageVersion Include="CsCheck" Version="4.8.0" />
    <PackageVersion Include="NetArchTest.Rules" Version="1.3.2" />
    <PackageVersion Include="Shouldly" Version="4.3.0" />
    <PackageVersion Include="NSubstitute" Version="6.2.0" />
    <PackageVersion Include="PublicApiGenerator" Version="11.5.4" />
    <PackageVersion Include="Verify.XunitV3" Version="31.28.0" />
    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
    <!-- First-party ASP.NET Core tooling the core uses to emit the OpenAPI document. The ASP.NET Core
         surface itself arrives through <FrameworkReference Include="Microsoft.AspNetCore.App" />, whose
         version is the shared framework's and therefore not pinned here. -->
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
    <!-- Microsoft.AspNetCore.OpenApi 10.0.10 transitively drags in Microsoft.OpenApi 2.0.0, which carries
         a known-high NuGet audit advisory (GHSA-v5pm-xwqc-g5wc — a circular schema reference terminates
         parsing, fixed upstream in 2.7.5). Same central transitive-pinning trick as SQLitePCLRaw and
         System.Security.Cryptography.Xml below: pin the first patched version so it wins over the
         transitive one, without any project taking a direct reference. -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
    <!-- The docs UI MMLib.Alvo.Host renders the OpenAPI document with. MIT (verified on the 2.16.17
         nuspec: <license type="expression">MIT</license>). Host-only by the package-boundary rule: a
         docs UI is a hosting decision (the F3 design's OpenAPI and Scalar section), so the core stays
         on Microsoft.AspNetCore.OpenApi alone and an embedded consumer picks its own UI or none. -->
    <PackageVersion Include="Scalar.AspNetCore" Version="2.16.20" />
    <!-- Test-only: an in-process TestServer for the Data API suite. WebApplicationFactory is
         deliberately not used — it needs an entry-point assembly, which does not exist until
         MMLib.Alvo.Host lands in PR4. -->
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.10" />
    <!-- Test-only: the CloudEvents conformance oracle. Apache-2.0. NOT a shipped dependency, and the
         package-boundary rule is why: MMLib.Alvo.Abstractions may take no new external dependency, so the
         envelope is hand-written there; and nothing in the core needs the SDK at run time, because Alvo
         serializes its own envelope for the outbox row and for webhook delivery. What the SDK is used for is
         enforcing CloudEvents' attribute-naming rule at test time (CloudEventAttribute.CreateExtension
         throws on an illegal name), so conformance is proven by the specification's own implementation
         rather than by a reading of the specification. -->
    <PackageVersion Include="CloudNative.CloudEvents" Version="2.9.0" />
    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
    <PackageVersion Include="MinVer" Version="7.0.0" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
    <!-- Test-only: bootstraps each provider's design-time services (IDatabaseModelFactory is
         design-time-only in modern EF Core, never registered by the runtime AddDbContext/UseX
         pipeline) so EfCoreSchemaIntrospector has a real factory to drive in-process, without a
         dotnet-ef dependency. See EfCoreSchemaMigratorApplyTests. -->
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.0" />
    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
    <!-- Microsoft.EntityFrameworkCore.Design 10.0.0 transitively drags in
         System.Security.Cryptography.Xml 9.0.0, which carries a known-high NuGet
         audit advisory (GHSA-23rf-6693-g89p et al., CVE-2026-50648, a DoS in
         EncryptedXml). Same central transitive-pinning trick as SQLitePCLRaw
         above: pin the patched version so it wins over the transitive one. -->
    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
  </ItemGroup>

  <!-- Analyzers for every project (CPM global = PrivateAssets=all, no per-csproj
       entries). Roslynator severities were already configured in .editorconfig;
       this makes them actually run. Apache-2.0. -->
  <ItemGroup>
    <GlobalPackageReference Include="Roslynator.Analyzers" Version="4.16.0" />
  </ItemGroup>

</Project>