Directory.Build.props

<Project>

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <LangVersion>latest</LangVersion>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
    <InvariantGlobalization>false</InvariantGlobalization>
    <!--
      On, and auditing transitive packages too. A mail client is the wrong place to be quiet
      about a known-vulnerable dependency, and with TreatWarningsAsErrors this is a build gate
      rather than a note nobody reads. See §19.
    -->
    <NuGetAudit>true</NuGetAudit>
    <NuGetAuditMode>all</NuGetAuditMode>
    <NuGetAuditLevel>low</NuGetAuditLevel>
  </PropertyGroup>

  <PropertyGroup>
    <Product>Mailbox</Product>
    <Company>Mailbox</Company>
    <Authors>codingncaffeine</Authors>
    <Copyright>Copyright (C) 2026 Mailbox contributors</Copyright>
    <PackageLicenseExpression>GPL-3.0-or-later</PackageLicenseExpression>
    <VersionPrefix>0.7.0</VersionPrefix>
  </PropertyGroup>

  <!--
    Central package versions. Bump here, nowhere else — a version written on a
    PackageReference is one this file cannot see, and two copies of a number drift the day
    only one of them is bumped.
  -->
  <PropertyGroup>
    <AvaloniaVersion>12.1.1</AvaloniaVersion>
    <!-- Chromium for the reading pane: the binding and the CEF build it speaks to move together
         (154.x = Chromium 154). A new Chromium is a new pair, and a release. -->
    <CefGlueVersion>154.8037.94</CefGlueVersion>
    <CefRuntimeVersion>154.0.33</CefRuntimeVersion>
    <MailKitVersion>4.17.0</MailKitVersion>
    <SqliteVersion>10.0.11</SqliteVersion>
    <!--
      The native SQLite the stores actually run on. Microsoft.Data.Sqlite is the managed half
      and brings its own build; this replaces it with SQLite3 Multiple Ciphers, which is the same
      SQLite plus page-level encryption. Deliberately not SQLCipher's own bundle: that ships
      SQLite 3.39, fourteen releases behind, and encrypting the store is no reason to give every
      reader who never turns it on a four-year-old database engine. This one is 3.53.4 — a patch
      ahead of the bundle it replaces — and carries linux-x64 and linux-arm64 natives, which the
      aarch64 packaging needs.
    -->
    <SqliteCiphersVersion>2.4.0</SqliteCiphersVersion>
    <!-- The LDAP client for the directory address book; Microsoft's, on the runtime's own
         servicing band. -->
    <LdapVersion>10.0.11</LdapVersion>
    <IcalNetVersion>5.2.3</IcalNetVersion>
    <VCardsVersion>8.1.2</VCardsVersion>
    <RichEditorVersion>1.1.0</RichEditorVersion>
    <HunspellVersion>7.0.1</HunspellVersion>
    <!-- Mailbox.Security compiles against Org.BouncyCastle directly — S/MIME, OpenPGP, DKIM
         and the passphrase vault all name its types. It used to arrive only as MimeKit's own
         dependency, which meant its version was whatever MimeKit happened to resolve and a
         MimeKit bump that dropped or majored it would have broken the build with nothing here
         to say why. 2.6.2 is what MimeKit 4.17.0 resolves today, so pinning it changes no
         binary; it only makes the dependency one we chose rather than one we inherited. -->
    <BouncyCastleVersion>2.6.2</BouncyCastleVersion>
    <!-- MimeKit 4.17.0 asks for System.Security.Cryptography.Pkcs 10.0.0, which carries two
         denial-of-service advisories (GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7) fixed in 10.0.13.
         Every project that takes MimeKit names the fixed one beside it, so the build never
         resolves the old one, and the build's vulnerability check stays an error. -->
    <PkcsVersion>10.0.13</PkcsVersion>
  </PropertyGroup>

  <!-- The test project's own, kept here for the same reason. -->
  <PropertyGroup>
    <TestSdkVersion>17.14.1</TestSdkVersion>
    <XunitVersion>3.1.0</XunitVersion>
    <XunitRunnerVersion>3.1.4</XunitRunnerVersion>
  </PropertyGroup>

</Project>