XE-Local-AI-Engine.Source/Directory.Packages.props at develop · w0rldx/XE-Local-AI-Engine.Source · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <!-- Required so the transitive-only pins below (OpenAI, System.Numerics.Tensors, the Microsoft.Extensions.*
         abstractions) bind without adding a direct PackageReference; without it each of them is silently ignored. -->
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <ItemGroup>
    <PackageVersion Include="Avalonia.Desktop" Version="12.1.4" />
    <PackageVersion Include="Avalonia.Themes.Fluent" Version="12.1.4" />
    <PackageVersion Include="Avalonia.Controls.WebView" Version="12.1.1" />
    <PackageVersion Include="Aspire.Hosting.Browsers" Version="13.6.4-preview.1.26523.11" />
    <PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.6.4" />
    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.4" />
    <PackageVersion Include="Azure.AI.OpenAI" Version="2.1.0" />
    <!-- DefaultAzureCredential for Azure Foundry managed-identity auth, consumed by the Application factory. -->
    <PackageVersion Include="Azure.Identity" Version="1.21.0" />
    <!-- MSAL ConfidentialClientApplication for the Entra ID authorization-code sign-in flow (Postman-parity delegated
         token via a confidential client + PKCE). Not pulled in transitively by Azure.Identity 1.21.0 (which depends
         only on Azure.Core), so both packages are direct references, version-locked to the same MSAL release. -->
    <PackageVersion Include="Microsoft.Identity.Client" Version="4.91.1" />
    <!-- OS-native encrypted MSAL token-cache persistence (DPAPI/Keychain/libsecret), mirroring the
         TokenCachePersistenceOptions Azure.Identity provides for its own credential types. -->
    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.91.1" />
    <!-- Pure-.NET document text extraction for chat file-upload attachments (single-file-publish safe; no Python/Docker/native deps). -->
    <PackageVersion Include="Microsoft.Extensions.DataIngestion.Abstractions" Version="10.11.0-preview.1.26513.7" />
    <!-- Genuine PdfPig (Apache-2.0, github.com/UglyToad/PdfPig). NOTE: the package id is `PdfPig`, NOT `UglyToad.PdfPig`
         (the latter is an unofficial, unlicensed republish on nuget.org with a commit absent from the real repo). -->
    <PackageVersion Include="PdfPig" Version="0.1.16" />
    <!-- Readability-port main-content extraction for the web_fetch tool (Apache-2.0, github.com/Strumenta/SmartReader); brings
         AngleSharp (MIT) as its HTML parser. ADR 0017. -->
    <PackageVersion Include="SmartReader" Version="0.11.1" />
    <PackageVersion Include="DocumentFormat.OpenXml" Version="3.5.1" />
    <PackageVersion Include="UTF.Unknown" Version="2.8.0" />
    <!-- Docker Engine API client for the Development Mode container sandbox, permitted by ADR 0004 for Development
         Mode build/test/lint execution ONLY. It is isolated from the inference path.

         NOTE the package id. `Docker.DotNet` (3.125.15) is the ORIGINAL, last published 2023-05-18, netstandard-only,
         and it drags in Newtonsoft.Json. `Docker.DotNet.Enhanced` is the MAINTAINED fork at
         github.com/testcontainers/Docker.DotNet — same `Docker.DotNet` assembly and namespace, MIT, a real net10.0
         target, System.Text.Json, and it is what Testcontainers 4.x itself depends on. Its description pins it to
         Docker Engine API v29.4.1, which is the generation this product's minimum daemon speaks.

         Its transports ship as separate `Docker.DotNet.Enhanced.{Unix,NPipe,NativeHttp,LegacyHttp}` packages that
         arrive transitively and lock-step to the same version, so they need no entry of their own. -->
    <PackageVersion Include="Docker.DotNet.Enhanced" Version="4.3.3" />
    <PackageVersion Include="CommunityToolkit.Aspire.Hosting.Sqlite" Version="13.6.0" />
    <PackageVersion Include="FastEndpoints" Version="8.3.0" />
    <PackageVersion Include="FastEndpoints.Swagger" Version="8.3.0" />
    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.317" />
    <!-- Architecture conformance tests (layer-dependency direction). Test-project only. -->
    <PackageVersion Include="NetArchTest.Rules" Version="1.3.2" />
    <!-- Architecture conformance tests (intra-project file/namespace placement). Test-project only, Apache-2.0.
         Sits alongside NetArchTest rather than replacing it: NetArchTest governs dependency DIRECTION between
         assemblies, ArchUnitNET governs WHERE a type is allowed to live inside one. Only the core package is
         referenced; the TngTech.ArchUnitNET.TUnit adapter is deliberately not, see PlacementConventionTests. -->
    <PackageVersion Include="TngTech.ArchUnitNET" Version="0.13.4" />
    <!-- Syntax-only parser for NoTupleConventionTests (a text scan cannot tell a tuple type from a parameter
         list). Test-project only, MIT; no Compilation or semantic model is built. Transitive pinning makes this
         the version everywhere, and Microsoft.EntityFrameworkCore.Design requires exactly 5.0.0 through
         Microsoft.CodeAnalysis.CSharp.Workspaces: move the two together. -->
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.0.0" />
    <!-- Newest intended prerelease; banned-API hard wall (RS0030) over BannedSymbols.txt. -->
    <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.14" />
    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.14" />
    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.14" />
    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.14" />
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.14" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.14" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.14" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.14" />
    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.23.0" />
    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.12.0" />
    <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.5.1" />
    <PackageVersion Include="Microsoft.Testing.Platform" Version="2.5.1" />
    <PackageVersion Include="Microsoft.Playwright" Version="1.64.1" />
    <PackageVersion Include="OllamaSharp" Version="5.5.0" />
    <!-- Coupled to the Microsoft.Playwright pin above: TUnit.Playwright's nuspec sets the Microsoft.Playwright
         floor (1.68.4 requires >= 1.62.0), so check that floor before moving either package. A Microsoft.Playwright
         bump additionally needs `playwright.ps1 install` to refresh ~/.cache/ms-playwright and CI's browser layer. -->
    <PackageVersion Include="TUnit.Playwright" Version="1.76.28" />
    <PackageVersion Include="Microsoft.Extensions.AI" Version="10.11.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.11.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.11.0" />
    <!-- Transitive only (pulled in by Microsoft.Extensions.AI.OpenAI): pinned
         explicitly, matching the version CentralPackageTransitivePinningEnabled currently resolves, so the plain
         OpenAI SDK's OPENAI001-experimental OpenAIClient(AuthenticationPolicy, OpenAIClientOptions) ctor that
         AzureFoundryChatClientFactory's v1-surface builders depend on is a visible, greppable dependency, and a
         future Microsoft.Extensions.AI.OpenAI bump becomes a conscious version change here rather than a silent
         transitive drift.

         Coupled to Microsoft.Extensions.AI.OpenAI: this pin must equal the OpenAI version that package is compiled
         against (Microsoft.Extensions.AI.OpenAI 10.11.0 is built against OpenAI 2.14.0; its nuspec floor is >= 2.14.0).
         A mismatch resolves and compiles clean but can fail at run time: 10.10.0 (built against 2.13.0) referenced
         OpenAI.Responses.GlobalMcpToolCallApprovalPolicy, which 2.14.0 renamed, so pairing it with 2.14.0 threw
         TypeLoadException on every Responses call carrying ChatOptions.Tools. CodexToolCallingWireTests catches that
         class of break. Move both pins together, to the OpenAI version the new Microsoft.Extensions.AI.OpenAI nuspec names. -->
    <PackageVersion Include="OpenAI" Version="2.14.0" />
    <!-- Never below 10.0.10: ModelContextProtocol 2.2.0 pulls Microsoft.Extensions.Hosting.Abstractions 10.0.10,
         which requires Configuration.Abstractions >= 10.0.10, and central transitive pinning turns a mismatch into
         an NU1109 downgrade error across five projects. Same servicing band as the DependencyInjection.Abstractions
         and Logging.Abstractions pins directly below. -->
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.14" />
    <!-- Already in every host graph transitively; referenced directly only by Providers.ProcessSupervision, whose stale
         reaper is an IHostedService. -->
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.14" />
    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.11.0" />
    <!-- Compatibility cohort: upgrade the stable MAF trio together after verifying their matching release set. -->
    <PackageVersion Include="Microsoft.Agents.AI" Version="1.26.0" />
    <PackageVersion Include="Microsoft.Agents.AI.Abstractions" Version="1.26.0" />
    <PackageVersion Include="Microsoft.Agents.AI.Workflows" Version="1.26.0" />
    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.11.0" />
    <!-- MXC process containment (Windows ProcessContainer = AppContainer + DACL) as the Preview launch mechanism inside
         ProcessSandboxRuntimeProvider. Pinned EXACTLY: the policy guard rejects weakening properties by name, so a new
         SDK surface is reviewed, never floated in. Single net8.0 asset (consumable from net10.0); the package bundles its
         natives (mxc_ffi.dll + plm.exe + WSLC files for win-x64/arm64, libmxc_ffi.so for linux, osx-arm64), so no
         third-party binary is vendored. MIT. -->
    <PackageVersion Include="Microsoft.Mxc.Sdk" Version="1.0.1" />
    <!-- ModelContextProtocol.AspNetCore takes an exact dependency on the matching ModelContextProtocol
         build, so these two only ever move together; a split bump fails restore with NU1107/NU1608. -->
    <PackageVersion Include="ModelContextProtocol" Version="2.3.0" />
    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.3.0" />
    <!-- WASAPI process-loopback capture for Windows per-application audio (transcription source kind
         ApplicationProcess). NOTE the package id: the `NAudio` META-package multi-targets
         net9.0;net9.0-windows;net9.0-windows10.0.19041.0 and drags in Midi/Asio/WinMM, which would force a Windows
         TFM onto XE-Local-AI-Engine.Client.Application. `NAudio.Wasapi` ships a single plain `lib/net9.0` asset
         carrying an assembly-level [SupportedOSPlatform("windows")] precisely so cross-platform consumers build on
         Linux without EnableWindowsTargeting; CA1416 then enforces Windows-only use at compile time. Its only
         dependency, NAudio.Core, declares System.Numerics.Tensors >= 9.0.0, which the 10.0.12 pin below satisfies
         upward under CentralPackageTransitivePinningEnabled. Both packages are MIT with a copyright string, so the
         release license corpus resolves them to third-party/nuget/standard/MIT.txt and no new notice file exists. -->
    <PackageVersion Include="NAudio.Wasapi" Version="3.3.0" />
    <PackageVersion Include="NSubstitute" Version="6.2.0" />
    <!-- Mechanical enforcement of correct NSubstitute usage (non-virtual member substitution,
         unused Received checks). Test-project only, PrivateAssets="all". -->
    <PackageVersion Include="NSubstitute.Analyzers.CSharp" Version="1.0.17" />
    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.20.1" />
    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.20.1" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.20.1" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.20.1" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.20.1" />
    <PackageVersion Include="Quartz" Version="3.22.7" />
    <PackageVersion Include="Quartz.Extensions.Hosting" Version="3.22.7" />
    <PackageVersion Include="Quartz.Plugins" Version="3.22.7" />
    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="3.22.7" />
    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="3.22.7" />
    <PackageVersion Include="Serilog" Version="4.4.0" />
    <PackageVersion Include="Scalar.AspNetCore" Version="2.18.3" />
    <PackageVersion Include="Scrutor" Version="7.0.0" />
    <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Environment" Version="3.0.1" />
    <PackageVersion Include="Serilog.Enrichers.Process" Version="3.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
    <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
    <PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.1" />
    <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.35.0.4138" />
    <!-- Terminal client (XE-Local-AI-Engine.Cli) only: argument parsing and console rendering. Spectre.Console is the
         core package alone; its ImageSharp add-on is deliberately not referenced. -->
    <PackageVersion Include="Spectre.Console" Version="0.57.2" />
    <PackageVersion Include="System.CommandLine" Version="2.0.13" />
    <PackageVersion Include="System.Numerics.Tensors" Version="10.0.14" />
    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.14" />
    <PackageVersion Include="TUnit" Version="1.76.28" />
    <PackageVersion Include="Velopack" Version="1.2.161" />
    <PackageVersion Include="YamlDotNet" Version="18.1.0" />
  </ItemGroup>
</Project>