textstack/Directory.Packages.props at main · mrviduus/textstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <!-- Lets a PackageVersion below raise a TRANSITIVE dependency without a direct
         PackageReference. Used to hold Microsoft.OpenApi on a patched build. This was
         impossible until Npgsql was corrected to 10.0.2: pinning every transitive to
         the central list surfaced the 9.0.3-vs-required-10.0.2 mismatch as NU1109. -->
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <ItemGroup>
    <!-- ASP.NET Core -->
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
    <!-- Transitive only, via Microsoft.AspNetCore.OpenApi 10.0.8, which resolves
         2.0.0 — GHSA-v5pm-xwqc-g5wc (high): circular schema references can terminate
         OpenAPI parsing. Vulnerable >= 2.0.0-preview.11 through 2.7.4, patched in
         2.7.5. Held on the 2.x line for compatibility with AspNetCore.OpenApi 10.x.
         No code imports it; transitive pinning above is what applies this version.
         Drop the entry once AspNetCore.OpenApi resolves 2.7.5 or later itself. -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
    <PackageVersion Include="Scalar.AspNetCore" Version="2.14.14" />
    <!-- Entity Framework -->
    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.8" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.8" />
    <!-- Transitive pin (EF Sqlite, tests only): 2.1.11 carries GHSA-2m69-gcr7-jv3q. Drop when EF ships >= 2.1.12. -->
    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.13" />
    <PackageVersion Include="SQLitePCLRaw.core" Version="2.1.13" />
    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
    <PackageVersion Include="SQLitePCLRaw.provider.e_sqlite3" Version="2.1.13" />
    <!-- Must be >= what Npgsql.EntityFrameworkCore.PostgreSQL requires (10.0.1 needs
         >= 10.0.2). It was declared 9.0.3 while resolution quietly upgraded it, so the
         version in the manifest was not the version that shipped. -->
    <PackageVersion Include="Npgsql" Version="10.0.2" />
    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
    <PackageVersion Include="EFCore.NamingConventions" Version="10.0.1" />
    <!-- Application Layer -->
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.12" />
    <!-- Authentication -->
    <PackageVersion Include="BCrypt.Net-Next" Version="4.2.0" />
    <PackageVersion Include="Google.Apis.Auth" Version="1.76.0" />
    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.22.0" />
    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.22.0" />
    <!-- LLM -->
    <PackageVersion Include="OpenAI" Version="2.10.0" />
    <!-- MCP (Phase 8, AI-047). Official ModelContextProtocol C# SDK (MS/Anthropic).
         Latest stable 1.4.0 (2026-06-04). Powers the stdio MCP server in
         TextStack.Ai.Mcp — the SDK ships the stdio transport + low-level
         ListTools/CallTool handler API used by the runtime tool catalog. -->
    <PackageVersion Include="ModelContextProtocol" Version="1.4.0" />
    <!-- HTTP (streamable) transport for the MCP server (AI-049, Phase 8). Separate
         package layered on ModelContextProtocol; pinned to the SAME 1.4.0 as the
         core SDK. Brings WithHttpTransport(o => o.Stateless = true) + MapMcp("/mcp")
         on a WebApplication. Pulls in the ASP.NET Core framework reference for the
         TextStack.Ai.Mcp http transport branch. -->
    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="1.4.0" />
    <!-- Tool-args validation (AI-030): real JSON Schema draft 2020-12 evaluation before dispatch -->
    <PackageVersion Include="JsonSchema.Net" Version="9.4.0" />
    <!-- AI eval framework (MEAI.Evaluation). Stable 10.6.0 — IChatClient seam +
         IEvaluator/EvaluationMetric + Reporting (response cache, HTML report).
         Used by tests/TextStack.AiEvals; see docs/eval-migration.md. -->
    <PackageVersion Include="Microsoft.Extensions.AI" Version="10.10.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation" Version="10.10.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.10.0" />
    <PackageVersion Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.10.0" />
    <!-- pgvector (Phase 4 RAG). EF maps the `vector` column type + DDL; retrieval
         stays raw Npgsql so the spoiler gate lives in SQL. Pgvector.EF 0.3.0 needs
         Npgsql.EFCore.PostgreSQL >=9.0.1 — satisfied by our 10.0.1. -->
    <PackageVersion Include="Pgvector" Version="0.3.2" />
    <PackageVersion Include="Pgvector.EntityFrameworkCore" Version="0.3.0" />
    <!-- HDBSCAN density clustering (AI-058 concept clusterer). Real HDBSCAN* in pure
         .NET (targets netstandard2.0 → runs on net10); cosine distance over OpenAI
         word embeddings. Replaces the hand-rolled cosine-threshold union-find. MIT. -->
    <PackageVersion Include="HdbscanSharp" Version="3.0.1" />
    <!-- Search -->
    <PackageVersion Include="Dapper" Version="2.1.86" />
    <!-- Hosting -->
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
    <!-- Image Optimization -->
    <!-- Images: SkiaSharp, the same version PDFtoImage brings in. ImageSharp was removed
         2026-10-07 (advisories fixed only in v4, which requires a licence key). -->
    <PackageVersion Include="SkiaSharp" Version="4.150.1" />
    <PackageVersion Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="4.150.1" />
    <!-- Worker -->
    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
    <PackageVersion Include="VersOne.Epub" Version="3.3.6" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.13.0" />
    <PackageVersion Include="PdfPig" Version="0.1.14" />
    <PackageVersion Include="PDFtoImage" Version="5.4.0" />
    <!-- OpenTelemetry. Bumped 1.11.x → 1.15.x to clear GHSA-4625-4j76-fww9
         (OTLP Exporter) and GHSA-g94r-2vxg-569j (Api). Stable channel. -->
    <PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.1" />
    <!-- This package has no stable channel; pinned to last-known-good beta
         we already used. Bumping to latest 1.15.1-beta.1 changes API
         (SetDbStatementForText → SetDbStatement on the options object). -->
    <PackageVersion Include="OpenTelemetry.Instrumentation.EntityFrameworkCore" Version="1.0.0-beta.12" />
    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
    <!-- Sentry (error tracking + AI-agent spans). 6.8.0 ships a first-class net10.0
         TFM with zero package dependencies. We deliberately do NOT take
         Sentry.OpenTelemetry: the OTel bridge is deprecated upstream and its
         replacement (Sentry.OpenTelemetry.Exporter) ships spans through the OTel
         SDK, so SentryOptions.BeforeSend never sees them — and our OTel spans carry
         http.client_ip + full SQL (SetDbStatementForText), which must be scrubbed.
         Sentry.Extensions.Logging comes in transitively via Sentry.AspNetCore. -->
    <PackageVersion Include="Sentry" Version="6.10.0" />
    <PackageVersion Include="Sentry.AspNetCore" Version="6.8.0" />
    <PackageVersion Include="Sentry.Extensions.Logging" Version="6.10.0" />
    <!-- Security (override transitive for CVE fix) -->
    <!-- Testing -->
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
    <PackageVersion Include="xunit.v3" Version="2.0.2" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
    <PackageVersion Include="coverlet.collector" Version="10.0.1" />
    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
    <PackageVersion Include="Moq" Version="4.20.72" />
    <!-- Real Postgres for tests/TextStack.Persistence.Tests (ADR-028); needs Docker. -->
    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.15.0" />
  </ItemGroup>
</Project>