PoMiniGames/Directory.Packages.props at master · punkouter26/PoMiniGames · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <ItemGroup>
    <!-- Tooling adopted 2026-09-02 (PoEcosystem plan, "top-50" selection). All four are
         trim-safe: Mapperly is a compile-time source generator (no runtime assembly),
         Blazored.LocalStorage is used through its string API only, and NSubstitute /
         bUnit never ship in the WASM bundle. -->
    <PackageVersion Include="Blazored.LocalStorage" Version="4.5.0" />
    <PackageVersion Include="NSubstitute" Version="6.2.0" />
    <!-- Azure -->
    <PackageVersion Include="Azure.Identity" Version="1.19.0" />
    <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.5.0" />
    <PackageVersion Include="Azure.Monitor.OpenTelemetry.AspNetCore" Version="1.4.0" />
    <!-- Transitive security pin: Azure.Monitor 1.4.0 drags in OpenTelemetry.Api 1.14.0,
         which has GHSA-g94r-2vxg-569j (moderate). Pin the patched line. -->
    <PackageVersion Include="OpenTelemetry.Api" Version="1.16.0" />
    <PackageVersion Include="Azure.Data.Tables" Version="12.11.0" />
    <PackageVersion Include="Azure.Storage.Blobs" Version="12.23.0" />
    <!-- API -->
    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
    <!-- §3.4 Native .NET 10 resilience pipelines (retry / circuit-breaker / timeout
         / hedging) backed by Polly v8, registered via IHttpClientFactory. -->
    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
    <!-- §3.4 Native HybridCache (stampede protection + L1/L2). Memoizes expensive
         Azure OpenAI generations at the slice boundary. -->
    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.7.0" />
    <!-- Transitive pin: Microsoft.AspNetCore.OpenApi pulls Microsoft.OpenApi; with
         CentralPackageTransitivePinningEnabled this holds it at a current version so
         the NuGet CVE audit (which fails the build) can't be tripped by an old
         transitive. No project references it directly. -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
    <PackageVersion Include="Scalar.AspNetCore" Version="2.13.10" />
    <!-- IdentityModel — security-pinned transitive deps (CVE mitigation, upgrade from 8.0.1) -->
    <PackageVersion Include="Microsoft.IdentityModel.Abstractions" Version="8.19.2" />
    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.19.2" />
    <PackageVersion Include="Microsoft.IdentityModel.Logging" Version="8.19.2" />
    <PackageVersion Include="Microsoft.IdentityModel.Protocols" Version="8.19.2" />
    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.19.2" />
    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.2" />
    <!-- Logging / Telemetry -->
    <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
    <PackageVersion Include="Serilog.Sinks.ApplicationInsights" Version="5.0.1" />
    <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
    <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageVersion Include="Serilog.Enrichers.Environment" Version="3.0.1" />
    <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
    <PackageVersion Include="Serilog.Exceptions" Version="8.4.0" />
    <!-- Blazor WASM -->
    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.10" />
    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.10" />
    <PackageVersion Include="Microsoft.AspNetCore.Components.WebAssembly.DevServer" Version="10.0.10" />
    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.10" />
    <!-- §2.3 AuthenticationStateProvider + AuthorizeRouteView. Not transitively
         included by the WASM metapackage in .NET 10. -->
    <PackageVersion Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.10" />
    <!-- AI (PoSurvive inference: server-side Azure OpenAI relay) -->
    <PackageVersion Include="Microsoft.Extensions.AI" Version="10.5.2" />
    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.5.2" />
    <!-- Must stay compatible with the OpenAI version Microsoft.Extensions.AI.OpenAI pulls in
         (10.5.2 → OpenAI 2.10.0). NuGet unifies OpenAI to the highest requested version, so the
         GA Azure.AI.OpenAI 2.1.0 — built against OpenAI 2.1.0 — bound against 2.10.0 at runtime
         and every chat call threw MissingMethodException on the removed
         ChatCompletionOptions.SerializedAdditionalRawData. That surfaced as "[The Jester
         stumbled and cannot predict.]" rather than a startup failure. Bump both together. -->
    <PackageVersion Include="Azure.AI.OpenAI" Version="2.9.0-beta.1" />
    <!-- Health Checks -->
    <!-- PoVoxelStrike asset pipeline: GLB parsing for the startup voxelizer. API-side
         only — must never be referenced from the Client, whose publish is trim-audited. -->
    <PackageVersion Include="SharpGLTF.Core" Version="1.0.6" />
    <!-- Testing -->
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
    <PackageVersion Include="xunit" Version="2.9.3" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
    <PackageVersion Include="FluentAssertions" Version="8.8.0" />
    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Playwright" Version="1.50.0" />
    <!-- §8 Testcontainers v4 with the dedicated Azurite module (replaces the
         long-deprecated DotNet.Testcontainers 1.6.0 package name). -->
    <PackageVersion Include="Testcontainers.Azurite" Version="4.12.0" />
    <!-- §1.2 Tag-driven versioning. MinVer reads the nearest 'v*' git tag and
         produces a SemVer 2.0 version (e.g. v1.4.0 + 3 commits → 1.4.4-alpha.0.3).
         Version flows into AssemblyVersion, FileVersion, and InformationalVersion
         via Directory.Build.props so every project gets it for free. -->
    <PackageVersion Include="MinVer" Version="6.0.0" />
  </ItemGroup>
</Project>