Directory.Packages.props

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
    <!-- Nuget package versions -->
    <AkkaHostingVersion>1.5.74</AkkaHostingVersion>
    <AkkaPersistenceSqlHostingVersion>1.5.73</AkkaPersistenceSqlHostingVersion>
    <AkkaRemindersVersion>1.5.73.4</AkkaRemindersVersion>
    <OpenTelemetryVersion>1.20.1</OpenTelemetryVersion>
    <SlackNetVersion>0.18.0</SlackNetVersion>
    <DiscordNetVersion>3.20.2</DiscordNetVersion>
    <MattermostNetVersion>5.0.12</MattermostNetVersion>
    <MicrosoftExtensionsAIVersion>10.8.3</MicrosoftExtensionsAIVersion>
    <!-- Microsoft.Extensions.TimeProvider.Testing ships on the dotnet/extensions minor
         cadence and has no 10.8.x patch, so it cannot share MicrosoftExtensionsAIVersion
         once the AI packages move to a patch release. -->
    <MicrosoftExtensionsTimeProviderTestingVersion>10.9.0</MicrosoftExtensionsTimeProviderTestingVersion>
    <OpenAIVersion>2.12.0</OpenAIVersion>
    <MicrosoftAspNetCoreVersion>10.0.14</MicrosoftAspNetCoreVersion>
    <SkiaSharpVersion>4.152.0</SkiaSharpVersion>
    <!-- Aspire pins are exercised only by samples/Netclaw.Demo.AppHost and its
         integration tests. The 13.x line is the .NET 10 generation of Aspire;
         9.x pulls a vulnerable KubernetesClient 17.0.4 (GHSA-w7r3-mgwf-4mqq)
         that trips NU1902 under our TreatWarningsAsErrors policy. -->
    <AspireHostingVersion>13.6.4</AspireHostingVersion>
    <CommunityToolkitAspireVersion>13.6.1</CommunityToolkitAspireVersion>
    <ModelContextProtocolVersion>2.2.0</ModelContextProtocolVersion>
  </PropertyGroup>
  <!-- App dependencies -->
  <ItemGroup>
    <PackageVersion Include="Akka.Hosting" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="Akka.Cluster.Sharding" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="Akka.Persistence" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="Akka.Persistence.Hosting" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="Akka.Persistence.Sql.Hosting" Version="$(AkkaPersistenceSqlHostingVersion)" />
    <PackageVersion Include="Aaron.Akka.Reminders" Version="$(AkkaRemindersVersion)" />
    <PackageVersion Include="Aaron.Akka.Reminders.Sqlite" Version="$(AkkaRemindersVersion)" />
    <PackageVersion Include="Akka.TestKit" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="Anthropic" Version="13.3.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.13.0" />
    <PackageVersion Include="Microsoft.Accordant" Version="0.1.6" />
    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.Extensions" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="$(MicrosoftAspNetCoreVersion)" />
    <!-- Transitive security pin: Microsoft.AspNetCore.OpenApi 10.0.9 pulls
         Microsoft.OpenApi 2.0.0, which trips NU1903 (CVE-2026-49451 /
         GHSA-v5pm-xwqc-g5wc, circular schema references can terminate OpenAPI
         parsing). Keep this on the patched 2.x line until ASP.NET Core ships a
         non-vulnerable transitive dependency.
         Microsoft.AspNetCore.OpenApi 10.0.13 requires Microsoft.OpenApi
         >= 2.12.2 && < 3.0.0. Central transitive pinning turns a lower pin
         into an NU1109 downgrade error, so keep this version at or above the
         floor that MicrosoftAspNetCoreVersion demands. -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.12.2" />
    <PackageVersion Include="Microsoft.Extensions.AI" Version="$(MicrosoftExtensionsAIVersion)" />
    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="$(MicrosoftExtensionsAIVersion)" />
    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="$(MicrosoftExtensionsTimeProviderTestingVersion)" />
    <PackageVersion Include="ModelContextProtocol.Core" Version="$(ModelContextProtocolVersion)" />
    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="$(ModelContextProtocolVersion)" />
    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.AspNetCore.DataProtection" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="System.Security.Cryptography.Xml" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.Data.Sqlite" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="$(MicrosoftExtensionsAIVersion)" />
    <PackageVersion Include="OpenAI" Version="$(OpenAIVersion)" />
    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="$(MicrosoftAspNetCoreVersion)" />
    <PackageVersion Include="JsonSchema.Net" Version="7.4.0" />
    <PackageVersion Include="NSec.Cryptography" Version="26.4.0" />
    <PackageVersion Include="OpenTelemetry" Version="$(OpenTelemetryVersion)" />
    <PackageVersion Include="OpenTelemetry.Api" Version="$(OpenTelemetryVersion)" />
    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="$(OpenTelemetryVersion)" />
    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="$(OpenTelemetryVersion)" />
    <PackageVersion Include="OllamaSharp" Version="5.4.30" />
    <PackageVersion Include="SauceControl.Blake2Fast" Version="2.0.0" />
    <PackageVersion Include="Discord.Net" Version="$(DiscordNetVersion)" />
    <PackageVersion Include="Mattermost.NET" Version="$(MattermostNetVersion)" />
    <PackageVersion Include="SlackNet" Version="$(SlackNetVersion)" />
    <PackageVersion Include="SlackNet.Extensions.DependencyInjection" Version="$(SlackNetVersion)" />
    <PackageVersion Include="Cronos" Version="0.13.0" />
    <PackageVersion Include="Netclaw.SkillClient" Version="0.4.1" />
    <PackageVersion Include="ShellSyntaxTree" Version="0.5.0-beta.2" />
    <PackageVersion Include="Termina" Version="0.17.1" />
    <PackageVersion Include="xunit" Version="2.9.3" />
    <PackageVersion Include="xunit.v3.mtp-off" Version="4.0.0" />
  </ItemGroup>
  <!-- Serialization -->
  <ItemGroup>
    <PackageVersion Include="Google.Protobuf" Version="3.36.2" />
    <PackageVersion Include="Grpc.Tools" Version="2.84.0" />
    <PackageVersion Include="YamlDotNet" Version="18.1.0" />
  </ItemGroup>
  <!-- Test dependencies -->
  <ItemGroup>
    <PackageVersion Include="Akka.Hosting.TestKit" Version="$(AkkaHostingVersion)" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
    <PackageVersion Include="CsCheck" Version="4.9.1" />
    <PackageVersion Include="Verify.XunitV3" Version="31.28.0" />
    <PackageVersion Include="Testcontainers" Version="4.14.0" />
    <!-- Transitive security pin: Testcontainers 4.13.0 pulls SSH.NET 2025.1.0,
         which trips NU1903 (CVE-2026-48798 / GHSA-q939-rpr3-3284, path traversal
         in ScpClient.Download recursive downloads, affected <= 2025.1.0).
         2026.0.0 is the patched line and still satisfies Testcontainers'
         >= 2025.1.0 constraint. SSH.NET is a test-only transitive dependency with
         no runtime exposure; remove this pin once Testcontainers ships a
         non-vulnerable transitive dependency on its own. -->
    <PackageVersion Include="SSH.NET" Version="2026.0.0" />
  </ItemGroup>
  <!-- .NET Aspire (samples/Netclaw.Demo.AppHost only) -->
  <ItemGroup>
    <PackageVersion Include="Aspire.Hosting.AppHost" Version="$(AspireHostingVersion)" />
    <PackageVersion Include="Aspire.Hosting.Testing" Version="$(AspireHostingVersion)" />
    <PackageVersion Include="CommunityToolkit.Aspire.Hosting.Ollama" Version="$(CommunityToolkitAspireVersion)" />
    <!-- Transitive security pin: Aspire 13.4.x pulls MessagePack 2.5.192, which
         trips NU1903 (GHSA-hv8m-jj95-wg3x, LZ4 decompression AccessViolation).
         Keep this on the patched 3.x line already used by dev until Aspire ships
         a non-vulnerable transitive dependency on its own. -->
    <PackageVersion Include="MessagePack" Version="3.1.10" />
  </ItemGroup>
  <!-- Image normalization (Netclaw.Media). SkiaSharp ships Windows/macOS native
       assets in the base package; Linux needs the explicit headless native asset
       (NoDependencies = no fontconfig, we do no text rendering). -->
  <ItemGroup>
    <PackageVersion Include="SkiaSharp" Version="$(SkiaSharpVersion)" />
    <PackageVersion Include="SkiaSharp.NativeAssets.Linux.NoDependencies" Version="$(SkiaSharpVersion)" />
  </ItemGroup>
  <!-- Benchmarks (benchmarks/Netclaw.Benchmarks only) -->
  <ItemGroup>
    <PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
  </ItemGroup>
  <!-- Memory embeddings (Netclaw.Embeddings + Netclaw.Embeddings.Tests). CPU-only ONNX
       inference + a pure-managed WordPiece tokenizer, per memory-core-redesign D1: no
       sidecar process, no native dependency beyond the ONNX Runtime CPU EP that already
       ships linux-x64 + linux-arm64 native assets. -->
  <ItemGroup>
    <PackageVersion Include="Microsoft.ML.OnnxRuntime" Version="1.30.0" />
    <PackageVersion Include="FastBertTokenizer" Version="1.2.6" />
    <!-- Pinned to the 10.0.10 transitive floor for Microsoft.Extensions.AI. Central
         transitive pinning requires a central version at or above every transitive floor. -->
    <PackageVersion Include="System.Numerics.Tensors" Version="10.0.10" />
  </ItemGroup>
  <!-- Source generators -->
  <ItemGroup>
    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
  </ItemGroup>
  <!-- SourceLink support for all Akka.NET projects -->
  <ItemGroup>
    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.401" />
  </ItemGroup>
  <!-- Transitive audit suppress: Microsoft.Data.Sqlite → SQLitePCLRaw.lib.e_sqlite3 2.1.11
       is flagged by NuGetAudit (GHSA-2m69-gcr7-jv3q, CVE-2025-6965 — SQLite < 3.50.2
       memory corruption in aggregate-term handling). No patched version of
       SQLitePCLRaw.lib.e_sqlite3 is available on NuGet: 3.50.3 was published then unlisted,
       and 2.1.11 remains the latest stable release. This suppress will be removed once
       Microsoft ships a Microsoft.Data.Sqlite release that pins a non-vulnerable
       SQLitePCLRaw.lib.e_sqlite3. Track: https://github.com/dotnet/efcore/issues/38257 -->
  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
  </ItemGroup>
</Project>