didcomm-dotnet/Directory.Packages.props at main · moisesja/didcomm-dotnet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
  <ItemGroup>
    <!-- DID resolution only. 2.0.0 relocated all crypto primitives to NetCrypto; didcomm-dotnet
         consumes NetDid solely for resolution (IDidResolver, DID Document model) — see PRD §3.1.
         The JOSE composition + crypto substrate come from DataProofsDotnet.Jose below.
         3.0.0 is a no-source-change upgrade from 2.3.0 for every 2.x consumer: the major signals
         the scale of net-did's release — a new did:ethr method (shipped as NetDid.Method.Ethr,
         which DidComm does not reference) and the DataProofsDotnet major crossing beneath
         did:webvh — not a break. The public-API deltas 2.x code compiles against are additive
         (VerificationMethod.AdditionalProperties, DidResolutionResult.InvalidOptions,
         NetDidBuilder.AddDidEthr()). It also forces NetCrypto 1.4.0 and DataProofsDotnet.Core
         1.1.1, both of which the pins below match, so the direct and transitive graphs agree.
         3.1.0 is an additive minor over 3.0.0: it depends on NetCrypto 1.4.0, and the pin below
         raises that to 1.5.0 (a forward move, no downgrade), and on Microsoft.Extensions.* 10.0.8,
         below the 10.0.10 pins here — the direct and transitive graphs stay in agreement. -->
    <PackageVersion Include="NetDid.Core" Version="3.1.0" />
    <PackageVersion Include="NetDid.Method.Key" Version="3.1.0" />
    <PackageVersion Include="NetDid.Method.Peer" Version="3.1.0" />
    <PackageVersion Include="NetDid.Method.WebVh" Version="3.1.0" />
    <PackageVersion Include="NetDid.Extensions.DependencyInjection" Version="3.1.0" />
    <!-- NetCrypto: the crypto substrate (arrives transitively via DataProofsDotnet.Jose). DidComm
         references it directly in exactly one place — JwsSignerFactory adapts a private signer JWK
         into a NetCrypto ISigner, because DataProofs' JWS layer signs through ISigner, not raw key
         bytes. Everything else (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK) is DataProofs.
         1.5.0 is load-bearing here: its secp256k1 verify path normalizes (r, n-s) to low-S so
         RFC 8812-valid high-S ES256K signatures verify (crypto-dotnet#23) — that is what makes
         inbound ES256K from didcomm-python pass in the live harness. The intervening 1.3.0/1.4.0
         additions (EC point decompression, IRecoverableDigestSigner for EVM flows) are unused by
         didcomm; the new IKeyStore member ships as a throwing default interface implementation, so
         external key stores stay source- and binary-compatible. net-did 3.x depends transitively
         on 1.4.0; pinning 1.5.0 directly is a forward move both graphs agree on (no NU1605). -->
    <PackageVersion Include="NetCrypto" Version="1.5.0" />
    <!-- JOSE composition + crypto substrate (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK).
         Brings NetCrypto transitively; didcomm carries no envelope crypto of its own. 1.1.0 added
         the async IEcdhKey ECDH seam + JweParser.PeekRecipients/ParseAsync (dataproofs-dotnet#13)
         that let opaque (HSM/KMS keystore) private keys do ECDH without exposing the scalar, plus
         the constant-work JWE decrypt path (dataproofs-dotnet#12). Consumed by didcomm-dotnet#45.
         1.1.1 fixes dataproofs-dotnet#15 — JwsParser leaked a raw InvalidOperationException for a
         non-string unprotected 'kid', and parsed the top-level JSON without wrapping — both
         reachable pre-verification and both the upstream root cause of didcomm-dotnet#58. The
         EnvelopeReader JWS boundary guard added for #58 stays regardless of this pin: it defends
         the whole untyped-fault class (FR-API-07), not that one input. -->
    <PackageVersion Include="DataProofsDotnet.Jose" Version="1.3.0" />
    <!-- ASP.NET Core (transports). Test/sample-only; 10.0.10 is the GA servicing line — the
         previous pin was a .NET 10 preview build left over from pre-GA scaffolding. -->
    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.10" />
    <!-- Caching -->
    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
    <!-- Logging -->
    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
    <!-- Dependency Injection -->
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.10" />
    <!-- Resilience (retry + timeout + circuit-breaker) for the Phase 5 HTTPS + WebSocket
         transports. Polly v8 is the .NET-idiomatic policy library and the user-confirmed
         Phase 5 choice for FR-TRN-08 / FR-TRN-11. Used via Polly.ResiliencePipeline; no
         extra Microsoft.Extensions.Http.Polly / .Resilience wrapper needed. -->
    <PackageVersion Include="Polly" Version="8.7.0" />
    <!-- Source Link. Build-only (PrivateAssets="All"), never shipped. The standalone
         Microsoft.SourceLink.GitHub versioning tracks the SDK band, so 10.0.x is the line that
         pairs with the net10.0 SDK this repo builds on — 8.0.0 was the .NET 8-era pin. -->
    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
    <!-- Testing. Held deliberately, not by neglect: newer majors exist for every entry here
         (Test.Sdk 18, xunit.runner.visualstudio 3, NSubstitute 6, coverlet 10). FluentAssertions
         is the one to be explicit about — 8.x relicensed under Xceed (free for OSS, paid for
         commercial use) and breaks API across the suite, so staying on 7.0.0 keeps this library's
         test dependencies unencumbered for downstream contributors. Moving the test stack is its
         own change with its own risk; it does not ride along with a dependency refresh. -->
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
    <PackageVersion Include="xunit" Version="2.9.3" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
    <PackageVersion Include="FluentAssertions" Version="7.0.0" />
    <PackageVersion Include="NSubstitute" Version="5.3.0" />
    <PackageVersion Include="coverlet.collector" Version="6.0.3" />
    <!-- IL/metadata reader for the FR-DX-01 public-API demonstration gate: the coverage test walks
         every sample assembly's metadata (member refs, type refs, signatures) to prove each public
         member of the shipped packages is exercised by a sample. Test-only; never shipped. -->
    <PackageVersion Include="Mono.Cecil" Version="0.11.6" />
    <!-- Benchmarks (NFR-07) -->
    <PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
  </ItemGroup>
</Project>