docs: refresh dependency table — Magick.NET 14.15.0 + AutoMapper licence pin (#871, #887) - #902
Merged
Merged
Conversation
…nce pin (#871, #887) - Magick.NET-Q16-AnyCPU 14.14.0 -> 14.15.0 (#871 merged): 14.15.0 is the declared first-patched version for 5 advisories (4 medium + 1 low) that accumulated against 14.14.0. Licence unchanged (Apache-2.0). - NEW AutoMapper row documenting the 14.0.0 licence pin. The rationale previously existed only as a comment in the .csproj, which is not where an agent looks before approving a dependency bump — #887 (Dependabot 15.1.3) would have silently reverted the ratified decision jsboige 2026-06-23 and pulled the repo from MIT into RPL-1.5/commercial. - Note that NuGet audit warnings surface on `restore`, not incremental `build` — an incremental build reports 0 while a forced restore reported 28 NU1901/NU1902 lines. This is how the #587 zero-warning invariant went red without any code change (advisory drift against a pinned version). Docs only; 0 code, 0 config, 0 prod CSV. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jsboige
pushed a commit
that referenced
this pull request
Jul 25, 2026
…ive, 2 non-release flags Release-gate audit of every pipeline dependency, triggered by the accidental discovery (#887) that AutoMapper 15.x flips MIT → RPL-1.5/commercial. No full-set audit had been done; prepared ahead of public release v0.9.0 (ai-01 dispatch). Method: dotnet list package --include-transitive + NuGet Registration API for licenseExpression / licenseUrl / requireLicenseAcceptance. Rule: nuspec is truth (divergence → nuspec wins). Verdict: - Shipping pipeline (Argumentum.AssetConverter) — all 24 direct deps + full transitive closure are permissive (MIT / Apache-2.0 / MS-PL / BSD-3). 0 GPL/AGPL/RPL/SSPL/commercial in the release binary. - The 3 license-pinned deps verified against nuspec: AutoMapper 14.0.0 MIT (15.x RPL — pinned), Magick.NET 14.15.0 Apache-2.0, QuestPDF 2022.12.12 MIT (> = commercial — pinned). Match #902. - type="file" licenses resolved manually (ExtendedXmlSerializer/SharpToken MIT, SkiaSharp/System.* MS-.NET MIT) — the SPDX angle-matter flagged in the dispatch. - 2 non-release items flagged for arbitrage: 1. FluentAssertions 8.5.0 (Tests) — commercial Xceed since v8.0 (2025-02); type=file + requireLicenseAcceptance=true. Test-only, does not ship. 2. UglyToad.PdfPig 1.7.0-custom-5 (AssetConverter) — custom build, not on nuget.org, license undeclared. Real PdfPig = Apache-2.0; custom-build provenance needs confirmation. If both flags resolve permissively, the license gate is PASS. This is a result, not a gap. 0 code change, 0 prod CSV, 0 run. Read-only audit; doc-only. Co-Authored-By: Claude-Code <noreply@anthropic.com>
This was referenced Jul 25, 2026
jsboige
added a commit
that referenced
this pull request
Jul 26, 2026
…24 permissive (gate PASS); 1 test-only flag (#905) * docs(licensing): dependency license inventory — pipeline 100% permissive, 2 non-release flags Release-gate audit of every pipeline dependency, triggered by the accidental discovery (#887) that AutoMapper 15.x flips MIT → RPL-1.5/commercial. No full-set audit had been done; prepared ahead of public release v0.9.0 (ai-01 dispatch). Method: dotnet list package --include-transitive + NuGet Registration API for licenseExpression / licenseUrl / requireLicenseAcceptance. Rule: nuspec is truth (divergence → nuspec wins). Verdict: - Shipping pipeline (Argumentum.AssetConverter) — all 24 direct deps + full transitive closure are permissive (MIT / Apache-2.0 / MS-PL / BSD-3). 0 GPL/AGPL/RPL/SSPL/commercial in the release binary. - The 3 license-pinned deps verified against nuspec: AutoMapper 14.0.0 MIT (15.x RPL — pinned), Magick.NET 14.15.0 Apache-2.0, QuestPDF 2022.12.12 MIT (> = commercial — pinned). Match #902. - type="file" licenses resolved manually (ExtendedXmlSerializer/SharpToken MIT, SkiaSharp/System.* MS-.NET MIT) — the SPDX angle-matter flagged in the dispatch. - 2 non-release items flagged for arbitrage: 1. FluentAssertions 8.5.0 (Tests) — commercial Xceed since v8.0 (2025-02); type=file + requireLicenseAcceptance=true. Test-only, does not ship. 2. UglyToad.PdfPig 1.7.0-custom-5 (AssetConverter) — custom build, not on nuget.org, license undeclared. Real PdfPig = Apache-2.0; custom-build provenance needs confirmation. If both flags resolve permissively, the license gate is PASS. This is a result, not a gap. 0 code change, 0 prod CSV, 0 run. Read-only audit; doc-only. Co-Authored-By: Claude-Code <noreply@anthropic.com> * docs(licensing): #905 reconcile verdict — PdfPig resolved via #908, 24/24 permissive, gate PASS Reconciles the §Verdict headline with the §7.2 finding ai-01 flagged: the title said "100% permissive, all 24 direct deps" while §7.2 documented one direct dep (UglyToad.PdfPig 1.7.0-custom-5) with no declared licence. #908 swapped that dep to the official PdfPig 0.1.14 (Apache-2.0, SPDX expression in the nuspec) — so 24/24 direct deps are now genuinely permissive and the headline is honest. Changes: - §Verdict: headline now "24/24 direct deps permissive", PdfPig-custom marked RESOLVED via #908, only FluentAssertions (test-only, non-shipped) remains flagged. Gate = PASS (no caveat). - §1 table: UglyToad.PdfPig row → PdfPig 0.1.14 Apache-2.0 (official, swapped via #908). - §2 VisualTests row: no longer "contrast" — both projects now use the same official PdfPig. - §3 transitive: UglyToad.PdfPig.* → PdfPig.* 0.1.14 Apache-2.0. - §7.2: marked RESOLVED, original finding retained as audit record. - §8 conclusion: 24/24 permissive, gate PASS, FluentAssertions = separate jsboige arbitration. Co-Authored-By: Claude-Code <noreply@anthropic.com> --------- Co-authored-by: Your <your.email@example.com> Co-authored-by: Claude-Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the doc-rot loop on two dependency decisions taken this cycle.
Magick.NET 14.14.0 → 14.15.0
#871 merged (
b70984f4). A forced restore on master emitted 28NU1901/NU1902lines (10 medium, 18 low), all against 14.14.0; each advisory declarespatched = 14.15.0exactly. Licence unchanged (Apache-2.0,requireLicenseAcceptance: false). Table updated, and the existing no-op-CMYK-for-PNG note (#632) preserved verbatim.AutoMapper 14.0.0 — new row, licence pin
The pin rationale lived only in a
.csprojcomment. That is not where an agent looks before approving a dependency bump, which is how #887 (Dependabot 14.0.0 → 15.1.3) arrived looking routine: green CI, a real security advisory in its body, and no visible sign it would revert decision jsboige 2026-06-23 (#588 /6caf5833) and move the repo from MIT to RPL-1.5 / commercial (requireLicenseAcceptance: true). Surfacing it in the table that CLAUDE.md presents as authoritative is the cheap prevention. Marked QuestPDF as licence-pinned too, for the same reason.Restore-vs-build note
Added, because it cost me a wrong conclusion this cycle: an incremental
dotnet buildreported 0 warnings whiledotnet restore --forcereported 28. NuGet audit only runs on restore. So the #587 zero-warning invariant can go red with no code change at all, purely from advisory drift against a pinned version — and the obvious check silently misses it.Docs only — 0 code, 0 config, 0 prod CSV.
🤖 Generated with Claude Code