<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <!--
    Versions are pinned here for the whole solution. Packages are added per milestone
    rather than all at once, so that every entry is one we have actually verified and
    restored. See docs/adr/ for the choices behind the notable ones.
  -->
  <ItemGroup Label="ASP.NET Core">
    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
  </ItemGroup>
  <ItemGroup Label="Endpoints">
    <!--
      FastEndpoints drags FluentValidation, JobQueues and Messaging in behind it. None of the
      three are used: validation lives in the feature services and is banned from moving into a
      Validator<T> (see BannedSymbols.txt and ADR 0008), and there is no message bus. They are
      left as plain transitives rather than declared here, because declaring a transitive under
      central transitive pinning is a standing promise to keep its version current, and these are
      not ours to steer. Declare one only to force a version forward for an advisory, as the
      group below does.
    -->
    <PackageVersion Include="FastEndpoints" Version="8.2.0" />
  </ItemGroup>
  <ItemGroup Label="Pinned transitive dependencies">
    <!--
      Microsoft.AspNetCore.OpenApi 10.0.10 resolves Microsoft.OpenApi 2.0.0, which is
      covered by GHSA-v5pm-xwqc-g5wc (high: circular schema references can terminate
      OpenAPI parsing; vulnerable <= 2.7.4, patched in 2.7.5). Pinned forward within the
      2.x major that ASP.NET Core 10 targets. Revisit when the ASP.NET Core package
      itself moves off 2.0.0.
    -->
    <PackageVersion Include="Microsoft.OpenApi" Version="2.11.0" />
    <!--
      Microsoft.EntityFrameworkCore.Sqlite 10.0.10 resolves SQLitePCLRaw 2.1.11, whose bundled
      SQLite build is covered by GHSA-2m69-gcr7-jv3q (high). 2.1.12 is the fix and is a patch bump
      inside the minor EF asks for, so nothing needs to move. Pinned as a family: the bundle, the
      core, the provider and the native library ship in lockstep and a mixed set is a loader error
      at runtime rather than a build failure.

      SQLitePCLRaw 3.x exists and is deliberately not used here. EF Core 10 is built against 2.1.x,
      and 3.0 is also where bundle_e_sqlcipher was deprecated — which is one of the reasons the
      local cache does not use SQLCipher at all. See DodoSSH.Client.Storage.
    -->
    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
    <PackageVersion Include="SQLitePCLRaw.core" Version="2.1.12" />
    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
    <PackageVersion Include="SQLitePCLRaw.provider.e_sqlite3" Version="2.1.12" />
  </ItemGroup>
  <ItemGroup Label="Persistence">
    <!--
      EF Core pinned explicitly. The Npgsql provider asks only for 10.0.4 while
      Microsoft.EntityFrameworkCore.Design pulls 10.0.10, and because Design is
      PrivateAssets=all that higher version does not flow to referencing projects — which
      produces a CS1705 in any test project that references Infrastructure. Pinning here lifts
      every project to one version via central transitive pinning.
    -->
    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10" />
    <!--
      Verified compatible with EF 10 before adopting; the plan flagged this package as
      historically lagging EF majors. Fallback if it ever blocks an upgrade is explicit
      HasColumnName in every IEntityTypeConfiguration: more code, zero risk.
    -->
    <PackageVersion Include="EFCore.NamingConventions" Version="10.0.1" />
    <!--
      The client's local cache. Plain SQLite, deliberately not SQLCipher: the rows are already
      ciphertext, so an encrypted database file would add a native dependency and a licence
      obligation to protect bytes that are protected already. SQLitePCLRaw's own
      bundle_e_sqlcipher is deprecated as of 3.0 besides. See DodoSSH.Client.Storage.
    -->
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
  </ItemGroup>
  <ItemGroup Label="Cryptography">
    <!--
      NSec wraps libsodium. Chosen over the BCL because .NET has no X25519 or Ed25519, and
      because ChaCha20Poly1305.IsSupported is false on macOS, which rules out the in-box
      AEAD for a cross-platform client. NSec also holds key material in libsodium's
      guarded, non-swappable memory, which a byte[] cannot do. See docs/crypto.md.

      26.4.0 targets net9.0; net10.0 consumes it by forward compatibility. Native binaries
      arrive via the libsodium package, pinned here because central transitive pinning
      requires it to be declared.
    -->
    <PackageVersion Include="NSec.Cryptography" Version="26.4.0" />
    <PackageVersion Include="libsodium" Version="1.0.22" />
    <!-- Managed differential oracle for the crypto test suite only. -->
    <PackageVersion Include="BouncyCastle.Cryptography" Version="2.6.2" />
  </ItemGroup>
  <ItemGroup Label="Desktop client">
    <!--
      SSH.NET already covers PTY shells, all three auth methods, ed25519/RSA/ECDSA, encrypted
      keys including PuTTY .ppk, SFTP, and local/remote/dynamic forwarding. The gaps are
      agent forwarding (needs an upstream change; de-scoped from v1) and being handed a
      pre-connected Stream — it performs its own socket connect, which is why the relay and
      ProxyJump both go through a loopback TCP bridge. See docs/adr/.
    -->
    <PackageVersion Include="SSH.NET" Version="2025.1.0" />
    <!--
      The S3 client, for buckets as a remote in the file browser. First-party, Apache-2.0, and
      managed only — no native assets — which is the bar this file sets for anything that gets
      pinned. Taken rather than hand-rolled because the alternative here is implementing SigV4
      request signing, and unlike the openssh-key-v1 container (which had no library at all) a
      maintained implementation of this exists and is the one every S3-compatible service tests
      against.

      AWSSDK.Core is declared and pinned forward. What AWSSDK.S3 4.0.101.6 resolves on its own is
      4.0.1, which is covered by GHSA-9cvc-h2w8-phrp — low severity, and this repository builds
      with NuGet audit as errors, so "low" is not a reason to carry it. 4.0.100.9 is past it and
      inside the same major. Same treatment as the OpenApi and SQLitePCLRaw entries above, and the
      same standing obligation: this is now ours to keep current.
    -->
    <PackageVersion Include="AWSSDK.S3" Version="4.0.101.6" />
    <PackageVersion Include="AWSSDK.Core" Version="4.0.100.9" />
    <!--
      Avalonia 12.1.0, with the WebView control on 12.0.1 — the latest it has shipped. Its
      dependency is Avalonia >= 12.0.0 with no upper bound and it targets net10.0, so the skew
      is fine. Checked rather than assumed, because a control package lagging the core version
      is exactly where a silent runtime mismatch would hide.
    -->
    <PackageVersion Include="Avalonia" Version="12.1.1" />
    <PackageVersion Include="Avalonia.Desktop" Version="12.1.1" />
    <!--
      The Android head. Same core version as the desktop one, which is not a courtesy: the two heads
      share every view model, so a version skew between them would be a skew inside one object graph.
    -->
    <PackageVersion Include="Avalonia.Android" Version="12.1.1" />
    <PackageVersion Include="Avalonia.Themes.Fluent" Version="12.1.1" />
    <PackageVersion Include="Avalonia.Fonts.Inter" Version="12.1.1" />
    <PackageVersion Include="Avalonia.Controls.WebView" Version="12.0.1" />
    <!--
      Lets a test lay out real XAML and measure it, which is the only way this repository can catch a
      control clipped off the bottom of a column — the defect this window has already shipped once. Pinned
      to the core version exactly rather than allowed to drift: the whole value of the harness is that the
      numbers it measures are the numbers the application renders.
    -->
    <PackageVersion Include="Avalonia.Headless" Version="12.1.1" />
    <!--
      Source-generated MVVM, so there is no reflection and trimming stays viable. ReactiveUI's one
      real advantage is observable composition over streams, and the place that would help — the
      terminal data plane — is Pipelines and channel code rather than view models.
    -->
    <PackageVersion Include="CommunityToolkit.Mvvm" Version="8.4.2" />
    <!--
      Packaging and self-update for the Windows desktop head. MIT, and on net10.0 it declares no
      dependencies at all — the whole package is one managed assembly, so it restores and compiles
      on the Linux runner that builds the solution even though the thing it produces only runs on
      Windows. That mattered enough to check: a per-OS conditional PackageReference is not available
      here, because it would make packages.lock.json depend on the operating system and CI's locked
      restore would then fail on whichever platform did not write it.

      MSIX would have been the platform-native choice and is ruled out rather than deprioritised: a
      packaged app runs WebView2 in an AppContainer where loopback is blocked, and the terminal data
      plane is a loopback WebSocket. See docs/platform-flags.md.

      The update feed this is pointed at is the project's own forge and never a DodoSSH deployment.
      That is ADR 0011 rule 2, and it is the reason the repository URL in VelopackUpdateSource is a
      constant rather than a setting: an operator who could answer the update check could pin a
      chosen user to a known-vulnerable build. See docs/adr/0013-desktop-distribution-and-updates.md.
    -->
    <PackageVersion Include="Velopack" Version="1.2.0" />
  </ItemGroup>
  <ItemGroup Label="Versioning">
    <!--
      One version for the whole repository, derived from the nearest v* git tag. The tag was already
      the version of record — ci.yml's "work out the tags" step parses refs/tags/v* for the docker
      image — and nothing set an assembly version at all, so every binary reported the SDK's default
      1.0.0 and the API served that as its ServerVersion. Deriving from the tag makes those one
      number instead of two that can disagree.

      MinVer's one real failure mode is that it answers plausibly rather than failing: a shallow
      clone with no tags yields 0.0.0-alpha.0.N. Here that is not cosmetic — Velopack compares the
      version baked into a package against the one it is running, so a wrong answer is a client that
      never updates. Hence two guards in ci.yml: fetch-depth 0 on every checkout, and a step on tag
      builds that fails if the computed version and the tag disagree.
    -->
    <PackageVersion Include="MinVer" Version="7.0.0" />
  </ItemGroup>
  <ItemGroup Label="Analyzers">
    <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
    <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.137" />
  </ItemGroup>
  <ItemGroup Label="Testing">
    <!--
      xunit.v3 runs on Microsoft.Testing.Platform, not VSTest. Microsoft.NET.Test.Sdk and
      coverlet.collector are VSTest components: referencing them alongside MTP raises
      MTP0001 and their collector never runs, so neither is referenced.

      No coverage collector yet. Microsoft.Testing.Extensions.CodeCoverage 18.9.0 pulls
      Microsoft.Testing.Platform.MSBuild 1.9.1, which is built against MTP 1.x and throws
      TypeLoadException on IDataConsumer against the MTP 2.3.x that xunit.v3 3.2.2 brings.
      Coverage gates are an M3 concern (90% on Domain and Authorization); pick a version
      aligned with MTP 2.x then rather than carrying a broken dependency until it matters.
    -->
    <PackageVersion Include="xunit.v3" Version="3.2.2" />
    <PackageVersion Include="Shouldly" Version="4.3.0" />
    <PackageVersion Include="NSubstitute" Version="6.0.0" />
    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
    <!-- Generic container, for the OpenSSH server the SSH suite talks to. -->
    <PackageVersion Include="Testcontainers" Version="4.13.0" />
    <PackageVersion Include="Respawn" Version="7.0.0" />
    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
    <!--
      Stands in for the identity provider so integration tests exercise the real JwtBearer
      pipeline. A TestAuthHandler that bypasses it would hide exactly the claim-mapping
      mistakes that cause real authorization holes.
    -->
    <PackageVersion Include="WireMock.Net" Version="2.13.0" />
  </ItemGroup>
</Project>