Granit Tech Stack — ADR-justified dependencies

Frameworks fail when their dependencies stop being maintained. Granit picks each direct dependency the way a senior engineer picks a kitchen knife — based on what’s been kept sharp for years, not what’s trending this quarter. Every choice that had alternatives is captured in an ADR so the reasoning survives the person who made it.

This page lists every direct production dependency, organized by functional domain. Indirect transitive dependencies — and there are many — are tracked in THIRD-PARTY-NOTICES.md.

For test-only dependencies, see Testing stack (ADR-003).

Runtime and language

Component	Version	Role
.NET	10	Runtime and SDK
C#	14	Language
ASP.NET Core	10	Web framework

Data and persistence

Library	License	Role	ADR
Entity Framework Core	MIT	ORM, migrations, interceptors (audit, soft delete)	—
Npgsql.EntityFrameworkCore.PostgreSQL	PostgreSQL	PostgreSQL provider for EF Core	—
Microsoft.EntityFrameworkCore.SqlServer	MIT	SQL Server provider for EF Core	—
StackExchange.Redis	MIT	Redis client for distributed caching	ADR-002
FusionCache	MIT	L1/L2 cache with backplane, fail-safe, stampede protection, OpenTelemetry	ADR-018
Microsoft.Extensions.Caching.Hybrid	MIT	`HybridCache` backbone — wrapped by Granit’s tenant-scoped cache service	—

Messaging and scheduling

Library	License	Role	ADR
Wolverine	MIT	Message bus, transactional outbox, handler pipeline	ADR-005
Cronos	MIT	CRON expression parsing for recurring jobs	ADR-005

Security and identity

Library	License	Role	ADR
VaultSharp	Apache-2.0	HashiCorp Vault client — used by `Granit.Vault.HashiCorp` (transit encryption, dynamic credentials)	—
Azure.Security.KeyVault.Keys	MIT	Azure Key Vault key operations (encrypt/decrypt)	—
Azure.Security.KeyVault.Secrets	MIT	Azure Key Vault secret management (DB credentials)	—
Azure.Identity	MIT	DefaultAzureCredential for Azure SDK authentication	—
Microsoft.AspNetCore.Authentication.JwtBearer	MIT	JWT Bearer authentication middleware	—

Validation

Library	License	Role	ADR
FluentValidation	Apache-2.0	Declarative validation rules	ADR-006
SmartFormat	MIT	Pluralization in validation messages	ADR-008

AI

Library	License	Role	ADR
Microsoft.Extensions.AI	MIT	Provider-agnostic `IChatClient` / `IEmbeddingGenerator` abstractions — used by `Granit.AI`	—
Microsoft.Extensions.AI.OpenAI	MIT	OpenAI integration (GPT-4o, o3/o4-mini, embeddings) for `Granit.AI.OpenAI` and `Granit.AI.AzureOpenAI`	—
Azure.AI.OpenAI	MIT	Azure OpenAI Service client with `DefaultAzureCredential` support — used by `Granit.AI.AzureOpenAI`	—
OllamaSharp	MIT	Ollama client for local model execution + `/api/show` capability discovery — used by `Granit.AI.Ollama`	—
Microsoft.Extensions.VectorData.Abstractions	MIT	Provider-agnostic vector store interface — used by `Granit.AI.VectorData`	—
ModelContextProtocol	MIT	MCP client/server SDK — used by `Granit.AI.Mcp` and `Granit.Mcp.{Client,Server}`	—
ModelContextProtocol.AspNetCore	MIT	ASP.NET Core hosting for MCP tool sources	—

API and web

Library	License	Role	ADR
Asp.Versioning	MIT	API versioning (URL segment, header, query)	ADR-004
Scalar.AspNetCore	MIT	Interactive OpenAPI documentation UI	ADR-009
Microsoft.AspNetCore.OpenApi	MIT	OpenAPI 3.1 document generation (versioned per major API)	ADR-009
Microsoft.AspNetCore.OData	MIT	OData v4 runtime — bridges `QueryDefinition<T>` to EntitySets for Power BI / Excel / Tableau in `Granit.Http.ODataExposure`	ADR-050
Microsoft.AspNetCore.OutputCaching.StackExchangeRedis	MIT	Distributed output cache backplane for `Granit.Http.OutputCaching.StackExchangeRedis`	—
Yarp.ReverseProxy	MIT	Reverse-proxy core for the Backend-For-Frontend pattern (`Granit.Bff.Yarp`)	—
Microsoft.Extensions.Http.Resilience	MIT	Polly v8 resilience pipeline for outbound HTTP (retry, circuit breaker, timeout) — used by HTTP-based notification providers and webhook delivery	—
AngleSharp	MIT	HTML parsing + DOM traversal — used by `Granit.Browsing` and notification template processors	—

Observability

Library	License	Role	ADR
Serilog	Apache-2.0	Structured logging (OTLP sink)	ADR-001
OpenTelemetry .NET	Apache-2.0	Distributed tracing, metrics (OTLP export)	ADR-001

Templating and document generation

Library	License	Role	ADR
Scriban	BSD-2-Clause	Template engine (Liquid-compatible, sandboxed)	ADR-010
Mjml.Net	MIT	MJML → responsive HTML email transformer in the templating pipeline	—
PuppeteerSharp	MIT	HTML-to-PDF rendering via headless Chromium	ADR-012
Microsoft.Playwright	Apache-2.0	Headless browser automation — used by `Granit.Browsing` providers	—
PdfPig	Apache-2.0	PDF text extraction for `Granit.AI.Extraction` and document indexing	—
ClosedXML	MIT	Excel (.xlsx) generation	ADR-011

Data exchange (import/export)

Library	License	Role	ADR
Sep	MIT	High-performance CSV parsing	ADR-015
Sylvan.Data.Excel	MIT	Excel (.xlsx/.xls) parsing	ADR-016

Storage and imaging

Library	License	Role	ADR
AWSSDK.S3	Apache-2.0	S3-compatible object storage (MinIO, Ceph, etc.)	—
Azure.Storage.Blobs	MIT	Azure Blob Storage client — used by `Granit.BlobStorage.AzureBlob`	—
Google.Cloud.Storage.V1	Apache-2.0	Google Cloud Storage client — used by `Granit.BlobStorage.GoogleCloud`	—
Magick.NET	Apache-2.0	Image processing (resize, WebP/AVIF, EXIF stripping)	ADR-013

Notifications

Library	License	Role	ADR
MailKit	MIT	SMTP email delivery	—
Azure.Communication.Email	MIT	Azure Communication Services email sending	—
Azure.Communication.Sms	MIT	Azure Communication Services SMS sending	—
AWSSDK.SimpleEmailV2	Apache-2.0	Amazon SES v2 email delivery — used by `Granit.Notifications.Email.AwsSes`	—
AWSSDK.SimpleNotificationService	Apache-2.0	Amazon SNS SMS delivery — used by `Granit.Notifications.Sms.AwsSns`	—
Microsoft.Azure.NotificationHubs	MIT	Azure Notification Hubs push notifications	—
Microsoft.AspNetCore.SignalR	MIT	Real-time WebSocket notifications	—
Lib.Net.Http.WebPush	MIT	Web Push notifications (VAPID)	—

Twilio, SendGrid, and Scaleway providers (Granit.Notifications.Twilio, Granit.Notifications.Email.SendGrid, Granit.Notifications.Email.Scaleway) use the vendors’ REST APIs directly via Microsoft.Extensions.Http.Resilience — no vendor SDK is required.

Miscellaneous

Library	License	Role	ADR
Microsoft.IO.RecyclableMemoryStream	MIT	Pooled memory streams (reduces GC pressure)	—

Test-only dependencies

These libraries are used exclusively in *.Tests projects and are not shipped in production packages.

Library	License	Role	ADR
xUnit v3	Apache-2.0	Test framework	ADR-003
Shouldly	BSD-3-Clause	Assertion library	ADR-003, ADR-014
NSubstitute	BSD-3-Clause	Mocking framework	ADR-003
Bogus	MIT	Test data generation	ADR-003
Testcontainers	MIT	Docker-based integration tests	ADR-007

License summary

License	Examples
MIT	EF Core, Wolverine, ClosedXML, StackExchange.Redis, Microsoft.Extensions.AI, Microsoft.AspNetCore.OData, Yarp.ReverseProxy, ModelContextProtocol, MailKit, OllamaSharp
Apache-2.0	OpenTelemetry, Serilog, FluentValidation, Magick.NET, Google.Cloud.Storage.V1, AWSSDK.*, Microsoft.Playwright, PdfPig
BSD-3-Clause	NSubstitute, Shouldly
BSD-2-Clause	Scriban
PostgreSQL	Npgsql

All dependencies are OSI-approved open-source licenses compatible with Apache-2.0. Authoritative counts, exact versions, and copyright notices are maintained in THIRD-PARTY-NOTICES.md — the table above is a quick spectrum, not a contract.