Merconiq Documentation

Third-party dependency and redistribution notices

This inventory records the dependency and copied-asset evidence visible at Merconiq baseline f86c1656a2ab5dbf1eed935a169118a7efe4badc (16 September 2026). It is an engineering notice and provenance record, not legal advice or a conclusion about which license applies to a particular owner, operator, or distribution model. The repository’s MIT License covers Merconiq-authored material only; it does not relicense third-party material.

Before distributing a build, the owner should confirm the applicable terms for the intended use and preserve the relevant package and asset notices. In particular, the entries marked owner review must not be treated as cleared by the repository MIT license.

Direct NuGet references

The following 40 unique package references are declared by the four pinned projects. Production means the package is referenced by the web or runtime projects; Build/test means it is used only by the test project or as a build tooling dependency. License labels are the SPDX expression reported by the NuGet registration metadata where one exists. A package-provided license file is authoritative when NuGet reports only a deprecated license URL.

Package Version Project scope Reported terms / notice source
Asp.Versioning.Mvc; Asp.Versioning.Mvc.ApiExplorer 10.2.1 Web MIT (NuGet license)
AutoFixture 4.18.1 Build/test MIT (NuGet license)
AutoMapper 16.2.0 Infrastructure RPL 1.5 or the separate Lucky Penny Software license; see the package LICENSE.md and license options (owner review)
ClosedXML 0.105.0 Web MIT (NuGet license)
coverlet.collector 10.0.1 Build/test MIT (NuGet license)
FluentAssertions 8.10.0 Tests Xceed Fluent Assertions Community License for non-commercial use; commercial use requires owner review of the package LICENSE (project)
FluentValidation; FluentValidation.DependencyInjectionExtensions 12.1.1 Core Apache-2.0 (NuGet license)
MediatR 14.1.0 Core RPL 1.5 or the separate Lucky Penny Software license; see the package LICENSE.md and license options (owner review)
Microsoft.AspNetCore.Authentication.JwtBearer; Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore 10.0.9 Web MIT (NuGet license)
Microsoft.AspNetCore.Identity.EntityFrameworkCore 10.0.9 Infrastructure, Web MIT (NuGet license)
Microsoft.AspNetCore.Mvc.Testing 10.0.9 Tests MIT (NuGet license)
Microsoft.EntityFrameworkCore 10.0.9 Infrastructure MIT (NuGet license)
Microsoft.EntityFrameworkCore.Design; Microsoft.EntityFrameworkCore.Tools 10.0.9 Infrastructure, Web (Design) MIT (NuGet license)
Microsoft.EntityFrameworkCore.InMemory 10.0.9 Tests MIT (NuGet license)
Microsoft.Extensions.Caching.Abstractions; Microsoft.Extensions.Identity.Stores; Microsoft.Extensions.Logging.Abstractions 10.0.9 Core MIT (NuGet license)
Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore 10.0.9 Web MIT (NuGet license)
Microsoft.ML; Microsoft.ML.TimeSeries 5.0.0 Core MIT (NuGet license)
Microsoft.NET.Test.Sdk 18.8.1 Tests MIT (NuGet license)
Moq 4.20.72 Tests BSD-3-Clause (NuGet license)
MudBlazor 9.5.0 Web MIT (NuGet license)
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.2 Infrastructure PostgreSQL License (NuGet license)
OpenTelemetry.Exporter.OpenTelemetryProtocol; OpenTelemetry.Extensions.Hosting; OpenTelemetry.Instrumentation.AspNetCore; OpenTelemetry.Instrumentation.EntityFrameworkCore; OpenTelemetry.Instrumentation.Http; OpenTelemetry.Instrumentation.Runtime 1.18.0 (EntityFrameworkCore 1.18.0-beta.1) Web Apache-2.0 (NuGet license)
QuestPDF 2026.7.1 Web QuestPDF dual-license package; the package LICENSE.md and pricing/licensing page require owner review
Serilog.AspNetCore 10.0.0 Web Apache-2.0 (NuGet license)
Swashbuckle.AspNetCore 10.2.3 Web MIT (NuGet license)
Testcontainers.PostgreSql 4.15.0 Tests MIT (NuGet license)
xunit; xunit.runner.visualstudio 2.9.3 / 4.0.0 Tests Apache-2.0 (NuGet license)

The table preserves package identities and pinned versions while grouping packages that share the same terms. The authoritative direct-reference locations are the PackageReference entries in:

Transitive NuGet dependencies

This baseline does not contain a packages.lock.json; transitive versions are therefore resolved by NuGet during restore and must not be guessed or copied from a later restore. The exact graph for a build must be captured after restoring with the pinned SDK (global.json):

dotnet restore
dotnet list Merconiq.sln package --include-transitive --format json > dependency-inventory.json

The resulting dependency-inventory.json is a package inventory of resolved transitive package IDs and versions for that build; it is not, by itself, a complete dependency-path graph. Preserve each project’s obj/project.assets.json or an equivalent lock-file graph alongside this inventory when a redistribution decision depends on dependency paths. Each transitive package retains its own license and notice obligations; the top-level MIT license is not a substitute. CI should retain this output with the build evidence when a redistribution decision depends on the resolved graph. The local audit for this change could not execute that command because the pinned .NET SDK is not installed in the execution environment.

Some direct packages also carry non-NuGet redistribution material. The QuestPDF 2026.7.1 package was inspected as a package archive and contains:

Those package-provided files should be preserved or made available in the chosen redistribution channel. Whether the Community, Professional, or Enterprise QuestPDF terms apply is owner-pending and depends on facts not recorded in this repository.

Frameworks and external runtime inputs

The projects also use the Microsoft.AspNetCore.App framework reference. The container configuration uses Microsoft .NET base images and a PostgreSQL 16 image. These are runtime and deployment inputs rather than NuGet references; their exact image digests and any separately distributed image content should be recorded with the release artifact when an owner authorizes publication. This document does not claim that the application source license covers those images or the PostgreSQL distribution.

Copied browser assets

These files are committed under Merconiq.Web/wwwroot/lib/ and are separate from NuGet restore:

Asset Version evidence License / notice
Bootstrap 5.3.3 in the distributed CSS headers MIT; notice at wwwroot/lib/bootstrap/LICENSE
jQuery 3.7.1 in the distributed JS headers MIT; notice at wwwroot/lib/jquery/LICENSE.txt
jQuery Validation 1.21.0 in the distributed JS headers MIT; notice at wwwroot/lib/jquery-validation/LICENSE.md
jQuery Validation Unobtrusive 4.0.0 in the distributed JS header Apache-2.0 header in the distributed JS; adjacent LICENSE.txt says MIT. Provenance discrepancy remains owner-review pending before replacing or repackaging it

The copied JavaScript, CSS, source maps, and license files are covered by the notices shipped beside each asset. Do not remove those files when preparing a redistribution bundle.

Owner review queue

The owner should record the outcome separately from this engineering change:

  1. Confirm the intended Merconiq distribution and whether the project qualifies for the applicable QuestPDF terms; retain the QuestPDF package license and native dependency notices.
  2. Confirm whether AutoMapper and MediatR use the RPL 1.5 terms or a Lucky Penny Software license for the intended distribution.
  3. Confirm whether the FluentAssertions community terms are appropriate for the build/test use and whether test dependencies are excluded from the shipped artifact.
  4. Capture a restored transitive graph for each shipped build and preserve the corresponding package notices. This record does not make legal conclusions for the owner.
This site is open source. Improve this page.