Optional package dependency review
Reviewed for the 0.5.0 release on 2026-09-18. compatibility/optional-dependencies.json records exact NuGet dependency declarations, source restore closures and license expressions. The optional package verifier checks these identities against actual restored artifacts. WeavePort source remains MIT; dependencies keep their own licenses.
| Dependency | Version | Use | License and redistribution obligations |
|---|---|---|---|
| Grpc.AspNetCore.Server | 2.83.0 | Server runtime | Apache-2.0; retain license, attribution and any applicable notices; identify modifications if made |
| Grpc.Net.Client, Grpc.Net.Common, Grpc.Core.Api | 2.83.0 | Client/server runtime | Apache-2.0; same obligations |
| Google.Protobuf | 3.36.1 | Protocol runtime | BSD-3-Clause; reproduce copyright, conditions and disclaimer; no endorsement |
| Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.DependencyInjection.Abstractions | 8.0.0 | Standalone client transitive closure | MIT; retain copyright/license and bundled third-party notices |
| Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.DependencyInjection.Abstractions | 10.0.12 | Hosting consumer closure | Existing core MIT review; higher compatible versions selected when Hosting is present |
| Grpc.Tools | 2.84.0 | Build only, PrivateAssets=all | Apache-2.0 package metadata; upstream combined license includes bundled tool component terms. Tools/binaries are not shipped in WeavePort runtime packages |
License text is retained with normalized text whitespace/line endings. Exact source provenance comes from the NuGet nuspec repository commit:
- gRPC .NET
4301104498e53898a452e8fb2fea6c0b1492b755: license, retained in grpc-dotnet-LICENSE.txt. - Protobuf
f377bfefc5e2cfab68b816903c25b23e091c439d: license, retained in protobuf-LICENSE.txt. Its explicit generated-code clause assigns generated code to the input-file owner; the runtime retains its BSD license. - gRPC tools
3252a89f10d8e92997862167ca7d095ecda85973: combined tool license, retained in grpc-tools-LICENSE.txt. - Microsoft 8.0.0 nuspec commit
5535e31a712343a63f5d7d796cd874e563e5ac14: exact package MIT license and third-party notices are retained from the NuGet archives.
The checked gRPC/Protobuf nupkgs declare SPDX expressions rather than embedded license files. Their exact source licenses are retained here and included with the gateway client package as supporting attribution. No third-party runtime DLL is embedded in a WeavePort nupkg; NuGet resolves dependencies separately. Applications redistributing a published output must preserve the dependency licenses/notices with those binaries. No source or binary modifications to these external dependencies are made. This is a dependency/notice review, not a vulnerability assessment or an assertion that every dependency is MIT.