Tech Stack
Granit builds on battle-tested open-source libraries. This page lists every direct production dependency, organized by functional domain. Each library was selected through an Architecture Decision Record (ADR) when multiple alternatives existed.
For test-only dependencies, see Testing stack (ADR-003).
Runtime and language
Section titled “Runtime and language”| Component | Version | Role |
|---|---|---|
| .NET | 10 | Runtime and SDK |
| C# | 14 | Language |
| ASP.NET Core | 10 | Web framework |
Data and persistence
Section titled “Data and persistence”| Library | License | Role | ADR |
|---|---|---|---|
| Entity Framework Core | MIT | ORM, migrations, interceptors (audit, soft delete) | — |
| Npgsql.EntityFrameworkCore.PostgreSQL | PostgreSQL | PostgreSQL provider for EF Core | — |
| StackExchange.Redis | MIT | Redis client for distributed caching | ADR-002 |
| Microsoft.Extensions.Caching.Hybrid | MIT | L1/L2 HybridCache (.NET 9+) | ADR-002 |
Messaging and scheduling
Section titled “Messaging and scheduling”| Library | License | Role | ADR |
|---|---|---|---|
| Wolverine | MIT | Message bus, transactional outbox, handler pipeline | ADR-005 |
| Cronos | MIT | CRON expression parsing for recurring jobs | ADR-005 |
Security and identity
Section titled “Security and identity”| Library | License | Role | ADR |
|---|---|---|---|
| VaultSharp | Apache-2.0 | HashiCorp Vault client — used by Granit.Vault.HashiCorp (transit encryption, dynamic credentials) | — |
| Azure.Security.KeyVault.Keys | MIT | Azure Key Vault key operations (encrypt/decrypt) | — |
| Azure.Security.KeyVault.Secrets | MIT | Azure Key Vault secret management (DB credentials) | — |
| Azure.Identity | MIT | DefaultAzureCredential for Azure SDK authentication | — |
| Microsoft.AspNetCore.Authentication.JwtBearer | MIT | JWT Bearer authentication middleware | — |
Validation
Section titled “Validation”| Library | License | Role | ADR |
|---|---|---|---|
| FluentValidation | Apache-2.0 | Declarative validation rules | ADR-006 |
| SmartFormat | MIT | Pluralization in validation messages | ADR-008 |
API and web
Section titled “API and web”| Library | License | Role | ADR |
|---|---|---|---|
| Asp.Versioning | MIT | API versioning (URL segment, header, query) | ADR-004 |
| Scalar | MIT | Interactive OpenAPI documentation UI | ADR-009 |
Observability
Section titled “Observability”| Library | License | Role | ADR |
|---|---|---|---|
| Serilog | Apache-2.0 | Structured logging (OTLP sink) | ADR-001 |
| OpenTelemetry .NET | Apache-2.0 | Distributed tracing, metrics (OTLP export) | ADR-001 |
Templating and document generation
Section titled “Templating and document generation”| Library | License | Role | ADR |
|---|---|---|---|
| Scriban | BSD-2-Clause | Template engine (Liquid-compatible, sandboxed) | ADR-010 |
| PuppeteerSharp | MIT | HTML-to-PDF rendering via headless Chromium | ADR-012 |
| ClosedXML | MIT | Excel (.xlsx) generation | ADR-011 |
Data exchange (import/export)
Section titled “Data exchange (import/export)”| Library | License | Role | ADR |
|---|---|---|---|
| Sep | MIT | High-performance CSV parsing | ADR-015 |
| Sylvan.Data.Excel | MIT | Excel (.xlsx/.xls) parsing | ADR-016 |
Storage and imaging
Section titled “Storage and imaging”| Library | License | Role | ADR |
|---|---|---|---|
| AWSSDK.S3 | Apache-2.0 | S3-compatible object storage (MinIO, Ceph, etc.) | — |
| Magick.NET | Apache-2.0 | Image processing (resize, WebP/AVIF, EXIF stripping) | ADR-013 |
Notifications
Section titled “Notifications”| Library | License | Role | ADR |
|---|---|---|---|
| MailKit | MIT | SMTP email delivery | — |
| Azure.Communication.Email | MIT | Azure Communication Services email sending | — |
| Azure.Communication.Sms | MIT | Azure Communication Services SMS sending | — |
| Microsoft.Azure.NotificationHubs | MIT | Azure Notification Hubs push notifications | — |
| Microsoft.AspNetCore.SignalR | MIT | Real-time WebSocket notifications | — |
| Lib.Net.Http.WebPush | MIT | Web Push notifications (VAPID) | — |
Miscellaneous
Section titled “Miscellaneous”| Library | License | Role | ADR |
|---|---|---|---|
| Microsoft.IO.RecyclableMemoryStream | MIT | Pooled memory streams (reduces GC pressure) | — |
Test-only dependencies
Section titled “Test-only dependencies”These libraries are used exclusively in *.Tests projects and are not shipped in production packages.
| Library | License | Role | ADR |
|---|---|---|---|
| xUnit v3 | Apache-2.0 | Test framework | ADR-003 |
| Shouldly | BSD-3-Clause | Assertion library | ADR-003, ADR-014 |
| NSubstitute | BSD-3-Clause | Mocking framework | ADR-003 |
| Bogus | MIT | Test data generation | ADR-003 |
| Testcontainers | MIT | Docker-based integration tests | ADR-007 |
License summary
Section titled “License summary”| License | Count | Examples |
|---|---|---|
| MIT | 49 | EF Core, Wolverine, ClosedXML, StackExchange.Redis |
| Apache-2.0 | 15 | OpenTelemetry, Serilog, FluentValidation, Magick.NET |
| BSD-3-Clause | 2 | NSubstitute, Shouldly |
| BSD-2-Clause | 1 | Scriban |
| PostgreSQL | 1 | Npgsql |
All dependencies are OSI-approved open-source licenses compatible with Apache-2.0.
The full list with versions and copyright notices is maintained in
THIRD-PARTY-NOTICES.md.