diff --git a/README.md b/README.md
index 8fbda9d..a780af9 100644
--- a/README.md
+++ b/README.md
@@ -43,3 +43,5 @@ classification, immutable reuse records, full notices and portable-archive check
 Read [CONTRIBUTING](CONTRIBUTING.md), [security reporting](SECURITY.md) and the [code of conduct](CODE_OF_CONDUCT.md). ArcNotes remains **AGPL-3.0-only**; see [LICENSE](LICENSE) and [third-party notices](THIRD_PARTY_NOTICES.md).
 
 `--build-info --evidence <absolute-path.json>` writes offline support metadata from the compiled application. See [build identity](docs/build-identity.md).
+
+The [dependency admission gate](docs/dependency-policy.md) checks the complete locked package closure, immutable inputs, public publisher boundaries and upgrade evidence.
diff --git a/docs/dependency-policy.md b/docs/dependency-policy.md
new file mode 100644
index 0000000..de1a641
--- /dev/null
+++ b/docs/dependency-policy.md
@@ -0,0 +1,13 @@
+# Dependency admission (WP02.05)
+
+`eng/policy/dependency-policy.json` admits the complete 91 package-version closure from all committed NuGet locks, including build tools and platform assets not distributed by current CI. `DependencyPolicy.Validate` runs inside the existing repository `check`; its offline fixtures run inside the existing Linux unit-test pass. No new workflow or runtime test is introduced.
+
+Each admission retains the exact NuGet SHA-512 content identity, package licence declaration, cached published nuspec SHA-256, immutable upstream source commit, dependency class and maintenance assessment. The ANGLE package uses a licence file: its three-clause BSD terms were reviewed directly from the already restored package and its hash is recorded. Package SPDX metadata describes the package's declaration, not a relicensing of bundled native material. Existing source provenance, complete distributed package notices and locked restore continue to govern that material. No package was downloaded or upgraded to build this inventory.
+
+Only the existing public Contracts package and private build-time Build.Policy are admitted first-party inputs. Repository identity is checked against their owning publisher; internal generated Contracts cannot enter the public consumer. `NuGet.Config` retains nuget.org as its only feed. Restore verifies committed package hashes; the static gate does not pretend to authenticate new registry bytes without restore. Publisher credentials stay solely with producer workflows; this consumer has none.
+
+The current channel is `foundation-candidate`. Only exact reviewed first-party CI versions may use that channel exception. Stable admission rejects every prerelease in the closure. Locked macOS/WebAssembly transitive assets do not imply macOS CI or corresponding distributed artifacts. Native admission covers the unchanged Avalonia/Skia/HarfBuzz framework closure; adding a DesktopPlatform capability requires its own reviewed native admission and later integration evidence.
+
+`eng/policy/dependency-review.json` seals all dependency/build/feed/workflow inputs with LF-normalized SHA-256 hashes and records the unchanged framework baseline. A changed input must receive a reviewed record and all relevant evidence. The checker also reads all prior admission snapshots from Git history: an existing coordinate can never acquire a different content hash, even after removal, reintroduction or a new review. CI checks out full history. Dependency updates require compilation, applicable Windows/Linux AOT, compatibility, licence, security and SBOM assessment. Framework major upgrades additionally require an explicit runtime-posture assessment. The recorded baseline must be an ancestor of accepted origin/main, and its declared framework versions must equal the actual Git source at that commit; a successor review cannot reset the baseline to evade this obligation. Runtime/performance/migration checks are local opt-in only for affected behavior in an existing environment; missing coverage is stated. Never provision toolchains or create empty caches solely to increase validation, and never repeat public-download/install/hash cycles.
+
+The initial maintenance assessment retains known pinned inputs and the existing security/update-review process. It makes no unverified promise of current upstream support or vulnerability absence. Product owners review maintenance, replacement options and vulnerabilities when admitting an update. Historical WP02 stage evidence is reusable; actual tooling publication belongs to DesktopPlatform and consumer functional acceptance remains WP03/WP06/WP50.
diff --git a/eng/ArcForges.Repository/DependencyPolicy.cs b/eng/ArcForges.Repository/DependencyPolicy.cs
new file mode 100644
index 0000000..1693fe7
--- /dev/null
+++ b/eng/ArcForges.Repository/DependencyPolicy.cs
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using System.Xml.Linq;
+
+namespace ArcForges.Repository;
+
+/// <summary>Offline admission of the owner's complete locked dependency closure.</summary>
+public static partial class DependencyPolicy
+{
+    private const string Feed = "https://api.nuget.org/v3/index.json";
+    private static readonly Dictionary<string, string> Publishers = new(StringComparer.OrdinalIgnoreCase)
+    {
+        ["ArcForges.Build.Policy"] = "https://github.com/ArcForges/DesktopPlatform",
+        ["ArcForges.Contracts.PublicApi"] = "https://github.com/ArcForges/Contracts"
+    };
+
+    // Historical Git snapshots retain every admitted coordinate, including removed dependencies.
+    // A new review may admit a new version but cannot rewrite bytes under a previous version.
+    public static void ValidateHistory(string currentPolicy, IEnumerable<string> priorPolicies)
+    {
+        using var current = JsonDocument.Parse(currentPolicy);
+        var hashes = current.RootElement.GetProperty("packages").EnumerateArray()
+            .ToDictionary(p => Text(p, "id") + "/" + Text(p, "version"), p => Text(p, "contentHash"), StringComparer.OrdinalIgnoreCase);
+        foreach (var snapshot in priorPolicies)
+        {
+            using var prior = JsonDocument.Parse(snapshot);
+            foreach (var package in prior.RootElement.GetProperty("packages").EnumerateArray())
+            {
+                var coordinate = Text(package, "id") + "/" + Text(package, "version");
+                if (hashes.TryGetValue(coordinate, out var hash))
+                    Require(hash == Text(package, "contentHash"), "Immutable historical coordinate changed: " + coordinate);
+                else hashes.Add(coordinate, Text(package, "contentHash"));
+            }
+        }
+    }
+
+    public static void ValidateBaseline(string reviewJson, string baselineGlobalJson, string baselinePackagesXml)
+    {
+        using var review = JsonDocument.Parse(reviewJson);
+        using var sdk = JsonDocument.Parse(baselineGlobalJson);
+        var declared = review.RootElement.GetProperty("baselineFrameworkVersions");
+        var avalonia = XDocument.Parse(baselinePackagesXml).Descendants("PackageVersion")
+            .Single(p => (string?)p.Attribute("Include") == "Avalonia.Desktop").Attribute("Version")!.Value;
+        Require(Text(declared, "dotnet") == Text(sdk.RootElement.GetProperty("sdk"), "version") && Text(declared, "avalonia") == avalonia,
+            "Framework baseline reset does not match accepted Git source.");
+    }
+
+    public static void Validate(string root, IEnumerable<string> inventory)
+    {
+        var files = inventory.Distinct(StringComparer.Ordinal).ToArray();
+        string Read(string path)
+        {
+            var full = Path.GetFullPath(Path.Combine(root, path));
+            var relative = Path.GetRelativePath(root, full);
+            Require(!Path.IsPathRooted(relative) && relative != ".." && !relative.StartsWith(".." + Path.DirectorySeparatorChar, StringComparison.Ordinal), "Dependency input escapes owner.");
+            return File.ReadAllText(full);
+        }
+        using var document = JsonDocument.Parse(Read("eng/policy/dependency-policy.json"));
+        var policy = document.RootElement;
+        Require(policy.GetProperty("schemaVersion").GetInt32() == 1 && Text(policy, "repository") == "ArcNotes" && Text(policy, "licenceBoundary") == "AGPL", "Invalid dependency owner.");
+        Require(Text(policy, "channel") is "foundation-candidate" or "stable", "Invalid dependency channel.");
+        Require(Text(policy, "feed") == Feed, "Wrong dependency feed.");
+        Require(Text(policy, "nativeAdmission") == "existing-framework-closure-only; new native slots require DesktopPlatform admission", "Unreviewed native admission.");
+        var admitted = new Dictionary<string, JsonElement>(StringComparer.OrdinalIgnoreCase);
+        foreach (var entry in policy.GetProperty("packages").EnumerateArray())
+        {
+            var id = Text(entry, "id");
+            var version = Text(entry, "version");
+            Require(ExactVersion().IsMatch(version), "Floating dependency version.");
+            Require(admitted.TryAdd(id + "/" + version, entry), "Duplicate dependency admission.");
+            var licence = Text(entry, "licence");
+            Require(licence is "MIT" or "Apache-2.0" or "BSD-3-Clause" || licence == "AGPL-3.0-only" && id == "ArcForges.Build.Policy", "Forbidden dependency licence.");
+            Require(Convert.FromBase64String(Text(entry, "contentHash")).Length == 64, "Invalid lock integrity.");
+            Require(Sha40().IsMatch(Text(entry, "sourceCommit")) && Sha256().IsMatch(Text(entry, "nuspecSha256")), "Floating source tag or missing exact source evidence.");
+            Require(Uri.TryCreate(Text(entry, "sourceRepository"), UriKind.Absolute, out var source) && source.Scheme == "https", "Untrusted source location.");
+            Require(Text(entry, "maintenanceAssessment").Length >= 30 && Text(entry, "licenceEvidence").Length >= 20, "Missing dependency review.");
+            Require(Text(entry, "dependencyClass") is "framework" or "transport" or "tooling" or "library", "Missing dependency class.");
+            if (id.StartsWith("ArcForges.", StringComparison.OrdinalIgnoreCase))
+                Require(Publishers.TryGetValue(id, out var publisher) && publisher == Text(entry, "sourceRepository"), "Wrong publisher or internal contract import.");
+            if (version.Contains('-', StringComparison.Ordinal))
+                Require(Text(policy, "channel") == "foundation-candidate" && Publishers.ContainsKey(id) && Text(entry, "previewAdmission") == "exact-foundation-candidate", "Preview dependency on stable core path.");
+        }
+
+        var observed = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var path in files.Where(p => Path.GetFileName(p) == "packages.lock.json"))
+        {
+            using var locked = JsonDocument.Parse(Read(path));
+            foreach (var framework in locked.RootElement.GetProperty("dependencies").EnumerateObject())
+                foreach (var package in framework.Value.EnumerateObject())
+                {
+                    if (Text(package.Value, "type") == "Project") continue;
+                    var identity = package.Name + "/" + Text(package.Value, "resolved");
+                    Require(admitted.TryGetValue(identity, out var admission), "Unadmitted dependency: " + identity);
+                    Require(Text(package.Value, "contentHash") == Text(admission, "contentHash"), "Mutable version: locked package bytes changed.");
+                    observed.Add(identity);
+                    if (package.Value.TryGetProperty("dependencies", out var edges))
+                        foreach (var edge in edges.EnumerateObject())
+                            Require(framework.Value.EnumerateObject().Any(p => p.Name.Equals(edge.Name, StringComparison.OrdinalIgnoreCase)) ||
+                                framework.Name.Contains('/', StringComparison.Ordinal) &&
+                                locked.RootElement.GetProperty("dependencies").GetProperty(framework.Name.Split('/')[0]).EnumerateObject()
+                                    .Any(p => p.Name.Equals(edge.Name, StringComparison.OrdinalIgnoreCase)), "Incomplete transitive closure.");
+                }
+        }
+        Require(observed.Count > 0 && observed.SetEquals(admitted.Keys), "Dependency closure drift.");
+        foreach (var path in files.Where(p => Path.GetExtension(p) is ".csproj" or ".props" or ".targets"))
+            foreach (var element in XDocument.Parse(Read(path)).Descendants())
+            {
+                if (element.Name.LocalName == "PackageVersion")
+                {
+                    var id = (string?)element.Attribute("Include") ?? "";
+                    var version = (string?)element.Attribute("Version") ?? "";
+                    Require(ExactVersion().IsMatch(version) && admitted.ContainsKey(id + "/" + version), "Floating or unadmitted central dependency.");
+                }
+                if (element.Name.LocalName == "PackageReference")
+                    Require(element.Attribute("Version") is null && element.Attribute("VersionOverride") is null && !element.Elements().Any(e => e.Name.LocalName is "Version" or "VersionOverride"), "Noncentral dependency override.");
+                Require(element.Name.LocalName is not "RestoreSources" and not "RestoreAdditionalProjectSources", "Untrusted restore source override.");
+            }
+        var config = XDocument.Parse(Read("NuGet.Config"));
+        var sources = config.Descendants("packageSources").Elements("add").ToArray();
+        Require(sources.Length == 1 && (string?)sources[0].Attribute("key") == "nuget.org" && (string?)sources[0].Attribute("value") == Feed, "Wrong package publisher feed.");
+        Require(!files.Any(p => Path.GetFileName(p).Equals("nuget.config", StringComparison.OrdinalIgnoreCase) && p != "NuGet.Config"), "Unreviewed nested feed configuration.");
+        foreach (var path in files.Where(p => p.StartsWith(".github/workflows/", StringComparison.Ordinal) && Path.GetExtension(p) is ".yml" or ".yaml"))
+            foreach (Match action in ActionReference().Matches(Read(path)))
+                Require(action.Groups[1].Value.StartsWith("./", StringComparison.Ordinal) || ImmutableAction().IsMatch(action.Groups[1].Value), "Floating workflow action tag.");
+
+        using var reviewDocument = JsonDocument.Parse(Read(Text(policy, "reviewRecord")));
+        var review = reviewDocument.RootElement;
+        Require(Text(review, "owner") == "ArcNotes" && Text(review, "decision") == "approved" && Sha40().IsMatch(Text(review, "baselineCommit")), "Missing upgrade review.");
+        Require(DateOnly.TryParseExact(Text(review, "reviewedOn"), "yyyy-MM-dd", out _), "Invalid review date.");
+        var requiredInputs = files.Where(IsDependencyInput).Append("eng/policy/dependency-policy.json").Order(StringComparer.Ordinal).ToArray();
+        var reviewedInputs = review.GetProperty("inputs").EnumerateObject().Select(p => p.Name).Order(StringComparer.Ordinal).ToArray();
+        Require(requiredInputs.SequenceEqual(reviewedInputs), "Missing dependency input review.");
+        foreach (var path in requiredInputs)
+            Require(HashText(Read(path)) == Text(review.GetProperty("inputs"), path), "Dependency inputs changed without matching upgrade evidence: " + path);
+        foreach (var check in new[] { "compilation", "aot", "compatibility", "licence", "security", "sbom", "localRuntime", "performance", "migration" })
+            Require(Text(review.GetProperty("checks"), check).Length >= 20, "Missing upgrade evidence: " + check);
+        var frameworkVersions = new Dictionary<string, string>(StringComparer.Ordinal);
+        using var sdk = JsonDocument.Parse(Read("global.json"));
+        frameworkVersions.Add("dotnet", Text(sdk.RootElement.GetProperty("sdk"), "version"));
+        frameworkVersions.Add("avalonia", admitted.Values.First(p => Text(p, "id") == "Avalonia").GetProperty("version").GetString()!);
+        foreach (var framework in frameworkVersions)
+        {
+            var baseline = Text(review.GetProperty("baselineFrameworkVersions"), framework.Key);
+            Require(ExactVersion().IsMatch(baseline), "Missing framework baseline.");
+            if (baseline.Split('.')[0] != framework.Value.Split('.')[0])
+                Require(Text(review, "runtimePostureAssessment").Length >= 40 && review.GetProperty("frameworkMajorUpgrade").GetBoolean(), "Framework major upgrade requires runtime posture evidence.");
+        }
+    }
+
+    public static bool IsDependencyInput(string path) => Path.GetFileName(path) is "packages.lock.json" or "global.json" or "NuGet.Config" ||
+        Path.GetExtension(path) is ".csproj" or ".props" or ".targets" || path is "third-party/sources.json" or "eng/policy/reuse-policy.json" or "eng/policy/licence-boundary.json" ||
+        path.StartsWith(".github/workflows/", StringComparison.Ordinal) && Path.GetExtension(path) is ".yml" or ".yaml";
+
+    public static string HashText(string text) => Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(text.Replace("\r\n", "\n", StringComparison.Ordinal))));
+    private static string Text(JsonElement value, string property) => value.GetProperty(property).GetString() ?? "";
+    private static void Require(bool condition, string message)
+    {
+        if (!condition) throw new InvalidOperationException(message);
+    }
+
+    [GeneratedRegex(@"^\d+\.\d+\.\d+(?:\.\d+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?$")]
+    private static partial Regex ExactVersion();
+    [GeneratedRegex("^[a-f0-9]{40}$")]
+    private static partial Regex Sha40();
+    [GeneratedRegex("^[a-f0-9]{64}$")]
+    private static partial Regex Sha256();
+    [GeneratedRegex(@"(?m)^\s*(?:-\s*)?uses:\s*([^\s#]+)")]
+    private static partial Regex ActionReference();
+    [GeneratedRegex("^[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+@[a-f0-9]{40}$")]
+    private static partial Regex ImmutableAction();
+}
diff --git a/eng/ArcForges.Repository/Program.cs b/eng/ArcForges.Repository/Program.cs
index 1d775cb..13536db 100644
--- a/eng/ArcForges.Repository/Program.cs
+++ b/eng/ArcForges.Repository/Program.cs
@@ -313,6 +313,33 @@ private static async Task Check()
             }
         }
         Console.WriteLine("Repository text, structured inputs and whitespace checks passed.");
+        DependencyPolicy.Validate(Directory.GetCurrentDirectory(), files);
+        using var dependencyReview = JsonDocument.Parse(File.ReadAllText("eng/policy/dependency-review.json"));
+        var dependencyBaseline = dependencyReview.RootElement.GetProperty("baselineCommit").GetString()!;
+        await Run("git", ["merge-base", "--is-ancestor", dependencyBaseline, "origin/main"]);
+        DependencyPolicy.ValidateBaseline(File.ReadAllText("eng/policy/dependency-review.json"),
+            await Capture("git", ["show", dependencyBaseline + ":global.json"]),
+            await Capture("git", ["show", dependencyBaseline + ":Directory.Packages.props"]));
+        if ((await Capture("git", ["rev-parse", "--is-shallow-repository"])).Trim() != "false")
+            throw new InvalidOperationException("Full Git admission history is required.");
+        var dependencyHistory = new List<string>();
+        foreach (var revision in (await Capture("git", ["log", "--format=%H", "--", "eng/policy/dependency-policy.json"])).Split('\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            if ((await Capture("git", ["ls-tree", "--name-only", revision, "--", "eng/policy/dependency-policy.json"])).Length > 0)
+                dependencyHistory.Add(await Capture("git", ["show", revision + ":eng/policy/dependency-policy.json"]));
+        }
+        DependencyPolicy.ValidateHistory(File.ReadAllText("eng/policy/dependency-policy.json"), dependencyHistory);
+        Directory.CreateDirectory("artifacts/evidence");
+        await File.WriteAllTextAsync("artifacts/evidence/dependency-policy.json", JsonSerializer.Serialize(new
+        {
+            repository = "ArcNotes",
+            result = "passed",
+            sourceCommit = (await Capture("git", ["rev-parse", "HEAD"])).Trim(),
+            policySha256 = DependencyPolicy.HashText(File.ReadAllText("eng/policy/dependency-policy.json")),
+            reviewSha256 = DependencyPolicy.HashText(File.ReadAllText("eng/policy/dependency-review.json")),
+            scope = "offline dependency admission; no new runtime or public-artifact validation"
+        }, Json) + "\n");
+        Console.WriteLine("Dependency admission, immutable inputs and upgrade review passed.");
         var projects = LicencePolicy.Validate(Directory.GetCurrentDirectory(), files);
         var evaluated = new List<object>();
         foreach (var project in projects)
diff --git a/eng/policy/dependency-policy.json b/eng/policy/dependency-policy.json
new file mode 100644
index 0000000..82414bf
--- /dev/null
+++ b/eng/policy/dependency-policy.json
@@ -0,0 +1,1194 @@
+{
+  "schemaVersion": 1,
+  "repository": "ArcNotes",
+  "licenceBoundary": "AGPL",
+  "channel": "foundation-candidate",
+  "feed": "https://api.nuget.org/v3/index.json",
+  "reviewRecord": "eng/policy/dependency-review.json",
+  "nativeAdmission": "existing-framework-closure-only; new native slots require DesktopPlatform admission",
+  "packages": [
+    {
+      "id": "ArcForges.Build.Policy",
+      "version": "1.0.0-ci.20.1",
+      "contentHash": "rGn/WwyV9sq38y9rlQGX9gLBqy93XOgHmUSKJ2AupR6DDfVHTHgZVwnhfGL1K9XJkRKV972GV/dFcLersJ5iVw==",
+      "licence": "AGPL-3.0-only",
+      "licenceEvidence": "Published package nuspec declares SPDX expression AGPL-3.0-only; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/ArcForges/DesktopPlatform",
+      "sourceCommit": "96d1acebc74e7dcc7dbff7652763084b1cd95908",
+      "nuspecSha256": "a061627db9f0daaae551d5f56f0e1646b6b22dc4edd8edc1db14799b06cef160",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "exact-foundation-candidate"
+    },
+    {
+      "id": "ArcForges.Contracts.PublicApi",
+      "version": "1.0.0-ci.36.1",
+      "contentHash": "4+pUDeDcOScTV5rEei5yri8CLvVb9309Zdl5TBcVKXBvFrowcOoPx5pkZmpqzcLQZAZ2LH6LVv8JCGURpf42zQ==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/ArcForges/Contracts",
+      "sourceCommit": "d77aefabe0676dbe32845cbcf50aee361eb3fe7e",
+      "nuspecSha256": "4d66f799e42c0beee3a3fc28a54da20952b83afb178abdc916d714b3394b5a6f",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "exact-foundation-candidate"
+    },
+    {
+      "id": "Avalonia",
+      "version": "12.1.2",
+      "contentHash": "GHSe4qxjbqqxB570xuB4KtoD+Qhk3uKXJUXbelGYhGz/ti8xEoL7e5DGun8hcsXHondszPPBEdcC68szw7vUKg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "6812a63a8b193752c1338e300f7f258a96e2f981d4a56dc8d032b907cd3954d0",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Angle.Windows.Natives",
+      "version": "2.1.27548.20260419",
+      "contentHash": "l17nI3XVDN3oMnpjf2pnmJg0YTwK4m6NLsn/itAjDMdObTFxN77D5F1M9sRMSfViSY3KKcse1ROczwgoWLJsnA==",
+      "licence": "BSD-3-Clause",
+      "licenceEvidence": "Cached package LICENSE reviewed: redistribution/source/binary attribution, non-endorsement and disclaimer; SHA256 54aff7276217df9f6b5181613999d208c9e40d2b1d51bf55217837e6871a4a63.",
+      "sourceRepository": "https://github.com/AvaloniaUI/angle/",
+      "sourceCommit": "1c89805903c1482166356d3b950d474973180e61",
+      "nuspecSha256": "2dd03940159c3b637786264f5a5563ffd3e9aad3bdab4a4c75270e095a485a1f",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.BuildServices",
+      "version": "11.3.2",
+      "contentHash": "qHDToxto1e3hci5YqbG9n0Ty8mlp3zBUN5wT66wKqaDVzXyQ0do3EnRILd4Ke9jpvsktaPpgE0YjEk7hornryQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia.BuildServices",
+      "sourceCommit": "777f975b0a0cecf0311273711d56697212c558c0",
+      "nuspecSha256": "a8846537f7d074b8f9ed753c03678128c36bd046939ee245fad8c575a7cd3e9b",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Desktop",
+      "version": "12.1.2",
+      "contentHash": "ghG7UVnLVhCyWm/74xh24gAkXgEZ41oJTUr7c0VI9BiVSqhpukvU5vm8l8ZY35BZX8VPx1YtXUI1+VbhDTOLMw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "aaf4a3b219f24950eb844a6f1af8c6defd1d5359775eca4ae8071ddfc30917e9",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.FreeDesktop",
+      "version": "12.1.2",
+      "contentHash": "RJqKF7djK/lyDBdj24+HKELGe+7I/86NIA57aeiod5k340svbcb9hs1RYkIF8Nga4Xa2Jd/Pzxpkmvdjb1ASiw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "eb6b999f0aab66ce9420d1ac0a1bcfe254e74c7612563be34d2b1284e28923c3",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.FreeDesktop.AtSpi",
+      "version": "12.1.2",
+      "contentHash": "632PfHnqe7OkzStmDOW2ghXfCcTapGhT46HZGMMOIZFr+I0biyxUk7felBQwNzEk5LJ54y4VfIoiWKTgZK8FnA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "eb0db053476369b31bdd40d1af8c8ad5cffbd700ba7193a04221a1bab313b76e",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.HarfBuzz",
+      "version": "12.1.2",
+      "contentHash": "CqYTMnOLuAXjGldTEMdEf5/ozMY1z5ZshpE4YF0i2s2o4ycsYq855BD/eQS0iBt5PbjtlJgk8njILrBwW0HteQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "6c8ce1c41f280d4c6ce7c1c8b286c3c7b2f830015a46b67ece380b6d32d58745",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Native",
+      "version": "12.1.2",
+      "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "c737958465ffa29a92104ae13d883055a8c9924826b84a5afae30a39e3dfe062",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Remote.Protocol",
+      "version": "12.1.2",
+      "contentHash": "DdLTe9xKXxxfRcXmUw1trXZpBpz1YiZYWXx0DfMVPFAnkCszKsHLi67kaZfGJqtfQq2EySKd2qgRYX2QYkSxcg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "85c04ad13fb6d2993780af8df2b23ad4eb29fa628eaf05899d825f5c6f0a2ece",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Skia",
+      "version": "12.1.2",
+      "contentHash": "x0TDDdZgNepbxRd6gSQyv3A/hHoVJk3kYqjRa1baI43XPGPuO87lArf4DRKAERgWUxUp1ad28aTvVsE3x0JM0g==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "4bc8127688e28c01d82bca0edaa6fc9ecddbc92d7041548a11a375e3964821a7",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Themes.Fluent",
+      "version": "12.1.2",
+      "contentHash": "EKw1PzlIfqB8n0+yGuHThR9cUEiqZYj0EHYp89jrTwSuudu8pji6I4SGe1UmdwJWdgWf+kuss8T7KT+0wsUyow==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "190589f97e9cffb968fba3b78d1a81aae4911601c2da0034aacbc69073c5e79d",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.Win32",
+      "version": "12.1.2",
+      "contentHash": "MjHc5aKNs7Hp/fiX13wTQ3pg+kG9lh+NfqSQGx6/SkfvdO1Hbmribk7Bt0pwFTxcJ6HGlzwGKp1Ur3Ib/tv0ew==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "2b639f3aabe320e0c0de49fc274157910a670cf0a8eab5690099d91c360ce48b",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Avalonia.X11",
+      "version": "12.1.2",
+      "contentHash": "wtCAY9k90yrvhzKmesDGGFxYHsgejmLaR7HY36A4VYJ+E1R8AguNZc3hFaVKywnQLpf/eLhAwQWUxoNVFu9h/w==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/",
+      "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a",
+      "nuspecSha256": "94be6f461cde50fa16914d0eec02aa76e4ac405ad135bc72e778a513245d5166",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Google.Protobuf",
+      "version": "3.36.1",
+      "contentHash": "77AqPEoaY1ODE+syYBHti0jXiwQq0J/fUr/fRyYhNlc9oKtH5dZZEr/OLKtdKNVG83PRnCYB2r8B80ZrObzOGQ==",
+      "licence": "BSD-3-Clause",
+      "licenceEvidence": "Published package nuspec declares SPDX expression BSD-3-Clause; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/protocolbuffers/protobuf.git",
+      "sourceCommit": "f377bfefc5e2cfab68b816903c25b23e091c439d",
+      "nuspecSha256": "d6a4a567ce4889e25d098fd39d13a65ce05c847e8574818edc0d1eee6277eb40",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.AspNetCore",
+      "version": "2.83.0",
+      "contentHash": "PMoR+paO24EgBjBvfCqrmkurBH+RmfOIYThsUv6sGx6LUH0kxhzQkjtZ44mJxU0IwEw64dCzHhIjAM+CmORp3g==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "3852b062a3142127590a43bb41470c956570ca4dd5a65713c4da92a57de1714e",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.AspNetCore.Server",
+      "version": "2.83.0",
+      "contentHash": "rWeSaXaSPIIerc82lhHKqmzlp/sgLnG+Zw1c3YEEVp/un+hJKPxJOXWuGUOS2cs3EvcZBZ2tliXsnAg5Mdk2Ew==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "b9a51de789abe619de7ee4bb9ec9f30452c4bca13d514e53ac574a0bb96116e3",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.AspNetCore.Server.ClientFactory",
+      "version": "2.83.0",
+      "contentHash": "DrX1dE9WJNOsaKDQpD1gQaVE567jMNfhpBuG6P2NvGhirf2HZczfIJtd2d1L+steYh0YZ1q57Sa1ZHuufMPYBw==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "c136c73c16bb696799979b16ec3e8cedb71f9787134697f595c9329367b46006",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.AspNetCore.Web",
+      "version": "2.83.0",
+      "contentHash": "0fQlnmUorVo7SCghly5MQ5IhOn+w+Z9PYQOibdnYVUPJOhzW3iVwr5HYMVC5PnsTUfwpyZWIOfrAnwPa51k5Qw==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "8de00c84bf910a92356c9384c2fca141770828596771d38cfef8253a3923be33",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Core.Api",
+      "version": "2.83.0",
+      "contentHash": "xU8BT2bCw4Ct+/qIFJhhjkDEilKUbBOfp4US7l3Xa3hnlkN9l2LgISCbOw4PFYpW5jJFcK7FUAyWOFIQ94Hiqg==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "1276f66b4414aa409f4548480ef6eeb245449ed2f747541c64d526f7ba73d3e0",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Net.Client",
+      "version": "2.83.0",
+      "contentHash": "dHYtx7hW4muttsCrWNG4/Ysb1iAIhNPEq28eo7vF166CdXn/RXOr3SGvSreIGIjvmdrADrBNJ2cUeJBto/T0XA==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "bc4f11891023c0511a08b5fcc47497b14ad145f2e3bf19b329fedce20c003367",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Net.Client.Web",
+      "version": "2.83.0",
+      "contentHash": "+VsLfmWH7Lv/8sH5k9QjrccR+FQapMvFkBkoTHLdk6EFqBMmBFsddy6A9vvilHZf1AL1GVPaSMBJyGiPcxp7+w==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "42b9b89c4f0c690c802a0ef6f3b18c1d3f011c00894425350fdc31cf95ce41b2",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Net.ClientFactory",
+      "version": "2.83.0",
+      "contentHash": "j07orG5YnET3n5+TnczHCQsyWL3a4n/lJlIS88B3Zffylpp0RkcPzLv4ILAwKmOWOBvbBHiytPzAwJ8p7JomEQ==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "ba34068bb1e956e14021209f9576a3fd9c40340f444a7d0c62ddfdef2cf8788b",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Net.Common",
+      "version": "2.83.0",
+      "contentHash": "9w52xxORdIGu4Mm8lff3psMIlarenu+7TC4uIfiiW9AyaHZ6iPE/18gIkG1DD9byGDuhjuhnN9hiviBUAmCuZw==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc-dotnet.git",
+      "sourceCommit": "4301104498e53898a452e8fb2fea6c0b1492b755",
+      "nuspecSha256": "08d24d135348f484daad19ec1a456e387ce7d6fddf13615a6ced1c7bbaef7de6",
+      "dependencyClass": "transport",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Grpc.Tools",
+      "version": "2.83.0",
+      "contentHash": "vK2Go/83W0v2Nn7tTP9fGrX4IjmOa93s3M0SZeFimU1vIIr2wL9yNJlIyK21y85SGm3++JncB8IF751cjoLHuQ==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/grpc/grpc.git",
+      "sourceCommit": "c876f4da50f7da2f331888b88b2a7243514139fe",
+      "nuspecSha256": "902fe31dd38be7efeb5d1b4b13f65c652005459a78db3122a2f58c2648eefc3e",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "HarfBuzzSharp",
+      "version": "8.3.1.3",
+      "contentHash": "NGZ2+ZVNPM+NdHB/asW0/ykWngyHWwcqjrbN2nDeH1B/aptPGlCUl8wkQ2cSJxw5fdWgdmIPmNuTPWpLwNVXWg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "2888c737ad016d584c74525e2d35db5097ea8576",
+      "nuspecSha256": "dc37c8a3c466e1a2ab3a8f9bdecb78d619ac9ae9089b6ce05c291729f4ed7b4a",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "HarfBuzzSharp.NativeAssets.Linux",
+      "version": "8.3.1.3",
+      "contentHash": "RI6A1LgmooU30+4QIyFt5rmBCzP0VzTR+587IJSGvYIsHHWlahFufihYxtraLfsIhW7I8dn6+xX+DZGygOPKWQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "2888c737ad016d584c74525e2d35db5097ea8576",
+      "nuspecSha256": "0aa61be16ff5d9e7a8379e5b162cccbce0754a5c360b3f33ab463c25d4d7618e",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "HarfBuzzSharp.NativeAssets.WebAssembly",
+      "version": "8.3.1.3",
+      "contentHash": "w2QfdNm9Uz/sUa0B5D+OnVQhyq3G/fBq6ibQMdWBlQqqwh0g0/5j3RFvYqZAmRZ5+RzvjVe8o8SFFnWYUSkuxA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "2888c737ad016d584c74525e2d35db5097ea8576",
+      "nuspecSha256": "b02d7556366842cd8ad79e9b3b7c77c0e28955f4a8d9756dd6f09ddefbff04cb",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "HarfBuzzSharp.NativeAssets.Win32",
+      "version": "8.3.1.3",
+      "contentHash": "bx8CE8Js+XGX8PUxAHCBDEORt5aaBYtMN4Hr9QFs57Xithh6yjUyYqksizH6eRDhJkwsGI+SXWmPmMm8lZC9Pw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "2888c737ad016d584c74525e2d35db5097ea8576",
+      "nuspecSha256": "6443701ebc6778a1f5adc888cbe30fd12b96f7b211a67311416b80efb90888b6",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "HarfBuzzSharp.NativeAssets.macOS",
+      "version": "8.3.1.3",
+      "contentHash": "KPTq0xnslkI6nAo0jh3ptcQPJvZZr7MWYXa2jUe4SnHc9q+JlHElmNXp0sfFoiTgoCX7WOYpYsurypuH9Gehxw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "2888c737ad016d584c74525e2d35db5097ea8576",
+      "nuspecSha256": "f03fdc73cf4cb1c13598896d2d8118fa3374c35b673a2b57de8886d1de74eadc",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "MicroCom.Runtime",
+      "version": "0.11.6",
+      "contentHash": "NdNWGDiZ6eS/Mf/9+QHR91cj1K7Hy+PX9yrHI/zM7xFYuj9IWT2uxtB6sCHjrnxAeLV9fut1R6zHDUGKX6f9lQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/kekekeks/MicroCom",
+      "sourceCommit": "76785efcafd91b5902fd19dd11145f6dd655b7b4",
+      "nuspecSha256": "c7aeab4b73acdba3bb8e66865c2bbe67566b8593d972be2089181344adef345f",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.ApplicationInsights",
+      "version": "2.23.0",
+      "contentHash": "nWArUZTdU7iqZLycLKWe0TDms48KKGE6pONH2terYNa8REXiqixrMOkf1sk5DHGMaUTqONU2YkS4SAXBhLStgw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/Microsoft/ApplicationInsights-dotnet",
+      "sourceCommit": "2faa7e8b157a431daa2e71785d68abd5fa817b53",
+      "nuspecSha256": "184c649613d487d2b11466882ad83e375bf94f6aa228afae78dd4005bb0bb2a0",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Bcl.AsyncInterfaces",
+      "version": "6.0.0",
+      "contentHash": "UcSjPsst+DfAdJGVDsu346FX0ci0ah+lw3WRtn18NUwEqRt70HaOQ7lI72vy3+1LxtqI3T5GWwV39rQSrCzAeg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/runtime",
+      "sourceCommit": "4822e3c3aa77eb82b2fb33c9321f923cf11ddde6",
+      "nuspecSha256": "3a965c424d56f1cee169d88cc9c04f2c04f01bd65f20147b26ac093d761beec9",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "AawF393Q+VkdrnrnI1gu612zh5iqpa1AGSvnKCQ3IkMgSKJXIQbO1sXYRgEzOU4f0cPZ6MaCCF29xZSGWlmbuQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "11b09aa210c6c1df6e12e883ea696c5d34031918811e091b28f92274e35d0857",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration",
+      "version": "10.0.12",
+      "contentHash": "e3IPP32CRNL031VZJAUTlCTG0YN7WFh4mN3fsSHTDQCJB+3+f0jGycv4fXk3rrftaY3B85XrQaj7sRthrOsavg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "f9146575d56ac5698ed2fb7cc41d469daa95c582ecd93b4aef3109227529b95f",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "8xaGcvS/qZ1otoxPQCEJkNva389CVL/plNcvIETZhQTETYdRkYDPEYhUMoAGONo4FU45ufdfE0j29AfWVVj0wA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "a515475aa7839e7db035ba6032e61317de14db8a9273ffc2622b5223835307ec",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.Binder",
+      "version": "10.0.12",
+      "contentHash": "dAgIf1TOr8KLs+aBRIbXUZBjHoSH4rDG8+XkX/Q6AZwkQdMA0+yPDKTHsieeXdZDfpOpZVHzOnuAb5Z2nX3KsA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "466cea7baa185ef3b636fecd108495e0188e6e7b48434a554c7924c29a8e1846",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.CommandLine",
+      "version": "10.0.12",
+      "contentHash": "hWWJzJpmg161rYJ2H6vxqCuFfh6zL2Tp9emOrfu1M4gsmW5BOlW8GldthyFwm2L+beW+0axmkMKRw3HyO1qceQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "92156b002dd9f31e48eb6a07b0ee3b0f6eeea72b04a77c56fde6aa8dcbcdddce",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.EnvironmentVariables",
+      "version": "10.0.12",
+      "contentHash": "OIFhLxKAdvSrZuecX177ZkN4AcAB6OLlbS8y0MQYL68512aMOZI8cJLb8OeuYe2X+gu5uMqbbCxhzAmSp+Q2ow==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "34d420bc8cad0e36187ec36f8520896fe4077fe907abb177a97253312f83a191",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.FileExtensions",
+      "version": "10.0.12",
+      "contentHash": "PNPS7yYH9U2M0dExn0tMkQFVtE53xTlCs/dgTfsWTTFyCF6qwGT3VrTgm2nnnkSRlSmvM9/J+n9xCpyzd9xTpQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "2ec902723d802291c12cf4748a048acdb41323cf10923f66517dcfb13edeeac7",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.Json",
+      "version": "10.0.12",
+      "contentHash": "H4u2ZeIhjmRQvbHj7S7U4MK1kXb0khx3UtOWcir32VHczdFyIVF0lvHew/VVHmCF7Uk0QseAUaO7HyFKOCSiKA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "3a337038c9b0bf11052d8518d3ce81d5e7d0e3f9137ad1fb97e6d305512cec40",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Configuration.UserSecrets",
+      "version": "10.0.12",
+      "contentHash": "2OtyTIt0/tkChr3inq9Y0c34xogxXW//68gvPzIWgKwyVR4x82RSGVSZfV+ZgG13zrKBzqjaI23wpUCfKpY2yQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "df05dfc8f5d5c9c2de5ccbf72c42c178ffc79cc7be40ef8a8ecef830dea10184",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.DependencyInjection",
+      "version": "10.0.12",
+      "contentHash": "lXyK2O5GoYvfxW8eCFcD16JFbcoSTM1sJkAM0UHS1jZyl9NYMW64Tqm6OQFT0IDBjZi+xHt95/Zg+nxZhGFhZg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "672bbde8d6a1d90b3d603f49d80f18fd56c8be929b74d049457b87266e2869b1",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.DependencyInjection.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "9/qymSh7hVDMGTGwrLz8MRp5zRyXy9adGDOs4HwRdnLil3oZGYuWeZjbmHgCQ9BL1qBroVfgUK3U/nb61617Cw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "8766714f4945465f519ba4c6ebcdea8e6e3234871178f009779d7b1b5a54c59c",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.DependencyInjection.Abstractions",
+      "version": "8.0.0",
+      "contentHash": "cjWrLkJXK0rs4zofsK4bSdg+jhDLTaxrkXu4gS6Y7MAlCvRyNNgwY/lJi5RDlQOnSZweHqoyvgvbdvQsRIW+hg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/runtime",
+      "sourceCommit": "5535e31a712343a63f5d7d796cd874e563e5ac14",
+      "nuspecSha256": "5e666a909af764ae8ab3faeeccc2773187d4ca4155d5d756356cad6766443f51",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Diagnostics",
+      "version": "10.0.12",
+      "contentHash": "amx0O/R4dReqKlC3T740+CHpX8D8tAIV0f5kAPfFi4XK9jYo9BSepGt9/rWfvvCoSMaZ1+XvnqPp/Vv2fmTdAg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "e8db86adfd9d5b22a610bc8a4c31f88c8ee8f5c281d48b776f53a378260b3741",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Diagnostics.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "fMp91qlRlMOuHfMyp7LuAnOS+MOeWTF1obJmyFcs4nZCXu6pr+QB1AbFJcl2qpBltBrqF/Y7+Rn9IuNcSuctig==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "bdf3460c4e6e03ae7d5fb9b9f14e9bcd4488976d90cee08f38463afd9dafecae",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.FileProviders.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "iQseV6HixWzEYQH4i++84ToIroXnM5jC1TJF4EqBz3lWNG1HBTMYDLkRb6Wm3wk5V6WqSfl7NukO/LYsloGyfg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "9c8964ebc38bcce07c4f0a867f117f8ba25ccaa3c44229ab54d2ab2ef3a35ed8",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.FileProviders.Physical",
+      "version": "10.0.12",
+      "contentHash": "3cY+wo2+Qe65BVwShhr2fFqZv5Ns73h3kX4mpW3WvSgfT3AWCk0hKArKW4TF7Dg3mvbJdA6RhWPW7FR+PS5/1w==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "35fa54259267ab58db6154112253e14fc43157c7b2fbeeb0d7c92e3b5924c911",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.FileSystemGlobbing",
+      "version": "10.0.12",
+      "contentHash": "45cV+UeI0chPAIXrx9Wv7K4PJXuuIR2pnOur5MOAo6kOFclBHSLLDrvGAxMfWRMtUvpv/kQZkxlgaUN56jwzSQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "2d6d9a922db605154cb501a958fa286c950331d9f740bfe1c9618a352773ece1",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Hosting",
+      "version": "10.0.12",
+      "contentHash": "dzPj59oALFLu9TA4YUrfxqXEcbJVen/D2kOoitgM1lXBeSvPwPR8rOrrV0NKilCV3K0l4o+TLJJ3a1wmTu40Uw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "e224419a1cd6579a8088c3f44c88c7fca02f49e170c36595a67d91195c3eb304",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Hosting.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "ZlIxIJtWmrph0Ikj0svSaTkZ+d+ZYpTAhazpf1b3aoFRmlNnNWwkcvqnqT9yKHjKvfBRthvUrkq11OxfItOhpg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "1162269059b15874a8c88bee745ae68e5232fa0ed87ffe9a68b9fd4fbca93846",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging",
+      "version": "10.0.12",
+      "contentHash": "6I46fTPfgYkrjRYfRXbho9WOvOelTnNjWuZws/hzGHDASH1LEJeA4VKK9k3wJvido8o7jJSB5WkMTonX7HM1bA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "04e581792606a6cad28ace707a13faf7c7f9a6a88773534257bd4fb510efe31f",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.Abstractions",
+      "version": "10.0.12",
+      "contentHash": "+24lC4plfbEDNfLAdTV/SWKS7dW+16X4HdydO3R++134kSNTzcbYA4KpR1Hdh6uWisB8Za3AzwyOn+K+NxWIug==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "7f698a1b620cfa4b035eff9c2f863e3c304e9d0f879c676ab949282617af840a",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.Abstractions",
+      "version": "8.0.0",
+      "contentHash": "arDBqTgFCyS0EvRV7O3MZturChstm50OJ0y9bDJvAcmEPJm0FFpFyjU/JLYyStNGGey081DvnQYlncNX5SJJGA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/runtime",
+      "sourceCommit": "5535e31a712343a63f5d7d796cd874e563e5ac14",
+      "nuspecSha256": "e49e6e9827ea70fb0f7c8162aa4356a1d2d211157851ba3faeb2cbacbba913f5",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.Configuration",
+      "version": "10.0.12",
+      "contentHash": "CLHWfKQZWFE6fSzRXfjd4UlGveckkfPtwx/p5yF/o3hEkMSzGsl7MSxNAkI19hjw0rprBqrQC09Dwy6Lh6kweA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "055ccec2edcf66f9e5a7fd9cfe80388b0cee6658dda75bcb4eacbf568d2a8b6d",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.Console",
+      "version": "10.0.12",
+      "contentHash": "nHvaR8gO0CdEfG324KdUsP3Hqgdf1licZb+UlNh5pFYw7+o8QYTmiMgFmwayE/LPSpaqND/Qn3xHa1cI9b8x0w==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "14e1663033ec07278de52aea1eee89168902ff8fddc848f702533c4fd5d87d9e",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.Debug",
+      "version": "10.0.12",
+      "contentHash": "dEvvABq9Qgfu/SgTncXDjCshcJmgO97bLOnMAuqBDSonlk4+VXlKJMHPak+S78TlOxJ47+gY7vPgVukJsr69gg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "433e2a88d9e5252a0b181fd3bc90379fac33e665b8d731227da93e640d396c75",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.EventLog",
+      "version": "10.0.12",
+      "contentHash": "Qn0FWPMiQzM4GQEEXxrJbh3vp3I9wrAgpMcsVH36+6FTRGXaqtwHDgf/2030FUJ4OuNSpOeIRh+9kCZGDDsfGg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "08bbfb22c257d9cf826ced329d55e9d81165708314da581f388c6fe418b52205",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Logging.EventSource",
+      "version": "10.0.12",
+      "contentHash": "nKpYoiUdBu8fdLwDxj/fjjGn//7/VwRLzujtMq99/pExrswMXOz+80hbB98QxrD8qPt9oWlFpEVrN9OBKOP7RQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "2e48a72b9e373e8679241079d24b37efdcf67a5dce239355ecc041d77f94f27f",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Options",
+      "version": "10.0.12",
+      "contentHash": "TDYD33TSRpXKZWlmTXNlj5kCihxatmv2Ec1u6C+bMYLphCS7PoSLE9Pjd/nunDoE7yETk+LLKjVJX78HYtWjpA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "f0577cbeecfe4f5d45df9313727e94370257b72b9b6477492feb0f2a02b70a39",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Options.ConfigurationExtensions",
+      "version": "10.0.12",
+      "contentHash": "rqpu4qj5WE9x1IHGXSIgHBKi7IUlQaHyp4aXCYIanG2OghlUMFZpZTgExaXwcvmLAJHsxKQWMPpc7D2WIbCVtA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "4fb2dca6c9777c1bfe07590a11ebd7a0f4362001ff0648bc711fbe59bc16a5f6",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Extensions.Primitives",
+      "version": "10.0.12",
+      "contentHash": "dYfCLR52UA+3DL7C4I/pvSaRPkNqxrUAQmbFL2u0zvYKKzqgrFCJl08Df+F1aYc8leu9JvpC9bsURUdpExcBXQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "154b9a2c247fd24c663b15a305428e0bdec23de00b36a4066daa12e052b9bcfd",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.NET.ILLink.Tasks",
+      "version": "10.0.12",
+      "contentHash": "xi+BDjFpW+Sb+MHFHaH6Y/gV9I8BluFwRXc1QyCdoZbIK26eNiBeFuMTe/FMwc33G1wdHCyDg7CVTmb8OdQrMQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "bf5762457b552fed442157eb53c6c6693ded498ecfd5581a77cbdb3898bda628",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Testing.Extensions.Telemetry",
+      "version": "2.4.0",
+      "contentHash": "JeP1RFqBa11fWmBk8xEfZcMKr4rxWSyI6OZ+659V069CaMkTEOQBW2UdSSeNz3absOsygcn7JJkzerC4LGnZ9w==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/microsoft/testfx",
+      "sourceCommit": "a2a92fdb11ad38cd55b31223c4cfbb070fa01c05",
+      "nuspecSha256": "5a13a0f3b3da2e1ea48c7faac4f0d3a8ca570a562ec4928e8e59d8f10efa9738",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
+      "version": "2.4.0",
+      "contentHash": "uRb+4qM42dFDg4kWJZ2kFEcwESNVCRZJjItp5vETorN3rSJGysP617LqYirOcrCYmxg+obPreHMM5JcsNDKtBw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/microsoft/testfx",
+      "sourceCommit": "a2a92fdb11ad38cd55b31223c4cfbb070fa01c05",
+      "nuspecSha256": "f99165b201b607209e5f03db0b2be881d020d45da108028c011fa2b2f6b57b99",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Testing.Platform",
+      "version": "2.4.0",
+      "contentHash": "dp1N3P1ujb0ztwFgqz2o/ItEvq+pm19/AiA+Xq7Zpcy7oPMcxDBZLYGtf0LlU1MveEBJuKVjZhI+LnkfcH/0jQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/microsoft/testfx",
+      "sourceCommit": "a2a92fdb11ad38cd55b31223c4cfbb070fa01c05",
+      "nuspecSha256": "66933f17979c2b024e80d6c8b4144150ecc5773153ee6a485aa430645da96b5d",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Testing.Platform.MSBuild",
+      "version": "2.4.0",
+      "contentHash": "qr5M6h16YHMJLFDcWELFVMMpGte2BUmveBZKT5YoBV+bmuJRPu9bv/Zqke4yQuOEKRNxoAETrG5jr+/6Rnr3Hg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/microsoft/testfx",
+      "sourceCommit": "a2a92fdb11ad38cd55b31223c4cfbb070fa01c05",
+      "nuspecSha256": "1fe1b7f9981ae944b65a9cf851ca791bd5e0dd66dedd5d114f838aeecf5bea4c",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Microsoft.Win32.Registry",
+      "version": "5.0.0",
+      "contentHash": "dDoKi0PnDz31yAyETfRntsLArTlVAVzUzCIvvEDsDsucrl33Dl8pIJG06ePTJTI3tGpeyHS9Cq7Foc/s4EeKcg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/runtime",
+      "sourceCommit": "cf258a14b70ad9069470a108f13765e0e5988f51",
+      "nuspecSha256": "eb8c4b9d4ebe62d8528dec6ab2a752c2e3488f28f882a6c45a33dcc21eacc58e",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "SkiaSharp",
+      "version": "3.119.4",
+      "contentHash": "53NOSUZ1Us+91Sm0uCkIivh/k7jOowRErZT2sIWwPFN9mLUvdxnE6rS4sWo4255+Rd2MWUSF+j0NMZHD6Cke+Q==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+      "nuspecSha256": "64f0b2f1511042f5a6ba63a9b9508aa5d34118e7e388d828121faa0e124e3597",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "SkiaSharp.NativeAssets.Linux",
+      "version": "3.119.4",
+      "contentHash": "UAyVzbqNfZsZbKbzj68zXLyUyF/SbTKmzTfOO6qDu++dtIUMMTzPBe8oOuzU/DiewpfKoUUlOSsJmqWc6blxBw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+      "nuspecSha256": "b95f79928a4833943ec3930ff1a9329c8ec004875bd922611743b2d4289bb2b5",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "SkiaSharp.NativeAssets.WebAssembly",
+      "version": "3.119.4",
+      "contentHash": "S1HOxtBbD4bYDtA2e9WH5TX+lxqRrTPvKjrjttRhxnHNNu7YY8VFo/LeCP7tNqoTA6PV+8vsvNbmRUEC2ip8RQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+      "nuspecSha256": "6c1275cb2d1b18b3126f1dc7fbd371c31e361d5ff18919f899ceea7f30462b38",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "SkiaSharp.NativeAssets.Win32",
+      "version": "3.119.4",
+      "contentHash": "XOpbx/4CReO2wYsq2s6rbvdauc6dntG4Zv499sHGTJ87bwZaFXszFkwql3+FIZMc8kUPeaj3Mx2ezIJmo8a1Kg==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+      "nuspecSha256": "3e0c3eafd204f390ab4e63f15bfaa34e5f128f576a2d97b9c25d1afb848a5c16",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "SkiaSharp.NativeAssets.macOS",
+      "version": "3.119.4",
+      "contentHash": "fgBOWEqbY012x7gMfJU4ezgz6dfhJb30Z6YdW35h85Zoe39+a8YNbAAwL29ihPfWoppg5AjvyKNzD1oCvlqWwA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://go.microsoft.com/fwlink/?linkid=868515",
+      "sourceCommit": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+      "nuspecSha256": "6aa19803f329aaa479b30ff851bd1830a1cd754e28bc5f7b21935caf83171896",
+      "dependencyClass": "framework",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "System.Diagnostics.EventLog",
+      "version": "10.0.12",
+      "contentHash": "sOZM+VyRj1pg/ItlHsvrSbjws6oGqZveTzTNBGZ9ziwRDyKsOF3ub6vhvOdxotCIqtlnyHAIwP5sLNvgiZC+pQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "b420e959398cd759ed7d74fe4656b4e8f842a2b78d86782f7884418a5e4c2791",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "System.Security.AccessControl",
+      "version": "6.0.1",
+      "contentHash": "IQ4NXP/B3Ayzvw0rDQzVTYsCKyy0Jp9KI6aYcK7UnGVlR9+Awz++TIPCQtPYfLJfOpm8ajowMR09V7quD3sEHw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/runtime",
+      "sourceCommit": "189fbbd88d97dd6d65515ba2da05b62eab4e5039",
+      "nuspecSha256": "2fb3325fbcea2d5eee1eb5666fd391fac8498f7acefe34f922aaceafea5e9df3",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "Tmds.DBus.Protocol",
+      "version": "0.94.1",
+      "contentHash": "11YMr7FnAbL83bQmVxlhbIKHvSLxjO81D12Ej0QMSGXMDTxNA9MTOa4MQxx43nv5el/efuPHwzyrj6a5ha2gug==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/tmds/Tmds.DBus.git",
+      "sourceCommit": "b4a7fed0b878f74cb54f7cca84d2889af4e596ba",
+      "nuspecSha256": "72830040b14d42de24d85be271fce22d608614360bc6bbc46762fd4a5039651a",
+      "dependencyClass": "library",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "runtime.linux-x64.Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "wAa+LAE6+Bkd+pEJvGdnQU8PZQRzvhurpQ4hzsOTpRuedIq1kunJcz86xBCBlzsc+QlVdCKVUPzEfB3uYVB7Gw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "b8255d65ca2676b02598a74307b5b1afc6109b7e4e812ec79bb4c67819279a10",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "runtime.osx-arm64.Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "WwM79vRmPYfsV7wVjFVYaZWc853weM+HpY917SbWI52go/PU+A2L24fMaGkYB3bunhjiLb/SMNlNT0fuyjbQqA==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "82760f9a2dfaae18bde29532b14c2b2a010dde46107e5798e9c126e791ed7e75",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "runtime.osx-x64.Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "vgcBY1cy8s45JTHH0oakn9R/wTUpJEhc6mbnwfkL4HhySqUcsmTPZq43zgC2/RoL8DWcFiWBHMgHgKGGHnRaxQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "c6c7361d89856c5839bd2e3d8faee98a509845085980873ca4083bcaad3128e3",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "runtime.win-arm64.Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "2qwg37KiPUnsvPjdLhAMjcRTxLFAC5BhIBkJd1HEBGzgSK4WT+gg/C+kh5Gwg53EQv6xTqF2oGks+c49JLa8jw==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "7801f64d974be01636ceece156533671686ff8353e40399b1b4386f3469eef91",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "runtime.win-x64.Microsoft.DotNet.ILCompiler",
+      "version": "10.0.12",
+      "contentHash": "clsgU9GnioCJ+PBzQTCoJHxLXRU+7O/BzYrwRT8CUP7jgyYjNgJmNsQ/kbzAA7MG5kDvFoFvIBGHGzYdINh/EQ==",
+      "licence": "MIT",
+      "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/dotnet/dotnet",
+      "sourceCommit": "95017c711e6afc1085133d440e42b4bd78155701",
+      "nuspecSha256": "19d813c7c0622f5079f52ac71a4bea79cb9e3a87a397921f7112957916ac223e",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.analyzers",
+      "version": "2.1.0",
+      "contentHash": "X7QXEcZQGz0G/HL4HUyK+aAvNa/IMGbOCnFIq4jD/Evktq12xANKwzOUr7b08vCmC1LXu/47qHWOdjm3KfaJ0A==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit.analyzers",
+      "sourceCommit": "cf90c99d73c3df1c53d54b60cd19130a06287382",
+      "nuspecSha256": "8d8fb2ff8c8a1505020e13d190a093af179b994eebce42ce03457ed9497e7b68",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.assert",
+      "version": "4.0.1",
+      "contentHash": "nC7d3cY06Oo7hkdwWPZkBR0Ud75xNhgx0P7i0GmMMZC3puCGlc4szFiT30biH03IN/eDnr8h+nv3A1UD17bk/A==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "3f2aef448f6c8e12cb7fa5d6ba111ea5311f530862a3e5fd9a63f153bec1f3af",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.common",
+      "version": "4.0.1",
+      "contentHash": "Qf25TVdadDQYf9zVxSd7L9RNQhuP0jCUHmo96XTmIKLxGefylIEV63jRbXBPFzdXmV09TCdcurk+AQ9LiWS2Hg==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "bdf4e653bae8f75b5392928a37bf108fcad4d2a5308524420828e82f3e79ded5",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.core.mtp-v2",
+      "version": "4.0.1",
+      "contentHash": "7qfTfrIfS2wybpSVyRLmhXHbSudD2eNw66LfukixmKsRCTcfvOrLsx0qGL/lObcEh3Z2F4SIXgoFnLIiB8yfjQ==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "51c8cc20af9bb6071e1df8454579c9048597f5c169db3470dc5057be9844f1da",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.extensibility.core",
+      "version": "4.0.1",
+      "contentHash": "J0d5OfFcp920nZxCRIvU14+TZhiSPQR0wvqEMZ3MRiJLPu1VmYlcRNkmcSW0i1DwkB81gAHc+fHUQf/cU64MYg==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "0def7df8a35e99e328a1b8799e169592b961ee06a3f7aac556a42ee8464cecf8",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.mtp-v2",
+      "version": "4.0.1",
+      "contentHash": "s88KiWwDDYgOWV3A+ViJiqCe9cLU/Rt6Gb5TfOC7Abv/HKSoj4IHVPcOQk7jPt7HhZHHEts5IuaVpB30eO5B1w==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "9134992ab09b0b8545f7fa31f6ab3c84a659b58493c7afca586a4977ee8998e2",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.runner.common",
+      "version": "4.0.1",
+      "contentHash": "p9AyfBpj2e5Iws8B57SbLiSngg7mEdvegHInKR4T2cjt2mis9h8htVgCnmu//agZO4zri6p6VQOj5EkHHTy3gA==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "2c80dbdeee78193f042e5b5e32c06d3b1d828659fb156c132f82574a5330799f",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    },
+    {
+      "id": "xunit.v3.runner.inproc.console",
+      "version": "4.0.1",
+      "contentHash": "Hqwfd6ehMIhPmVWUQ2dgmknzuLFTWeyp8ES1q3D4YR5bQVyiXDcaIoaFwqAz2zgLr49WaW4Mz7VVncP7u/Q8/Q==",
+      "licence": "Apache-2.0",
+      "licenceEvidence": "Published package nuspec declares SPDX expression Apache-2.0; existing packaged upstream notices remain authoritative for bundled material.",
+      "sourceRepository": "https://github.com/xunit/xunit",
+      "sourceCommit": "8ed8aa354c7298e157a0fc2dcd61b95df345256a",
+      "nuspecSha256": "621fc57c6e5ab43360c5933415c98727f36abf658d1a7d9793159a2b827d4a5f",
+      "dependencyClass": "tooling",
+      "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.",
+      "previewAdmission": "none"
+    }
+  ]
+}
diff --git a/eng/policy/dependency-review.json b/eng/policy/dependency-review.json
new file mode 100644
index 0000000..3bb23cf
--- /dev/null
+++ b/eng/policy/dependency-review.json
@@ -0,0 +1,44 @@
+{
+  "schemaVersion": 1,
+  "owner": "ArcNotes",
+  "decision": "approved",
+  "reviewedOn": "2026-09-21",
+  "baselineCommit": "2dee20b0c1d9acaf3d83b20dfd045e1e070e082c",
+  "baselineFrameworkVersions": {
+    "dotnet": "10.0.401",
+    "avalonia": "12.1.2"
+  },
+  "frameworkMajorUpgrade": false,
+  "runtimePostureAssessment": "No framework version changes: existing desktop Native AOT and trim posture retained.",
+  "checks": {
+    "compilation": "Retain required Windows/Linux compilation in the existing CI graph.",
+    "aot": "Retain Windows x64/ARM64 and Linux x64 AOT publication; no runtime graph changed.",
+    "compatibility": "No package versions, APIs or generated public contracts changed; prior WP02 stage evidence retained.",
+    "licence": "Complete locked closure and published cached metadata reviewed; existing source/native notices and provenance gates retained.",
+    "security": "Existing dependency-review and CodeQL gates remain required; no duplicated scanner or vulnerability-free assertion.",
+    "sbom": "Existing portable dependencies.json is generated from actual restore assets; no distributed closure changed.",
+    "localRuntime": "Not run: dependency policy tooling changes do not affect application runtime behavior.",
+    "performance": "Not applicable: no runtime dependency, executable behavior or performance-sensitive algorithm changed.",
+    "migration": "Not applicable: no persistence format or storage dependency changed."
+  },
+  "inputs": {
+    ".github/workflows/ci.yml": "ec5963a454ab794847a07fd4360fd1708b3aef44385b4eeafd3d0137366ec1ab",
+    "Directory.Build.props": "90a5954ec7685904894ef8d19fea650f9bcebabbde98b0b94058f8b7c68fb5a4",
+    "Directory.Build.targets": "21da49619dc407ca9de526c9aa75cb9a0e67ca6314bddd4770dd165975405bd4",
+    "Directory.Packages.props": "ef826d5a6865882ae44e02c03a21e2d94e3146a2027a22bdbc6a558aac260321",
+    "NuGet.Config": "4b8c02e4d50d3cc41197afc609f592e5a1889c049fe39147564e2811c5d8e261",
+    "eng/ArcForges.Repository/ArcForges.Repository.csproj": "b80fff54a4c877998e66b035a159e790bce4c771244d1d239fa8d58c8dd589a6",
+    "eng/ArcForges.Repository/packages.lock.json": "c89665a55992ffd3e4e1c3ba0ae067c104a48ac9b4d40561147e3208d7acc931",
+    "eng/policy/dependency-policy.json": "ebde30ed1fd96baa1aaa2063ac03dad3336504e64508381008f191f79a380c55",
+    "eng/policy/licence-boundary.json": "b47394287794368d8b997161afe66ecdb03b632ce56d72f26df59e686200b478",
+    "eng/policy/reuse-policy.json": "07ce0656c89f0d7173f0e81fc94ab88eb5deed45ad30e1aff987f1e3c373e015",
+    "global.json": "d533441ee720f55065ffdda4273cd815f53f534612cd5899bd4b9b41d0e3a630",
+    "src/ArcForges.ArcNotes.Core/ArcForges.ArcNotes.Core.csproj": "2338d20f00790d79a717e3ed74cfd79de26204d428eda618247558d84f776f3d",
+    "src/ArcForges.ArcNotes.Core/packages.lock.json": "2d4085d38648181c42333b905a7d57bff5b5faee5a35e777c05f16cf2b3c6142",
+    "src/ArcForges.ArcNotes/ArcForges.ArcNotes.csproj": "4a4bb4fb53401da31b2f2aafd96f5c733a78f08c60632f717eeb8b8e1eaabdba",
+    "src/ArcForges.ArcNotes/packages.lock.json": "2db0cecbda58e2a4bae5b55ddcea422a74b359f65643f46a74c10718281feec7",
+    "tests/ArcForges.ArcNotes.Tests/ArcForges.ArcNotes.Tests.csproj": "850e1ce3bbc3cbe8e4d96d4ed2db6522ea32c80c4cb724ee2ee4716b74950897",
+    "tests/ArcForges.ArcNotes.Tests/packages.lock.json": "432eab7f4ebd9e2ba494394ac92b702908afafdbbcfdf745eb3655cad86d65c0",
+    "third-party/sources.json": "106696f712f9574d0e5521337c954bdb936ee3e30901a7aab1f2d569bed548f6"
+  }
+}
diff --git a/eng/provenance/files.json b/eng/provenance/files.json
index 651aad3..a33767d 100644
--- a/eng/provenance/files.json
+++ b/eng/provenance/files.json
@@ -27,16 +27,20 @@
     "THIRD_PARTY_NOTICES.md",
     "docs/bootstrap-plan.md",
     "docs/build-identity.md",
+    "docs/dependency-policy.md",
     "docs/development.md",
     "docs/licence-boundary.md",
     "docs/provenance.md",
     "docs/release-notes.md",
     "docs/releasing.md",
     "eng/ArcForges.Repository/ArcForges.Repository.csproj",
+    "eng/ArcForges.Repository/DependencyPolicy.cs",
     "eng/ArcForges.Repository/IdentityEvidence.cs",
     "eng/ArcForges.Repository/LicencePolicy.cs",
     "eng/ArcForges.Repository/Program.cs",
     "eng/ArcForges.Repository/packages.lock.json",
+    "eng/policy/dependency-policy.json",
+    "eng/policy/dependency-review.json",
     "eng/policy/licence-boundary.json",
     "eng/policy/reuse-policy.json",
     "eng/provenance/NOTICE.txt",
@@ -69,6 +73,7 @@
     "tests/ArcForges.ArcNotes.Tests/ArcForges.ArcNotes.Tests.csproj",
     "tests/ArcForges.ArcNotes.Tests/BuildIdentityTests.cs",
     "tests/ArcForges.ArcNotes.Tests/CandidateTests.cs",
+    "tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs",
     "tests/ArcForges.ArcNotes.Tests/HelloStateTests.cs",
     "tests/ArcForges.ArcNotes.Tests/LicencePolicyTests.cs",
     "tests/ArcForges.ArcNotes.Tests/ProvenancePolicyTests.cs",
diff --git a/tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs b/tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs
new file mode 100644
index 0000000..d6d5a85
--- /dev/null
+++ b/tests/ArcForges.ArcNotes.Tests/DependencyPolicyTests.cs
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+using System.Diagnostics;
+using System.Text.Json.Nodes;
+using ArcForges.Repository;
+using Xunit;
+
+namespace ArcForges.ArcNotes.Tests;
+
+public sealed class DependencyPolicyTests
+{
+    [Fact]
+    public void ActualReviewedClosurePasses()
+    {
+        using var fixture = new Fixture();
+        fixture.Check();
+    }
+
+    [Theory]
+    [InlineData("licence", "GPL-3.0-only", "Forbidden dependency licence")]
+    [InlineData("version", "1.*", "Floating dependency version")]
+    [InlineData("sourceCommit", "main", "Floating source tag")]
+    [InlineData("sourceRepository", "https://github.com/untrusted/publisher", "Wrong publisher")]
+    [InlineData("id", "ArcForges.Contracts.Internal", "Wrong publisher")]
+    public void RejectsUnreviewedAdmission(string field, string value, string expected)
+    {
+        using var fixture = new Fixture();
+        fixture.Edit("eng/policy/dependency-policy.json", data => data["packages"]![field == "id" ? 1 : 0]![field] = value);
+        Assert.Contains(expected, Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RejectsSameVersionWithChangedBytes()
+    {
+        using var fixture = new Fixture();
+        fixture.Edit("eng/policy/dependency-policy.json", data => data["packages"]![0]!["contentHash"] = Convert.ToBase64String(new byte[64]));
+        Assert.Contains("Mutable version", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void NewReviewCannotRewritePreviouslyAdmittedCoordinate()
+    {
+        const string prior = """{"packages":[{"id":"example","version":"1.0.0","contentHash":"original"}]}""";
+        const string updated = """{"packages":[{"id":"example","version":"1.0.0","contentHash":"replacement"}]}""";
+        const string removed = """{"packages":[]}""";
+        DependencyPolicy.ValidateHistory(prior, [prior]);
+        Assert.Contains("Immutable historical coordinate", Assert.Throws<InvalidOperationException>(() => DependencyPolicy.ValidateHistory(updated, [removed, prior])).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void SuccessorReviewCannotResetFrameworkBaseline()
+    {
+        const string sdk = """{"sdk":{"version":"10.0.401"}}""";
+        const string packages = """<Project><ItemGroup><PackageVersion Include="Avalonia.Desktop" Version="12.1.2" /></ItemGroup></Project>""";
+        const string review = """{"baselineFrameworkVersions":{"dotnet":"11.0.100","avalonia":"13.0.0"}}""";
+        Assert.Contains("Framework baseline reset", Assert.Throws<InvalidOperationException>(() => DependencyPolicy.ValidateBaseline(review, sdk, packages)).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void StableCoreCannotConsumeCandidatePackages()
+    {
+        using var fixture = new Fixture();
+        fixture.Edit("eng/policy/dependency-policy.json", data => data["channel"] = "stable");
+        Assert.Contains("Preview dependency", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void RejectsChangedFeedAndFloatingAction()
+    {
+        using var fixture = new Fixture();
+        var config = Path.Combine(fixture.Root, "NuGet.Config");
+        var original = File.ReadAllText(config);
+        File.WriteAllText(config, original.Replace("api.nuget.org", "untrusted.example", StringComparison.Ordinal));
+        Assert.Contains("Wrong package publisher feed", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+        File.WriteAllText(config, original);
+        File.AppendAllText(Path.Combine(fixture.Root, ".github/workflows/ci.yml"), "\n      - uses: actions/checkout@main\n");
+        Assert.Contains("Floating workflow action", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ChangedInputsRequireReviewAndFrameworkMajorNeedsPosture()
+    {
+        using var fixture = new Fixture();
+        fixture.Edit("global.json", data => data["sdk"]!["version"] = "11.0.100");
+        Assert.Contains("changed without matching upgrade evidence", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+        fixture.Edit("eng/policy/dependency-review.json", data => data["inputs"]!["global.json"] = DependencyPolicy.HashText(File.ReadAllText(Path.Combine(fixture.Root, "global.json"))));
+        Assert.Contains("Framework major upgrade", Assert.Throws<InvalidOperationException>(fixture.Check).Message, StringComparison.Ordinal);
+    }
+
+    private sealed class Fixture : IDisposable
+    {
+        public string Root { get; } = Path.Combine(Path.GetTempPath(), "dependency-policy-" + Guid.NewGuid());
+        private readonly string[] _files;
+
+        public Fixture()
+        {
+            var source = AppContext.BaseDirectory;
+            while (!File.Exists(Path.Combine(source, "eng/policy/dependency-policy.json")))
+                source = Path.GetDirectoryName(source.TrimEnd(Path.DirectorySeparatorChar)) ?? throw new InvalidOperationException("Owner source not found.");
+            var start = new ProcessStartInfo("git") { WorkingDirectory = source, RedirectStandardOutput = true };
+            start.ArgumentList.Add("ls-files");
+            using var process = Process.Start(start)!;
+            _files = process.StandardOutput.ReadToEnd().Split('\n', StringSplitOptions.RemoveEmptyEntries).Select(p => p.TrimEnd('\r'))
+                .Where(DependencyPolicy.IsDependencyInput).Append("eng/policy/dependency-policy.json").ToArray();
+            process.WaitForExit();
+            Assert.Equal(0, process.ExitCode);
+            foreach (var path in _files.Append("eng/policy/dependency-review.json"))
+            {
+                Directory.CreateDirectory(Path.GetDirectoryName(Path.Combine(Root, path))!);
+                File.Copy(Path.Combine(source, path), Path.Combine(Root, path));
+            }
+        }
+
+        public void Check() => DependencyPolicy.Validate(Root, _files);
+        public void Edit(string path, Action<JsonNode> change)
+        {
+            var data = JsonNode.Parse(File.ReadAllText(Path.Combine(Root, path)))!;
+            change(data);
+            File.WriteAllText(Path.Combine(Root, path), data.ToJsonString());
+        }
+
+        public void Dispose() => Directory.Delete(Root, true);
+    }
+}