Skip to content

Example: dependencies

dependencies.md records what a library depends on and how each dependency is used. Reviewers cross-check it against the project file, because a wrong Reference Type value changes how the portal links libraries together.

What reviewers should check

  • Reference Type is exactly one of Project Reference, NuGet Package, or NuGet Package (same-repo). Values like "Internal library" or "Shared" are wrong even when the description around them is accurate.
  • Internal dependencies link to the referenced library's overview.md; a library with no documentation set appears as plain text instead of a broken link.
  • Sections appear in template order — Internal, External, Transitive, Build-time, API, External web application navigations, Dependency risks and notes — and conditional sections are omitted entirely rather than left empty or filled with "None".
  • Every dependency table ends with a Usage column that says how the dependency is actually used, not what the package is.
  • Transitive rows exclude BCL and Microsoft.Extensions.* packages, name the framework library they arrive through, and carry †.
  • The External dependencies table lists concrete versions matching the project or packages file, and ## Sources closes the page.

Example

The document below is a complete, correct dependencies.md for a fictional library.

View rendered example — the same document as a real page, so you can compare rendering as well as source.

---
title: SAIF.Framework.Validation dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: Policy Systems Team
last_reviewed: 2026-02-18
library: SAIF.Framework.Validation
reference_type: package
---

# SAIF.Framework.Validation dependencies

SAIF.Framework.Validation keeps a deliberately small dependency surface so it
can be referenced by both a web front end and an overnight batch process
without pulling in hosting concerns. It takes one internal framework
dependency for tracing and environment access, one internal package for shared
policy value types, and two external packages for XML rule set handling and
logging. It references no data access assembly, which is why rule evaluation
behaves identically in interactive and batch callers.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| [SAIF.Framework.Core](../saif-framework-core/overview.md) | NuGet Package | Supplies `ValidationComponentBase`, framework tracing, and the initialization guard that `ValidationEngine` inherits. |
| [SAIF.Framework.Policy.Types](../saif-framework-policy-types/overview.md) | NuGet Package | Provides the `PolicyPeriod` and `JurisdictionCode` value types used by date-range and state-scoped rules. |
| [SAIF.Framework.Validation.Rules.Tests](../saif-framework-validation-rules-tests/overview.md) | Project Reference | Test-only project reference used to exercise rule types against sample claim records during the build. |

## External dependencies
| Dependency | Version | Usage |
| --- | --- | --- |
| System.Xml.Linq | 4.0.0.0 | Parses rule set XML in `RuleSetLoader` and materializes `ValidationRule` instances. |
| log4net | 2.0.15 | Writes rule set load failures and evaluation timing to the shared application log. |
| Newtonsoft.Json | 13.0.3 | Serializes `ValidationResult` for the batch error log written by `SAIF.PremiumAudit.Batch`. |

## Transitive dependencies

Dependencies in this section are inherited from dependency framework libraries.
They are not directly referenced by this library but are required at runtime
through framework packages.

| Dependency | Source framework | Type | Usage |
| --- | --- | --- | --- |
| SAIF.Framework.Environment | `SAIF.Framework.Core` | Transitive | Resolves environment configuration values that `ValidationComponentBase` reads during initialization.† |
| SAIF.Framework.Diagnostics | `SAIF.Framework.Core` | Transitive | Provides the trace listener that `WriteTrace` routes component trace entries to.† |

## Dependency risks and notes
- `log4net` 2.0.15 is the version pinned across the SAIF .NET Framework 4.8
  estate. Upgrading this library alone would produce assembly binding redirect
  conflicts in `SAIF.Claims.Intake`.
- `SAIF.Framework.Core` is consumed as a NuGet package rather than a project
  reference, so a base class change ships only when the package version is
  bumped in this library's project file.
- The library has no data access dependency by design. Adding one would let
  rules issue queries and break the guarantee that batch and web evaluation
  produce the same result for the same record.
- `Newtonsoft.Json` is used only for batch error output. If the batch logger
  moves to structured logging, this dependency can be removed.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)

## Sources
- src/SAIF.Framework.Validation/SAIF.Framework.Validation.vbproj
- src/SAIF.Framework.Validation/packages.config
- src/SAIF.Framework.Validation/SAIF.Framework.Validation.nuspec
- src/SAIF.Framework.Validation/RuleSetLoader.vb