Skip to content

DEPENDENCY_POLICY.md

Latest commit

 

History

History
47 lines (36 loc) · 1.95 KB

DEPENDENCY_POLICY.md

File metadata and controls

47 lines (36 loc) · 1.95 KB
Raw

Dependency Policy

cxxmcp keeps the public SDK dependency surface intentionally small and separates SDK package dependencies from examples, tests, documentation, and external gateway tooling.

Supported Modes

  • Source/archive builds use bundled header-only SDK dependencies so direct CMake, FetchContent, CPM.cmake, and source installs work without a package manager. The install tree includes tl/expected.hpp and nlohmann/json.hpp.
  • Registry builds should use CXXMCP_USE_SYSTEM_DEPS=ON and package-manager dependencies for tl-expected, nlohmann-json, and cpp-httplib. In this mode the install tree must not vendor tl or nlohmann headers.

cpp-httplib is used by the HTTP and WebSocket transport implementations. Downstream code should include the cxxmcp transport headers, not httplib.h directly.

OpenSSL is optional. Package recipes should expose it as one cross-cutting feature for HTTPS, WSS, and auth crypto instead of separate transport-specific OpenSSL feature names.

Update Cadence

  • GitHub Actions are monitored by Dependabot.
  • Bundled header-only dependencies, including the vendored cpp-httplib fallback, are updated deliberately through normal pull requests with package-smoke and release-gate evidence.
  • Security updates that affect public SDK builds are treated as priority fixes under the project security and release policies.

Package Registry Guidance

Package recipes should keep the default SDK package narrow:

  • build SDK libraries and public headers only;
  • disable examples, tests, and docs by default;
  • avoid pulling OpenSSL or other optional auth dependencies into default installs;
  • keep gateway/runtime tooling outside the SDK package contract.

The detailed package-consumption policy is maintained in docs/package_consumption.md. Release-time dependency and reference review rules are maintained in docs/dependency_policy.md.