Which projects do you pay?

You only pay Maintenance Fees for the projects that are direct dependencies. So the first step is to catalog your direct dependencies. To be clear, you do NOT include transitive dependencies, which are brought in by your direct dependencies.

Fortunately, most programming ecosystems provide package managers that can map declared dependencies to the Open Source Project that produced them. However, do not forget to include any tools from Open Source Projects used by your developers or in your build and continuous integration processes which may not be referenced by a package manager.

Once you have the list of direct dependencies, you can check each project’s README file for instructions on how to pay the Maintenance Fee.

The following are examples of how to find your direct dependencies in popular programming ecosystems using their package managers.

.NET Example

1. Open each .csproj and collect the unique PackageReference identifiers. For example:

   <ItemGroup>
     <PackageReference Include="WixToolset.Dtf" Version="6.0.0" />
   </ItemGroup>

   Check imported project files too

   You may also find PackageReference elements imported into your .csproj via Directory.Build.props, Directory.Build.targets or explicit Import elements. If you find a PackageReference it is likely a direct dependency.

2. Search for that identifier on NuGet.org

3. Click the “Project website” link on the right to be taken to the project.

4. Follow the instructions in the project’s README file how to pay the Fee for a project

using != direct dependency

It can be tempting to check for dependencies by searching for all using statements in your C# code. However, namespaces can come from both direct and transitive dependencies, so using statements will not tell you which packages are direct dependencies.

Similarly, PackageVersion elements in your Directory.Packages.props file may refer to both direct and transitive dependencies.

JS Example

1. Open each package.json and collect the package identifiers listed in dependencies, devDependencies, optionalDependencies, and peerDependencies.

   {
     ...
      "dependencies": {
        "project1": "^0.0.1"
      },
      "devDependencies": {
        "project2": "^0.0.2"
      },
      ...
   }

   If the project is a monorepo, check each package.json for the packages used by each project.

2. Search for the package identifiers on NPM

3. Click the “Project website” link on the right to be taken to the project.

4. Follow the instructions in the project’s README file how to pay the Fee for a project

import and require != direct dependency

It can be tempting to check for dependencies by searching for import or require statements in your JavaScript code. However, packages can be imported from both direct and transitive dependencies, so imports will not tell you which packages are direct dependencies.

Similarly, entries in package-lock.json, yarn.lock, or pnpm-lock.yaml may refer to both direct and transitive dependencies.

---

Maintainers

Is your ecosystem missing from the above? Add an example today.