The answers your dependency review will ask for
Licensing, supply chain, security posture, versioning, and — just as important — what TerraFluent doesn't do. Everything below is verifiable from the public packages and repositories.
Licensing
- All three packages are MIT licensed, declared as an SPDX license expression in the NuGet package metadata — not a license file you have to lawyer over.
- No dual licensing, no community/commercial split, no revenue thresholds, no page limits, no watermarks. Commercial and closed-source use is unrestricted.
- License texts: Pdf · Html · Docx.
Supply chain
- Zero runtime dependencies. Each package's nuspec declares empty dependency groups — nothing transitive enters your build. Check for yourself on the NuGet pages: Pdf · Html · Docx.
- 100% managed code. No native binaries, no headless browser, no Office automation — nothing platform-specific to scan or approve.
- Public source with repository metadata. Every package embeds its GitHub repository URL in the NuGet metadata; the Html and Docx packages also embed the exact source commit each version was built from.
- CI on every repository. Each repo builds and tests on GitHub Actions before release — the PDF engine runs its test suite across .NET 8, 9, and 10.
Security posture
- The libraries make no network calls and collect no telemetry — data goes in as C# objects, documents come out as bytes.
- Private vulnerability reporting is enabled on all three repositories via GitHub Security Advisories — see the security policy for scope and supported versions.
- PDF output supports AES-256 encryption (default) with user/owner passwords and permission flags — documented here, including what PDF permissions can and cannot enforce.
Platform support
| Package | Targets | Runs on |
|---|---|---|
| TerraFluent.Pdf.Reporting 2.0.2 | net8.0 · net9.0 · net10.0 |
Windows, Linux, macOS — including Docker (Alpine images work: no native dependencies), Azure Functions, and AWS Lambda |
| TerraFluent.Html.Reporting 1.1.1 | netstandard2.0 · net10.0 |
|
| TerraFluent.Docx.Reporting 1.3.0 | netstandard2.0 · net10.0 |
The netstandard2.0 targets mean Html and Docx Reporting also run on
.NET Framework 4.6.1+ — relevant if you're generating documents from a legacy
ASP.NET application.
Versioning & releases
Semantic versioning, breaking changes only in major versions, a maintained CHANGELOG.md in every repository, and tagged GitHub releases — the full policy and current versions are on the releases page.
What TerraFluent does not do
Knowing the boundaries early saves evaluation time:
- No PDF/A or PDF/UA conformance. PDF output is standard PDF 1.7 without archival metadata or tagged accessibility structure. If you need it, open an issue — demand is tracked publicly.
- No HTML-to-PDF conversion. The PDF engine is code-first; it does not render existing HTML. (The compare page explains when to pick which package.)
- No visual template designer. Documents are defined in fluent C#, versioned with your code — there is no drag-and-drop designer or template marketplace.
- No paid support or SLA. Support is public and best-effort via GitHub issues.
Project continuity
TerraFluent is maintained by a single developer — worth stating plainly, because your review will ask. The mitigations are structural: the MIT license makes forking legal and cheap, the full test suites and CI definitions live in the repositories, every release is reproducible from a tagged commit, and the documentation is versioned with the code. If the project stopped tomorrow, your team could patch its own fork the same afternoon — which is not true of most commercial reporting vendors.