Pin Polly to a fixed version to avoid unintended OSMF implications through transitive dependencies

The Polly project announced that it will adopt the Open Source Maintenance Fee (OSMF) model starting on November 16, 2026. According to the announcement, organizations generating revenue from products that use Polly may be required to pay a maintenance fee.

Orchard Core currently consumes Polly as a transitive dependency. While this is not an immediate technical issue, it may become a legal and compliance concern for Orchard Core adopters once OSMF-covered Polly releases become available.

A key concern is that Polly has not yet published the actual EULA or legal terms that will govern its implementation of the OSMF. At this point, only the announcement has been published.

If Polly adopts the standard terms and EULA templates published by the Open Source Maintenance Fee initiative, the wording appears insufficiently clear regarding the treatment of transitive dependencies. The commonly stated intention is that consumers of a project that merely depends on Polly transitively should not be subject to the fee. However, the available wording is broad enough that organizations using Orchard Core could reasonably conclude that they are required to pay a fee simply because Polly exists somewhere in their dependency graph. Discussions in the Polly repository show that this question is already causing confusion among users.

Even if the intended interpretation excludes transitive consumers, legal ambiguity alone may be enough to create adoption and compliance concerns for Orchard Core users. Until the final Polly-specific terms are published and the treatment of transitive dependencies is clearly defined, upgrading to OSMF-covered Polly versions may expose Orchard Core consumers to unnecessary uncertainty.

We have previously taken a similar approach with JsonPath.Net by pinning the dependency to a specific version when licensing concerns arose.

Proposed action

• Pin Polly to the latest version released before the OSMF takes effect on November 16, 2026.
• Reevaluate future Polly upgrades once the final Polly-specific EULA and terms have been published.
• Upgrade only after it is clear that Orchard Core consumers are not unintentionally affected through transitive dependency usage.

References

Introducing the Open Source Maintenance Fee for Polly (July 14, 2026) OSMF adoption · App-vNext Polly · Discussion #3183