Clarification Required: Polly OSMF Impact on Microsoft.Extensions.Http.Resilience

Question

Clarification Required: Polly OSMF Impact on Microsoft.Extensions.Http.Resilience

Neeraj Mahajan 121

Hello Team,

We are seeking clarification regarding the recently announced Open Source Maintenance Fee (OSMF) for Polly and its implications for applications that follow Microsoft's recommended resilience patterns. [thepollyproject.org]

Microsoft documentation states that Microsoft.Extensions.Resilience and Microsoft.Extensions.Http.Resilience are built on or rely on Polly, and these packages are currently recommended for implementing resiliency in .NET applications. [learn.microsoft.com], [learn.microsoft.com], [devblogs.m...rosoft.com]

We would appreciate guidance on the following:

If an application references only:

Microsoft.Extensions.Http.Resilience, and/or
Microsoft.Extensions.Resilience

and does not directly reference any Polly.* NuGet packages, is the application considered a direct consumer of Polly for OSMF or licensing/compliance purposes?

Does Microsoft have an official position or guidance for customers regarding the OSMF introduced by Polly?
Are there any compliance, procurement, or licensing considerations that customers should evaluate when adopting Microsoft's recommended resilience packages, given their dependency on Polly?

We have reviewed public discussions where it was suggested that users of Microsoft's resilience packages may not be expected to pay the Polly OSMF directly. However, we have not found any official Microsoft guidance confirming this interpretation and would appreciate an authoritative position. [github.com], [github.com]

Thank you for your assistance.

Kind regards,

Neeraj Mahajan

0 comments

1 answer

Your answer

Answer 1

Hello @Neeraj Mahajan , thank you for reaching out.

Regrettably, legal advice is outside what I can provide here. For questions about the OSMF’s definitions and requirements, please reach out through OSMF Discussions.

If your concern boils down to whether using those Microsoft packages requires you to pay Polly’s maintenance fee: the answer is no in the scenario you described, where Polly is only a transitive dependency. As you may already have seen in the OSMF FAQ linked in those discussions, transitive dependencies do not require the maintenance fee.
Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

As far as I could establish from my research, Microsoft has not published guidance specifically on Polly’s OSMF, so I’m afraid there’s no official statement I can point you to.

For any broader compliance, procurement, or licensing requirements, those should be reviewed with your legal or procurement team. For clarification specifically on the OSMF requirements, please refer to OSMF Discussions mentioned above.

If you have any further questions that are technical and related to .NET or these packages, please feel free to ask here. Or if you found my response helpful or informative, I would greatly appreciate it if you could follow this guide for your confirmation. Thank you.