Skip to content

Bump the nuget-dependencies group with 28 updates - #220

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/dot-config/develop/nuget-dependencies-a0db546a68
Open

Bump the nuget-dependencies group with 28 updates#220
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/dot-config/develop/nuget-dependencies-a0db546a68

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown

Updated Azure.Core from 1.62.0 to 1.63.0.

Release notes

Sourced from Azure.Core's releases.

1.63.0

1.63.0 (2026-09-25)

Features Added

  • Added mTLS proof-of-possession support to ClientCertificateCredential, including subject name and issuer certificate authentication configured with SendCertificateChain. Proof-of-possession is used by default when requested; first-party applications can opt out by setting the Azure.Identity.EnableClientCertificateMtlsProofOfPossession AppContext switch (or AZURE_IDENTITY_ENABLE_CLIENT_CERTIFICATE_MTLS_POP environment variable) to false.
  • Added mTLS proof-of-possession support to the managed identity federated identity flow used by configured credentials, covering both managed identity assertion acquisition and client assertion token redemption. It is enabled by default; set EnableMtlsProofOfPossession to false in the credential's JSON configuration to force bearer authentication for both exchanges. On a host that cannot provide a binding certificate, the flow falls back to a bearer token instead of failing, matching the direct managed identity flow.

Breaking Changes

  • Renamed the experimental ManagedIdentityCredentialOptions.DisableMtlsProofOfPossession property and corresponding configuration setting to EnableMtlsProofOfPossession. mTLS proof-of-possession is enabled by default for direct and configured managed identity when requested and supported. To force bearer authentication, replace DisableMtlsProofOfPossession = true with EnableMtlsProofOfPossession = false in code or credential configuration.

Bugs Fixed

  • Fixed ModelReaderWriter deserialization of GeoPoint with AzureCoreContext or a generated consumer context throwing because its type builder was not registered.
  • Fixed DefaultAzureCredential taking up to a minute to continue past managed identity on hosts where IMDS is unavailable. Ordinary chained requests use the short Azure.Core IMDS probe, while proof-of-possession capability discovery passes the same initial IMDS timeout to MSAL so discovery retry delays are canceled and timed-out discovery results are not cached.
  • Fixed chained managed identity aborting the credential chain when MSAL reports all sources unavailable immediately after a successful initial IMDS probe.
  • Managed identity mTLS proof-of-possession now requires a KeyGuard-backed host capability and enforces KeyGuard as the minimum binding strength during token acquisition. (#​62585)

Commits viewable in compare view.

Updated Azure.Messaging.ServiceBus from 7.20.2 to 7.21.0.

Release notes

Sourced from Azure.Messaging.ServiceBus's releases.

7.21.0

7.21.0 (2026-10-06)

Features Added

  • Added SqlFilterCount and CorrelationFilterCount properties to TopicRuntimeProperties, exposing the total number of SQL filters and correlation filters across all of a topic's subscriptions. These are populated by GetTopicRuntimePropertiesAsync and GetTopicsRuntimePropertiesAsync.
  • Added ServiceBusAdministrationClientOptions.ServiceVersion.V2024_05 and made it the default service version. The topic filter counts above are served by the 2024-05 service API version, so the administration client now sends api-version=2024-05 by default.
  • Added GetMessageSessionsAsync overloads on ServiceBusClient for queues and subscriptions. The no-filter overload returns the IDs of sessions that have active messages or session state, and the sessionStateUpdatedAfter overload returns session IDs whose session state was updated after the specified timestamp. Implements the com.microsoft:get-message-sessions AMQP management operation. (#​58761)
  • Added opt-in support for non-exclusive session locking on ServiceBusSessionReceiver, allowing a session to be cooperatively taken over by another receiver. Set ServiceBusSessionReceiverOptions.EnableNonExclusiveSession to accept a session non-exclusively, then read the token from ServiceBusSessionReceiver.SessionLockToken and pass it as ServiceBusSessionReceiverOptions.SessionLockToken = Guid.Parse(token) to take that session over. ServiceBusSessionReceiver.IsSessionExclusive reports the mode the session was established under. Dispositions for a non-exclusive session are routed over the management link so that settlement keeps working across a takeover, which lowers settlement throughput compared to an exclusive session. This applies to ServiceBusSessionReceiver only; ServiceBusSessionProcessor continues to lock sessions exclusively. Accepting a session with EnableNonExclusiveSession set throws NotSupportedException when the endpoint declines it, either by refusing the request outright or by accepting it without assigning a lock token, which is how a caller detects whether the feature is available for a namespace. An endpoint that declines in some other way surfaces the exception its own error maps to. (#​60060)

Bugs Fixed

  • Fixed retry classification for web socket failures with nested causes. On modern .NET, a transient network failure during a web socket connection attempt surfaces as a WebSocketException that wraps an HttpRequestException, which wraps the meaningful IOException or SocketException. The retry policy previously inspected only one level of nesting and treated these failures as terminal. The policy now unwraps nested wrapper exceptions to a bounded depth, so transient failures such as a connection reset use the configured retries. Terminal socket failures, such as host-not-found and host-unreachable, are not retried at any supported depth. A host-unreachable failure on an established connection is now terminal. Earlier versions retried it. (#​61868)

  • Fixed a bug where canceling ServiceBusReceiver.CloseAsync left the receiver unable to close its own links. The receiver was marked as closed, and its set of locked messages disposed, before the cancellation was observed, so every later call to CloseAsync returned immediately without doing any work and the links stayed open until the owning ServiceBusClient was disposed. The receiver is now left open and closable when a close does not complete, so the operation can be retried. (#​59309)

Other Changes

  • The default ServiceBusAdministrationClient service version is now 2024-05 (previously 2021-05). Existing operations are unaffected in behavior; the change is required to surface the new topic filter count properties.

Commits viewable in compare view.

Updated Confluent.Kafka from 2.15.0 to 2.15.1.

Release notes

Sourced from Confluent.Kafka's releases.

2.15.1

Enhancements

Fixes

  • Fix early return in FindMessageByName (#​2644)
  • Preserve HTTP status for retriable SR errors (#​2647)
  • Security patch in examples and tests using old NJsonSchema versions, test framework upgrade in Confluent.Kafka tests (#​2656)

Commits viewable in compare view.

Updated coverlet.collector from 10.0.1 to 10.1.0.

Release notes

Sourced from coverlet.collector's releases.

10.1.0

Improvements

  • Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #​2019
  • Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #​1946
  • Replace legacy .sln files with modern .slnx format #​1966
  • coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #​2005
  • Relax auto-property skip logic and improve coverage for records #​1941

Fixed

  • Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #​1980 #​1967
  • Fix Regression in branch coverage for lambda expressions #​1938
  • Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #​1979
  • Fix silent zero coverage on .NET Framework since 8.0.0 #​1985 by @​tobiwae
  • Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #​1987 #​1988 by @​bkoelman
  • Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #​2010
  • Fix use --config-file CLI arg in coverlet.MTP #​2030 by alexthornton1
  • Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #​2032 by @​Eljees

Diff between 10.0.1 and 10.1.0

Commits viewable in compare view.

Updated docfx from 2.78.5 to 2.81.0.

Release notes

Sourced from docfx's releases.

2.81.0

What's Changed

✨ Features & Platform Support

  • Allow custom templates to override search.min.js in the modern template by @​filzrev in #​10055.
  • Add metadata.sourceLinkExclude to exclude selected source paths from View Source links without removing API documentation by @​vicancy in #​11141.
  • Record the DocFX build version in the docfx_version field of manifest.json by @​vicancy in #​11162.
  • Add a .NET 11 RC target, including support for the .NET 11 Razor source generator, while retaining .NET 8, 9, and 10 targets by @​vicancy and @​filzrev in #​11176 and #​11182.

⚡ Performance & Reliability

  • Reduce JavaScript template processing overhead and memory allocations by reusing parsed scripts and improving model conversion. Add execution limits to prevent runaway scripts from hanging builds by @​lahma in #​11084.
  • Avoid unnecessary exceptions and repeated file reads when loading toc.yml by @​filzrev in #​9974.

🐛 Bug Fixes

  • Restore source links for partial types extended by source generators by @​vicancy in #​11141.
  • Fix local namespace links in managed reference documentation by resolving them through xrefs during site generation by @​vicancy in #​11163.
  • Preserve nested XML blocks when inserting Markdown separators, preventing content from incorrectly rendering as code blocks by @​vicancy in #​11175.
  • Preserve explicit false and 0 values when overwriting nullable properties by @​vicancy in #​11181.

📦 Dependency Updates

Upgrade Notes

Custom JavaScript template preprocessors now enforce a 30-second timeout and a 50-million-statement limit for each getOptions or transform invocation. Long-running custom scripts may need adjustment.

Full Changelog: dotnet/docfx@v2.80.1...v2.81.0

2.80.1

What's Changed

💪 Other Changes

New Contributors

Full Changelog: dotnet/docfx@v2.78.6...v2.80.1

2.78.6

What's Changed

💪 Other Changes

Commits viewable in compare view.

Updated dotnet-stryker from 4.16.0 to 5.0.0.

Release notes

Sourced from dotnet-stryker's releases.

5.0.0

5.0.0 (2026-09-11)

Breaking Changes

Bug Fixes

Features

  • Add test information to html/json report for MTP test runner (#​3541) (5d497fa)
  • MTP: Support perTest and perTestInIsolation coverage analysis (#​3752) (0705367)
  • Add --diag option to improve diagnostic when mutated compilation fails (#​3702) (01db9f4)
  • Support solution configuration (#​3751) (b8bc307)
  • timeouts: Calculate timeout values based on actual mutant runtimes (#​3731) (4fa9ee7)

Commits viewable in compare view.

Updated FsCheck.Xunit.v3 from 3.3.4 to 3.4.0.

Release notes

Sourced from FsCheck.Xunit.v3's releases.

3.4.0

Updated xunit.v3 to version 4.x. (by Simon Baynes)

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.Analyzers from 5.6.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp.Workspaces from 5.0.0 to 5.9.0.

Updated Microsoft.EntityFrameworkCore from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.HealthChecks's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.8.0 to 10.10.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

  • OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

  • Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
  • Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
  • OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

  • Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
  • Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

  • Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
  • Bump PowerShell from 7.6.4 to 7.6.5 #​7702
  • [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
  • Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
  • Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
  • Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
  • Do not validate extension during publish step #​7725 by @​peterwaltonwork
  • Add skill for upgrading OpenAI #​7728 by @​jozkee
  • Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

  • @​Lroca88 made their first contribution in #​7718
  • @​thaildhe172591 made their first contribution in #​7735
  • @​ANcpLua submitted issue #​7665 (resolved by #​7735)
  • @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

10.9.0

Version 10.9.0 is headlined by changes in these areas:

  • AI: New experimental routing APIs center on the abstract RoutingChatClient base class, with SemanticRoutingChatClient as a concrete semantic-routing implementation. Separately, the abstract FailoverChatClient specialization and its concrete OrderedFailoverChatClient implementation add failover routing.
  • AI Evaluation: The generated report gains redesigned Overview, Cases, History, and Comparison views.
  • ASP.NET Core and HTTP diagnostics: The release adds HTTP request latency log enrichment and fixes configuration binding, response-body logging, request-path redaction, and resilience package version handling.
  • Source-generated logging and service discovery: Fixes cover classification type qualification, thread-local state cleanup, and DNS query suffix handling.

Experimental API Changes

New Experimental APIs

  • New experimental API: HTTP request latency log enrichment (EXTEXP0013) #​7602
  • New experimental API: Chat client routing and failover (MEAI001) #​7662

What's Changed

AI (Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI)

  • Add extensible chat client routing #​7662 by @​joshuajyue (co-authored by @​Copilot)
  • Pass the request's options to the selected client #​7685 by @​joshuajyue (co-authored by @​jozkee @​Copilot)
  • AI.Abstractions: fix ExcludeFromSchema dropped under concurrent AIFunction creation #​7677 by @​jozkee (co-authored by @​Copilot)
  • Cap OpenAI dependency version (b10f9c0) by @​jeffhandley (co-authored by @​Copilot)

Note: Microsoft.Extensions.AI.OpenAI constrains its dependency for OpenAI to 2.12.x, preventing OpenAI updates to 2.13.0+ due to an incompatibility. We expect to release Microsoft.Extensions.AI.OpenAI version 10.9.1 during the week of August 17 to address this issue.

HTTP Resilience and Diagnostics (Microsoft.Extensions.Http.Resilience and Microsoft.Extensions.Http.Diagnostics)

  • Fix Grpc.Net.ClientFactory version range check - Fixes #​7565 #​7566 by @​Ghost93
  • Fix response body logging under debugger #​7678 by @​Rimobul
  • Redact outgoing path when route is unknown #​7687 by @​Rimobul
  • Fix HTTP client logging config binding #​7691 by @​Rimobul

ASP.NET Core Extensions (Microsoft.AspNetCore.Diagnostics.Middleware)

  • Rename HttpLatencyTelemetry extensions class and drop redundant TFM guard #​7645 by @​EasyL0ver (co-authored by @​Copilot)
  • Add HTTP request latency log enricher (experimental) #​7602 by @​EasyL0ver (co-authored by @​Copilot)

Logging Source Generator (Microsoft.Gen.Logging)

  • [Microsoft.Gen.Logging] Clear thread-local state when logging throws #​7682 by @​Rimobul
  • [Microsoft.Gen.Logging] Fully qualify classification types #​7689 by @​Rimobul

AI Evaluation (Microsoft.Extensions.AI.Evaluation.Reporting)

  • [Microsoft.Extensions.AI.Evaluation.Reporting] Evaluation report redesign #​7609 by @​grafanaKibana

Project Templates (Microsoft.McpServer.ProjectTemplates)

  • Remove MCP server project template #​7680 by @​jeffhandley (co-authored by @​Copilot)

... (truncated)

10.8.4

This servicing update refreshes the .NET AI project templates ahead of the July 30, 2026 retirement of GitHub Models — removing the GitHub Models provider option and updating template dependencies.

As a result, both the AI Chat Web (aichatweb) and AI Agent Web API (aiagent-webapi) templates now require the AI service provider to be chosen explicitly via --provider; there is no longer a default. One of the following must be selected:

  • --provider azureopenai — Azure OpenAI
  • --provider ollama — Ollama (for local development)
  • --provider openai — OpenAI Platform

Packages in this release

Package Version
Microsoft.Extensions.AI.Templates 10.8.4-preview.3.26379.3
Microsoft.Agents.AI.ProjectTemplates 1.13.0-preview.1.26379.3

What's Changed

Project templates

  • Removed the GitHub Models provider from the AI Chat Web and AI Agent Web API templates, ahead of GitHub Models being fully retired on July 30, 2026. The --provider option is now required with no default (#​7667).
  • Updated AI template dependencies — bumped Aspire.Hosting.AppHost to 13.4.6 and CommunityToolkit.VectorData.SqliteVec to 1.0.0-preview.4 (aligned System.Linq.AsyncEnumerable to 10.0.9), replacing earlier workaround package pins (#​7639).

Full Changelog

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version Note
Microsoft.Extensions.VectorData.Abstractions 10.8.2 Published August 7, 2026
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

Update: August 7, 2026
The Microsoft.Extensions.VectorData.Abstractions package was initially excluded from this release by mistake. Because Microsoft.Extensions.VectorData.ConformanceTests has a dependency on Microsoft.Extensions.VectorData.Abstractions, that led to failures when updating to Microsoft.Extensions.VectorData.ConformanceTests 10.8.2.

Microsoft.Extensions.VectorData.Abstractions was published August 7, 2026 to resolve that issue.

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.8.1 to 18.10.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.10.1

What's Changed

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

18.10.0

What's Changed

Full Changelog: microsoft/vstest@v18.9.0...v18.10.0

18.9.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.11.0 to 2.12.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.12.0

2.12.0 (2026-08-12)

Features

  • adds deserialization of the example extension (095ae3b)
  • serialize license identifier as extension for earlier versions (d5cdce8)
  • serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

  • better nullability round-tripping (7a25659)
  • bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
  • bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
  • library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
  • marks deprecated properties from the specification as obsolete (26aba69)
  • marks deprecated properties from the specification as obsolete (abc5301)
  • schema: serialize compatibility examples from examples list (be57a7c)
  • serialize examples as extension in v2/v3 (d27141b)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.11.0 to 3.10.2.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.10.2

3.10.2 (2026-08-20)

Bug Fixes

3.10.1

3.10.1 (2026-08-19)

Bug Fixes

3.10.0

3.10.0 (2026-08-11)

Features

  • adds deserialization of the example extension (e5a1080)
  • do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
  • serialize license identifier as extension for earlier versions (d090989)
  • serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

  • better nullability round-tripping (655c2c8)
  • bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
  • deserialize metadata url from extension in earlier version (9387b01)
  • marks deprecated properties from the specification as obsolete (787b045)
  • marks deprecated properties from the specification as obsolete (953c22a)
  • schema: serialize compatibility examples from examples list (5d8ec3a)
  • serialize examples as extension in v2/v3 (ff1dbc9)
  • serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

Bug Fixes

  • adds explicit error message for invalid json pointers (63fc55d)
  • adds explicit error message for invalid json pointers (bc93efe)
  • default mapping is not being serialized with the correct shape (fe4a25f)
  • differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
  • handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
  • validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

  • add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
  • library: support schema keywords on references (434b2f8)
  • library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

  • Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
  • handling of nullable enums for 3.0 (#​2920) (beb68f5)
  • library: keep v3 schema references ref-only (c938727)
  • preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
  • use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

  • add contains/minContains/maxContains members (78475e3)
  • add contains/minContains/maxContains members (1a974f8)
  • library: add missing json schema properties (9b1aed6)
  • library: add missing json schema properties (82f84e0)

Bug Fixes

  • library: always copy unevaluated properties (4907d1c)
  • library: avoid false circular refs for external schema re-exports (b635242)
  • library: avoid false circular refs for external schema re-exports (7a443c2)
  • library: remove unshipped schema extension fallback (cf54bb3)
  • library: use version-specific schema keyword callbacks (6e22ec6)
  • library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

  • reader: remove ParseNode infrastructure (9b4f45b)
  • Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

  • reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

  • library: handle circular schema references (b3cd42b)
  • library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

  • null reference exception for boolean component schemas (f97f91a)
  • null reference exception for boolean component schemas (fe0b50a)
  • schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

  • schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

  • hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
  • hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

  • security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

  • library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

  • a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
  • a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
  • double encoding of json pointer for invalid reference rule (b246cd0)
  • encoding of special characters for JSON paths (4c757e1)
  • library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
  • library: do not emit unevaluatedProperties for non-object schemas (19538aa)
  • library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
  • potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

  • library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
  • library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
  • securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

  • implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
  • library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
  • library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
  • optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

Bug Fixes

  • broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

  • models: add shared Content interface (9e13b25)
  • models: add shared Content interface (#​2695) (9e13b25)
  • models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

  • hidi validate command now logs warnings (76a3c0f)
  • hidi validate command now logs warnings (62e7d56)

Bug Fixes

  • discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
  • discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

  • Support custom tag ordering (008576c)
  • Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

  • correct error pointer when extension parser throws OpenApiException (43c75a9)
  • wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

  • schema: always serialize additionalProperties: false (6651c36)
  • schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

  • Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

  • load JSON documents that are preceded by multiple whitespace ([6461bac](https://gith...
    ...

Description has been truncated

@dependabot
Bump the nuget-dependencies group with 28 updates
f20691e 
Bumps Azure.Core from 1.62.0 to 1.63.0
Bumps Azure.Messaging.ServiceBus from 7.20.2 to 7.21.0
Bumps Confluent.Kafka from 2.15.0 to 2.15.1
Bumps coverlet.collector from 10.0.1 to 10.1.0
Bumps docfx from 2.78.5 to 2.81.0
Bumps dotnet-stryker from 4.16.0 to 5.0.0
Bumps FsCheck.Xunit.v3 from 3.3.4 to 3.4.0
Bumps Microsoft.AspNetCore.OpenApi from 10.0.10 to 10.0.12
Bumps Microsoft.AspNetCore.TestHost from 10.0.10 to 10.0.12
Bumps Microsoft.CodeAnalysis.Analyzers from 5.6.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 5.0.0 to 5.9.0
Bumps Microsoft.EntityFrameworkCore from 10.0.10 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.10 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.10 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.10 to 10.0.12
Bumps Microsoft.Extensions.DependencyInjection from 10.0.10 to 10.0.12
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.10 to 10.0.12
Bumps Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.10 to 10.0.12
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.8.0 to 10.10.0
Bumps Microsoft.NET.Test.Sdk from 18.8.1 to 18.10.1
Bumps Microsoft.OpenApi to 2.12.0, 3.10.2
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.19.1
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.19.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.19.0
Bumps Testcontainers.MsSql from 4.13.0 to 4.15.0
Bumps Testcontainers.RabbitMq from 4.14.0 to 4.15.0
Bumps xunit.runner.visualstudio from 3.1.5 to 4.0.0
Bumps xunit.v3 from 3.2.2 to 4.0.1

---
updated-dependencies:
- dependency-name: Azure.Core
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Azure.Messaging.ServiceBus
  dependency-version: 7.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Confluent.Kafka
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: docfx
  dependency-version: 2.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: dotnet-stryker
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: FsCheck.Xunit.v3
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.OpenApi
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Testcontainers.MsSql
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Testcontainers.RabbitMq
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: xunit.v3
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 28, 2026
@dependabot
dependabot Bot requested a review from Amir-ESH as a code owner September 28, 2026 05:06
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Sep 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Amir-ESH Amir-ESH Awaiting requested review from Amir-ESH Amir-ESH is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants