[dependabot]

Updated cyclonedx from 6.2.0 to 6.3.1.

Release notes

Sourced from cyclonedx's releases.

6.3.1

Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#​1139, #​1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @​wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0

Added

• NuGet purls for project references (#​1137, fixes #​1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

• Development dependency scopes (#​1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
• --exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

• Assembly-name resolution (#​1128, fixes #​917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
• Exclusion filtering (#​1135, fixes #​1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
• Target-framework regression coverage (#​1131, fixes #​1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

• @​MichaelKopfMkf — NuGet purls for project references (#​1137, #​1136).
• @​mtsfoni — development dependency scopes and compatible exclusion behavior (#​1138).
• @​uo-uhbc — exclusion-filter orphan handling fix and reproduction (#​1135, #​1133).
• @​mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#​1131).
• @​Eljees — root-namespace assembly-name resolution fix (#​1128).
• @​TobiDimmel — reported the assembly-name property resolution issue (#​917).
• @​jasonlhills — reported the exclusion-filter failure (#​1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

• @​MichaelKopfMkf made their first contribution in #​1137.
• @​mgnslndh made their first contribution in #​1131.
• @​Eljees made their first contribution in #​1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1

CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

• Resolve dependency ranges with multiple matching package versions (#​1113, fixes #​1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
• Fix hash computation for uncached NuGet packages (#​1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

• Update .NET dependencies and CI tooling.
• Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

• Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

• @​LukasChristel — fix hash computation for uncached NuGet packages (#​1099).
• @​michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#​1110).
• @​mtsfoni — dependency range resolution fix and regression coverage (#​1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Updated MSTest from 4.3.3 to 4.5.1.

Release notes

Sourced from MSTest's releases.

4.5.1

See the release notes here

4.5.0

See the release notes here

4.4.1

See the release notes here

4.4.0

See the release notes here

Commits viewable in compare view.

Updated Testcontainers.PostgreSql from 4.14.0 to 4.16.0.

Release notes

Sourced from Testcontainers.PostgreSql's releases.

4.16.0

What's Changed

Huge thanks to everyone for your contributions and feedback 🧡.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​54051351.

🚀 Features

• feat: Add common WithSsl builder API and support it in Azurite (#​1788) @​aleksandarMilev, @​HofmeisterAn
• feat: Add BuildKit support for image builds via sidecar container (#​1761) @​george-petrakis, @​HofmeisterAn
• feat(Elasticsearch): Add OTLP and certificate support (#​1774) @​HofmeisterAn

🐛 Bug Fixes

• fix(PostgreSql): Support SSL with Alpine images and non-root users (#​1790) @​HofmeisterAn
• fix: Do not pull base image with unresolved platform variable (#​1787) @​HofmeisterAn
• fix(Kafka): Default to KRaft for Confluent Platform 8.x images (#​1775) @​arnelirobles, @​HofmeisterAn
• fix(Kafka): Drop the trailing comma from advertised listeners (#​1772) @​arnelirobles, @​HofmeisterAn
• fix: Prevent Docker ignore patterns from matching path prefixes (#​1768) @​Benziza, @​HofmeisterAn

📖 Documentation

• docs: Complete builder API tables and align heading casing (#​1778) @​HofmeisterAn
• docs: Explain how builder configurations combine (#​1770) @​arnelirobles, @​HofmeisterAn

🧹 Housekeeping

• fix: Regenerate expired test certificates (#​1786) @​zcsizmadia
• chore: Resolve Sonar findings (#​1776) @​HofmeisterAn
• chore: Remove Minio module (#​1769) @​HofmeisterAn
• chore: Publish NuGet packages with Trusted Publishing (OIDC) (#​1763) @​HofmeisterAn
• feat: Prepare next release cycle (4.16.0) (#​1762) @​HofmeisterAn

📦 Dependency Updates

• chore(deps): Bump the actions group with 5 updates (#​1781) @​dependabot[bot]

4.15.0

What's Changed

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​45594466.

🚀 Features

• feat: Add options to the Docker Compose up and down command (#​1759) @​HofmeisterAn
• feat: Add QuestDB module (#​1618) @​FortuneN, @​HofmeisterAn
• feat: Add Compose support (#​1750) @​HofmeisterAn
• fix(Couchbase): Treat an already provisioned cluster as configured (#​1736) @​arnelirobles, @​HofmeisterAn
• feat: Retry transient Docker image pull failures (#​1734) @​thomhurst, @​HofmeisterAn
• chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn
• feat(MongoDb): Resolve the MongoDb shell file path once (#​1745) @​HofmeisterAn

🐛 Bug Fixes

• fix: Detach from the container output before stopping or removing it (#​1755) @​HofmeisterAn
• fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn

📖 Documentation

• docs: Update CONTRIBUTING.md (#​1744) @​HofmeisterAn

🧹 Housekeeping

• chore: Improve null check, test typing, and IDE settings (#​1757) @​HofmeisterAn
• fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn
• chore: Resolve Sonar findings (#​1751) @​HofmeisterAn
• chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
• feat: Prepare next release cycle (4.15.0) (#​1742) @​HofmeisterAn

📦 Dependency Updates

• chore(deps): Bump mkdocs-material from 9.7.2 to 9.7.7 (#​1758) @​dependabot[bot]
• chore(deps): Bump the actions group with 5 updates (#​1754) @​dependabot[bot]
• chore(deps): Bump the actions group across 1 directory with 7 updates (#​1747) @​dependabot[bot]
• chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
• chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn

Commits viewable in compare view.