[dependabot]

Updated Aspire.Hosting from 13.5.4 to 13.6.4.

Release notes

Sourced from Aspire.Hosting's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

• 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

• ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

• 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

---

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

• 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

• 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

---

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

• [release/13.6] Bump version to 13.6.2 by @​danegsta with @​Copilot in [release/13.6] Bump version to 13.6.2 microsoft/aspire#20877
• [release/13.6] Pin MessagePack to 2.5.307 for security fixes by @​eerhardt in [release/13.6] Pin MessagePack to 2.5.307 for security fixes microsoft/aspire#21156

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

13.6.1

What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.

🐛 Fixes

• 📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #​20725. (#​20747, backport of #​20736, @​JamesNK)

• 📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #​20728. (#​20762, backport of #​20758, @​heyysiri)

• 🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#​20545, backport of #​20527, @​JamesNK)

• 🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical Watch task over Kubernetes ContainerExec resources terminated unexpectedly error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#​20664, backport of #​20466, @​radical)

• 🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through dotnet run or dotnet watch now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and aspire stop flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #​20495. (#​20514, backport of #​20494, @​danegsta)

---

Full Changelog: v13.6.0...v13.6.1

Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8

13.6.0

Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.

Highlights

• 🗃️ Persistent, refreshed dashboard — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail.
• 🖥️ AppHost-owned terminals and database REPLs — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in WithRepl() commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while aspire terminal ps and aspire terminal tape play support discovery and repeatable terminal interactions.
• 🌐 First-party Java and Rust hosting — New Aspire.Hosting.Java and Aspire.Hosting.Rust packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.
• 🛠️ More flexible AppHosts — The prerelease Aspire.Hosting.Dotnet integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard appsettings.json configuration and Deno runtime support.
• ⌨️ Sharper CLI workflows — Select launch profiles with aspire run and aspire start, update repository-local CLI manifests with aspire update, create file-based C# AppHosts with aspire init --language csharp --file-based, and export TypeScript API data with aspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and aspire stop --force --volumes adds explicit cleanup of Aspire-owned volumes.
• 💻 More capable VS Code tooling — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable.
• ☁️ New Azure options in preview — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning.
• ☸️ More expressive, reliable deployments — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.
• 🔌 Expanded integrations — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard.

⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from Aspire.Hosting.Terminals to Aspire.Hosting.ApplicationModel.

See the full list and migration guidance in the Aspire 13.6 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.

Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜

---

Full Changelog: v13.5.4...v13.6.0

Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.SignalR.Client from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.SignalR.Client's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Compliance.Redaction from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.Compliance.Redaction's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

• Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

• Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

• Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
• Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
• AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
• Ignore empty model IDs in streaming responses #​7816 by @​valkiara
• Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
• Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
• Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

• [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
• Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
• Order iteration results numerically #​7769 by @​tahakocal
• Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

• Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

• Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
• Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

• Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package	Version
Microsoft.Extensions.AI.OpenAI	10.10.1
Microsoft.Extensions.AI.Abstractions	10.10.1

What's Changed

AI

• Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

• @​zxyao145 made their first contribution in #​7761
• @​zxyao145 submitted issue #​7760 (resolved by #​7761)
• @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Binder from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.Binder's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Kiota.Bundle from 1.22.0 to 2.1.2.

Release notes

Sourced from Microsoft.Kiota.Bundle's releases.

2.1.2

2.1.2 (2026-09-08)

Bug Fixes

• serialization-json: honor custom TimeSpan converters (#​795) (e22c5ba)
• serialization-json: honor DateTimeOffset converters (802e20a)
• serialization-json: honor guid converters before fallback parsing (#​794) (22cc1d3)

2.1.1

2.1.1 (2026-09-04)

Bug Fixes

• http: handle not modified responses (#​787) (82e3190)

2.1.0

2.1.0 (2026-08-27)

Features

• adds support for wildcard host validation (#​779) (6a6130e)

2.0.2

2.0.2 (2026-07-16)

Bug Fixes

• http: bump System.Text.Json minimum version to 8.0.5 to address vulnerability (#​744) (430c6a9)

2.0.1

2.0.1 (2026-06-26)

Bug Fixes

• Added net10-browser as a target to enable the BROWSER directive (#​728) (4ab20a0)

2.0.0

2.0.0 (2026-05-06)

⚠ BREAKING CHANGES

• net5.0 and net6.0 TFMs dropped; net8.0 and net10.0 added.
• update target frameworks, merge IAsyncParseNodeFactory, and remove obsolete APIs (#​708)
• abstractions: IAsyncParseNodeFactory removed; implement IParseNodeFactory.GetRootParseNodeAsync directly.
• abstractions: Use DeserializeAsync/DeserializeCollectionAsync instead.
• abstractions: GetPartValue(string) and RemovePart(string) removed; use the overloads that accept (partName, contentType).

Features

• update target frameworks to net8.0 and net10.0, drop net5.0 and net6.0 (c41f7e0)
• update target frameworks, merge IAsyncParseNodeFactory, and remove obsolete APIs (#​708) (c41f7e0)

Bug Fixes

• build: update package version lower bounds from 6.0 to 8.0 (c41f7e0)
• ci: use glob pattern for timestamped coverlet coverage report paths (c41f7e0)
• resolve trim analysis warnings and pin PublicApiAnalyzers to net8.0 (c41f7e0)

Code Refactoring

• abstractions: merge IAsyncParseNodeFactory into IParseNodeFactory (c41f7e0)
• abstractions: remove deprecated single-param MultipartBody.GetPartValue and RemovePart overloads (c41f7e0)
• abstractions: remove synchronous Deserialize and DeserializeCollection from KiotaSerializer (c41f7e0)

1.22.2

1.22.2 (2026-05-05)

Bug Fixes

• Set CLSCompliant attribute where possible (#​705) (f6c21e4)

1.22.1

1.22.1 (2026-03-19)

Bug Fixes

• adds missing parentheses in pattern matching (#​671) (50d535e)
• performance issue with enum parsing during deserialization (#​670) (3a09234)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.7.5 to 2.12.2.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.12.2

2.12.2 (2026-08-20)

Bug Fixes

• duplicate schema example when serializing to v2 (#​3046) (a6366be)

2.12.1

2.12.1 (2026-08-19)

Bug Fixes

• circular ref guard (#​3033) (#​3039) (406e6fd)
• harden yaml parsing (#​3034) (fdc5718)

2.12.0

2.12.0 (2026-08-12)

Features

• adds deserialization of the example extension (095ae3b)
• serialize license identifier as extension for earlier versions (d5cdce8)
• serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

• better nullability round-tripping (7a25659)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
• library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
• marks deprecated properties from the specification as obsolete (26aba69)
• marks deprecated properties from the specification as obsolete (abc5301)
• schema: serialize compatibility examples from examples list (be57a7c)
• serialize examples as extension in v2/v3 (d27141b)

2.11.0

2.11.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (557bd6a)
• adds support for anchor and id external resolution (4138e47)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (baf8428)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (a139f83)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (6091f5a)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (a8688dc)

Bug Fixes

• adds explicit error message for invalid json pointers (#​2955) (a304e56)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (a8787af)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (e08570f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (bc11356)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (310b6e2)

2.10.0

2.10.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (465521b)
• library: support schema keywords on references (2749463), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (#​2917) (6a45a82)
• handling of nullable enums for 3.0 (#​2920) (f4778e0)
• library: keep v3 schema references ref-only (8d811c3)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (fb20d46)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (c79a83e)
• use async method for crypto flush (677b519)

2.9.0

2.9.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (fadb422)
• library: add missing json schema properties (db41a3c)

Bug Fixes

• library: always copy unevaluated properties (3951a31)
• library: avoid false circular refs for external schema re-exports (a058913)
• library: avoid false circular refs for external schema re-exports (1bace68)
• library: merge contains compat members into missing properties (7dc45e1)
• library: remove unshipped schema extension fallback (b301827)
• library: use version-specific schema keyword callbacks (f93d76a)
• library: use x-jsonschema schema extensions (ec04a7f)

2.8.0

2.8.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (d7c6a9d)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

2.7.6

2.7.6 (2026-05-28)

Bug Fixes

• reader: preserve nullable Null flag when type appears after nullable in V3.1/V3.2 deserializers (288e95a)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.7.5 to 3.11.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.11.0

3.11.0 (2026-10-19)

Features

• document: add GetOperationById to search operations across path… (#​3025) (1dae1ff)

Bug Fixes

• components-key validation timeouts under load (#​3108) (01d4729)
• openapi: omit null response descriptions (afd4967)
• serialization: potential infinite loop when inlining references (c6ef130)
• serialization: references inlining (#​3124) (c6ef130)

3.10.2

3.10.2 (2026-08-20)

Bug Fixes

• duplicate schema example when serializing to v2 (#​3045) (50f5a2b)

3.10.1

3.10.1 (2026-08-19)

Bug Fixes

• circular ref guard (#​3033) (8018d40)
• harden yaml parsing (#​3027) (e0d5e9d)

3.10.0

3.10.0 (2026-08-11)

Features

• adds deserialization of the example extension (e5a1080)
• do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
• serialize license identifier as extension for earlier versions (d090989)
• serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

• better nullability round-tripping (655c2c8)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
• deserialize metadata url from extension in earlier version (9387b01)
• marks deprecated properties from the specification as obsolete (787b045)
• marks deprecated properties from the specification as obsolete (953c22a)
• schema: serialize compatibility examples from examples list (5d8ec3a)
• serialize examples as extension in v2/v3 (ff1dbc9)
• serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
• library: support schema keywords on references (434b2f8)
• library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
• handling of nullable enums for 3.0 (#​2920) (beb68f5)
• library: keep v3 schema references ref-only (c938727)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
• use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (78475e3)
• add contains/minContains/maxContains members (1a974f8)
• library: add missing json schema properties (9b1aed6)
• library: add missing json schema properties (82f84e0)

Bug Fixes

• library: always copy unevaluated properties (4907d1c)
• library: avoid false circular refs for external schema re-exports (b635242)
• library: avoid false circular refs for external schema re-exports (7a443c2)
• library: remove unshipped schema extension fallback (cf54bb3)
• library: use version-specific schema keyword callbacks (6e22ec6)
• library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (9b4f45b)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

• reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

• library: handle circular schema references (b3cd42b)
• library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (f97f91a)
• null reference exception for boolean component schemas (fe0b50a)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

• schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
• hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

• library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
• double encoding of json pointer for invalid reference rule (b246cd0)
• encoding of special characters for JSON paths (4c757e1)
• library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
• library: do not emit unevaluatedProperties for non-object schemas (19538aa)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
• potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
• library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
• securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

• implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
• library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
• library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

• models: add shared Content interface (#​2695) (338566f)

Bug Fixes

• broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

• models: add shared Content interface (9e13b25)
• models: add shared Content interface (#​2695) (9e13b25)
• models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

• hidi validate command now logs warnings (76a3c0f)
• hidi validate command now logs warnings (62e7d56)

Bug Fixes

• discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
• discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

• Support custom tag ordering (008576c)
• Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

• correct error pointer when extension parser throws OpenApiException (43c75a9)
• wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

• schema: always serialize additionalProperties: false (6651c36)
• schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

• Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

• load JSON documents that are preceded by multiple whitespace (6461bac)
• non-seekable json streams would fail to load as a document (2436d73)
• reading streams in an asp.net context would cause async exceptions (f9e5248)

3.0.2

3.0.2 (2025-12-08)

Bug Fixes

• additional properties serialization should not emit a schema in v2 (946cba9)
• additional properties serialization should not emit booleans in v3.1+ (946cba9)

3.0.1

3.0.1 (2025-11-17)

Bug Fixes

• empty strings should be quoted in yaml (8d215f9)
• empty strings should be quoted in yaml (0ca10db)

3.0.0

3.0.0 (2025-11-11)

⚠ BREAKING CHANGES

• adds support for OpenAPI 3.2.0

Note: Please refer to the upgrade guide for a detailed description of the breaking changes.

Note: ASP.net users should remain on version 1.X for ASP.net < 10, and version 2.X for ASP.net 10, this new major version will be implemented in a future version of ASP.net, more information

Features

• adds support for OpenAPI 3.2.0 (765a8dd)

Special thanks

• Matthieu Costabello

2.13.0

2.13.0 (2026-10-19)

Features

• document: add GetOperationById to search operations across path… (#​3025) (#​3074) (75d6cea)

Bug Fixes

• components-key validation timeouts under load (#​3108) (#​3112) (5369417)
• openapi: omit null response descriptions (1344a43)

2.12.2

2.12.2 (2026-08-20)

Bug Fixes

• duplicate schema example when serializing to v2 (#​3046) (a6366be)

2.12.1

2.12.1 (2026-08-19)

Bug Fixes

• circular ref guard (#​3033) (#​3039) (406e6fd)
• harden yaml parsing (#​3034) (fdc5718)

2.12.0

2.12.0 (2026-08-12)

Features

• adds deserialization of the example extension (095ae3b)
• serialize license identifier as extension for earlier versions (d5cdce8)
• serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

• better nullability round-tripping (7a25659)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
• library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
• marks deprecated properties from the specification as obsolete (26aba69)
• marks deprecated properties from the specification as obsolete (abc5301)
• schema: serialize compatibility examples from examples list (be57a7c)
• serialize examples as extension in v2/v3 (d27141b)

2.11.0

2.11.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (557bd6a)
• adds support for anchor and id external resolution (4138e47)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (baf8428)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (a139f83)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (6091f5a)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (a8688dc)

Bug Fixes

• adds explicit error message for invalid json pointers (#​2955) (a304e56)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (a8787af)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (e08570f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) ([bc11356](https://github.co...

_Description ha...

Description has been truncated