Skip to content

Bump the nuget-minor-patch group with 29 updates - #80

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-minor-patch-f15d5c0b03
Open

Bump the nuget-minor-patch group with 29 updates#80
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-minor-patch-f15d5c0b03

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Updated AngleSharp from 1.8.2 to 1.8.4.

Release notes

Sourced from AngleSharp's releases.

1.8.4

Released on Wednesday, October 7 2026

What's Changed

  • Improved selection when parsing <select> (#​1364) @​PrzemyslawKlys
  • Updated constraint validation eligibility of fieldset and output elements (breaking behavior change) (#​1373) @​PrzemyslawKlys
  • Fixed change of <select> value (IsSelected) (#​1365) @​PrzemyslawKlys
  • Fixed indeterminate input state when cloning (#​1367) @​PrzemyslawKlys
  • Fixed <select> form submission including unselected options and options in disabled groups (#​1366) @​PrzemyslawKlys
  • Fixed option indexes inside option groups (#​1368) @​PrzemyslawKlys
  • Fixed selecting an option leaving other single-select options selected (#​1372) @​PrzemyslawKlys
  • Fixed validity checks for controls excluded from validation (#​1370) @​PrzemyslawKlys
  • Fixed template content document when adopting a subtree (#​1374) @​PrzemyslawKlys
  • Fixed checking a radio leaving other group members checked (#​1371) @​PrzemyslawKlys
  • Fixed parsed radio checkedness depending on attribute order @​PrzemyslawKlys
  • Fixed SVG annotation-xml elements being treated as HTML integration points @​NotAFlightRisk
  • Fixed required radio validation across group members (#​1369) @​PrzemyslawKlys
  • Released 1.8.4 by @​FlorianRappl in Release 1.8.4 AngleSharp/AngleSharp#1377

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.8.3...v1.8.4

1.8.3

Released on Wednesday, September 30 2026

What's Changed

  • Improved cancellation of queued timer callbacks (#​1357) @​PrzemyslawKlys
  • Improved configuration / setup performance (#​1360) @​PrzemyslawKlys
  • Fixed form submission ignoring sandbox restrictions (#​1358) @​PrzemyslawKlys
  • Fixed <base> elements not following frozen document base URL and tree-order mutation rules (#​1355, #​1362)
  • Fixed native Unloading handlers subscribing to unloading instead of beforeunload (#​1354) @​PrzemyslawKlys
  • Added OnReset event to inform script hosts of native listener removals (#​1356) @​PrzemyslawKlys
  • Added pull-based HTML serialization stream (#​1361) @​PrzemyslawKlys
  • Released 1.8.3 by @​FlorianRappl in Release 1.8.3 AngleSharp/AngleSharp#1363

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.8.2...v1.8.3

Commits viewable in compare view.

Updated Aspire.Hosting from 13.5.4 to 13.6.1.

Release notes

Sourced from Aspire.Hosting's releases.

13.6.1

What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.

🐛 Fixes

  • 📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #​20725. (#​20747, backport of #​20736, @​JamesNK)

  • 📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #​20728. (#​20762, backport of #​20758, @​heyysiri)

  • 🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#​20545, backport of #​20527, @​JamesNK)

  • 🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical Watch task over Kubernetes ContainerExec resources terminated unexpectedly error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#​20664, backport of #​20466, @​radical)

  • 🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through dotnet run or dotnet watch now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and aspire stop flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #​20495. (#​20514, backport of #​20494, @​danegsta)

Full Changelog: v13.6.0...v13.6.1

Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8

13.6.0

Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.

Highlights

  • 🗃️ Persistent, refreshed dashboard — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail.
  • 🖥️ AppHost-owned terminals and database REPLs — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in WithRepl() commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while aspire terminal ps and aspire terminal tape play support discovery and repeatable terminal interactions.
  • 🌐 First-party Java and Rust hosting — New Aspire.Hosting.Java and Aspire.Hosting.Rust packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.
  • 🛠️ More flexible AppHosts — The prerelease Aspire.Hosting.Dotnet integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard appsettings.json configuration and Deno runtime support.
  • ⌨️ Sharper CLI workflows — Select launch profiles with aspire run and aspire start, update repository-local CLI manifests with aspire update, create file-based C# AppHosts with aspire init --language csharp --file-based, and export TypeScript API data with aspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and aspire stop --force --volumes adds explicit cleanup of Aspire-owned volumes.
  • 💻 More capable VS Code tooling — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable.
  • ☁️ New Azure options in preview — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning.
  • ☸️ More expressive, reliable deployments — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.
  • 🔌 Expanded integrations — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard.

⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from Aspire.Hosting.Terminals to Aspire.Hosting.ApplicationModel.

See the full list and migration guidance in the Aspire 13.6 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.

Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜

Full Changelog: v13.5.4...v13.6.0

Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f

Commits viewable in compare view.

Updated AWSSDK.SecretsManager from 4.0.100.14 to 4.0.100.16.

Release notes

Sourced from AWSSDK.SecretsManager's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Azure.Security.KeyVault.Secrets from 4.11.1 to 4.11.2.

Release notes

Sourced from Azure.Security.KeyVault.Secrets's releases.

4.11.2

4.11.2 (2026-10-02)

Bugs Fixed

  • Fixed handling of claims challenges when the authentication challenge cache is empty or cleared while a request is in flight.
  • Fixed an issue in the challenge-based authentication policy where a cached authentication challenge accepted with challenge resource verification disabled could be reused by a separate default-strict client without revalidating the challenge resource.
  • Improved authentication challenge resource validation.

Commits viewable in compare view.

Updated Discord.Net from 3.20.1 to 3.20.2.

Release notes

Sourced from Discord.Net's releases.

3.20.2

[3.20.2] - 2026-10-08

A small update that brings support for the new file upload component file extension filter as well as some other new API things.

Added

  • #​3280 Add attachment flags and fix container spoiler state (d550c75)
  • #​3282 Add IsSpoilerChannel flag (bdecf12)
  • #​3286 Add file type filters support for file upload components #​3286 (d34a50e)

Fixed

  • #​3279 Fix ModifyOriginalResponseAsync rejecting null content with attachments (9c78ee0)

Misc

  • #​3283 Add audio recording sample (bd4a42c)
  • #​3284 Give some extra info when no selectmenu options are given (911efb4)
  • #​3285 Change default attachment size limit to 20MiB (247b1e5)

New Contributors

Full Changelog: discord-net/Discord.Net@3.20.1...3.20.2

Commits viewable in compare view.

Updated dotnet-ef from 9.0.7 to 9.0.20.

Release notes

Sourced from dotnet-ef's releases.

9.0.20

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.19...v9.0.20

9.0.19

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.18...v9.0.19

9.0.18

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.17...v9.0.18

9.0.17

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.15...v9.0.16

9.0.15

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.12...v9.0.13

9.0.12

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

Full Changelog: dotnet/efcore@v9.0.8...v9.0.9

Commits viewable in compare view.

Updated Jint from 4.16.3 to 4.17.0.

Release notes

Sourced from Jint's releases.

4.17.0

Jint 4.17.0 is a release from the 4.x branch. It backports correctness and conformance fixes from main (four of them for scripts that could end the host process), linear string building, and two new opt-in APIs for hosts. That is why it is a minor release rather than a patch. Nothing in it changes an existing API or an existing default, so it is a drop-in update from 4.16.4.

Highlights

A pooled engine can let go of a finished request's objects. Hosts that reuse one engine across many evaluations (CaptureGlobalSnapshot once, RestoreGlobalSnapshot between runs) keep the interpreter's warmed caches, and that is the point of reusing it. But a warmed call site remembers the last function it called, and a warmed member read remembers the last object it read from. In a pooled web host, that can be a delegate built from a finished request's services, which then stay alive until the same script runs again. The new Engine.Advanced.DiscardInterpreterCaches() drops those caches, so the objects can be collected. The engine, its intrinsics and its global object stay as they are. The next run of each script rebuilds its cache, which costs roughly what a first run on a new engine costs, minus building the engine. A good place to call it is when an engine has been idle for a while, rather than after every use (#​4229, from #​4227).

A host can carry its own state across await. Jint now runs ECMAScript's HostMakeJobCallback and HostCallJobCallback steps for every promise reaction, every thenable job and the FinalizationRegistry cleanup callback. A host can take part through the new Options.Host.JobCallbacks, which accepts a JobCallbackHooks with Capture, Enter and Exit callbacks. That lets each branch of a Promise.all fan-out keep its own host context, such as a logging scope or ambient request data, through every await (#​4231, from #​4230; issue #​4200). The default is no hooks, in which case each promise registration costs one null check and nothing a script can observe changes.

Four more ways for a script to end the host process are closed.

  • ShadowRealm. A failure crossing a ShadowRealm boundary threw its TypeError copy from inside the catch that was handling the original failure. That added a nested exception dispatch at every hop, and no stack check could see it. Even with the stack-overflow guard on, a long chain of wrapped functions ended the process on the way back out, and a three-line script with a name getter needed no chain at all. Building that copy also ran script (toString, getters, proxy traps); it no longer does. A failed importValue now reports the import failure instead of an unrelated error (#​4220, from #​4176 and #​4183).
  • instanceof and eval. instanceof now checks the native stack before calling a custom Symbol.hasInstance method, and eval checks it before parsing. A self-referencing Symbol.hasInstance, or var s = 'eval(s)'; eval(s), now raises a RangeError the script can catch instead of ending the process. On the MaxExecutionStackCount path, eval also stopped hopping to a new thread at each overflow without ever throwing. instanceof over a bound function now consults every bound link's own Symbol.hasInstance, as the specification requires (#​4221, from #​4172, #​4184 and #​4187).
  • These checks follow 4.x's existing rule. Like every other stack check on 4.x, they are active only when Options.Constraints.StackOverflowGuard is on, so turn it on for any script you do not fully trust.

Building a string with s = s + x is linear. A + whose result reaches 512 characters now produces a deferred string instead of copying both sides. Building with s = s + x, s = x + s and s = s + a + b therefore becomes linear, as s += x already was. Short concatenations take a separate path and pay nothing for this. The deferred string is safe to read from several engines that share one Prepared<Script>, and it is charged to LimitMemory when it is built, so a memory limit still bounds it. Binding an already-bound function also no longer copies its whole "bound …" name at every level (#​4160, from #​3386, #​3571, #​4130, #​4164 and #​4173).

Array.prototype.concat spreads host arrays and lists. Since 4.14, CLR arrays and lists reach script as live views by default. concat added such a view as a single element instead of spreading its items, so a.concat(b) returned the two wrappers. It now spreads anything script sees as an array (#​4219, from #​4216; issue #​4201).

TypedArray.prototype.with survives a shrinking coercion. When converting the index or the value made a resizable buffer shorter, with copied past its new end and let a CLR ArgumentException escape. It now copies only what the buffer still holds (#​4218, from #​4157).

Verification

Every backport was verified failing-first: its tests were run against the unfixed 4.x tree on .NET 10 and .NET Framework 4.7.2, then with the change. The release candidate was measured against 4.16.4 on SunSpider and Dromaeo in six paired rounds, alternating which build ran first in each round. The four Dromaeo ObjectRegExp rows ran 12–15% faster and SunSpider's 3d-raytrace 2.3% faster. No row regressed by 1% or more; the two rows whose interval did not include zero (one Dromaeo Cube variant, +0.70%, and SunSpider's controlflow-recursive, +0.88%) are within this machine's run-to-run noise.

What's Changed

Full Changelog: sebastienros/jint@v4.16.4...v4.17.0

4.16.4

Jint 4.16.4 is a maintenance release from the 4.x branch. It backports correctness and conformance fixes from main — three of them for scripts that could end the host process — together with a few measured performance improvements, and nothing in it changes an existing API or an existing default. If you are on 4.16.3 it is a drop-in update — every public signature is the one 4.16.0 shipped, on all five target frameworks, and the per-framework snapshots in Jint.Tests.PublicInterface/Verify/ are unchanged. main remains 5.0.0 development; what is coming there is recorded as it lands in docs/v5-migration.md.

Highlights

A number reads as the same double on every target framework. Before .NET 9, the runtime's ulong-to-double and string-to-double conversions double-round, and Jint inherited that: a whole-number literal in [2⁶³, 2⁶⁴) held a different double on .NET Framework and .NET 8 than on .NET 10 (#​3531); parseFloat, Number and JSON.parse mis-rounded past their integer window on .NET Framework, and JSON.parse('1e999') threw a CLR OverflowException out of the engine instead of answering Infinity (#​3535); a fraction or exponent literal could land one ULP away on .NET Framework (#​3538); and parseInt and wide radix literals now hold the Number nearest the integer they denote on every framework, with a legacy octal no longer re-read as decimal (#​3537). The string-to-number lanes and trim now accept exactly the white space the parser does — U+0085 NEL no longer counts, and a byte-order mark no longer breaks Number or BigInt (#​3542) — and an exponent scan no longer clamps at 10⁶ (#​3593). All six arrive together as #​4120, because they share one parser. This changes numeric results — to the correct ones. The literal and string-to-number fixes change answers on .NET Framework only; parseInt, radix literals, the white-space set and the exponent clamp change them on every framework.

BigInt('+12') is 12n. The decimal spelling of a StringIntegerLiteral may carry a sign, so a leading + is accepted there and only there; BigInt('+0x10') stays a SyntaxError (#​4121).

A split keeps its segments when a constraint runs script. String.prototype.split filled a thread-shared scratch list and checks constraints every 10,000 segments; a host Constraint that ran script on the same thread could clear the list an outer split was still filling, which then returned only the segments added afterwards (#​4122).

An overload is not a fit for a number it cannot hold. Overload scoring gated float, short, byte and their kin on the value fitting, but not int and long — so 3000000000 was a perfect match for an int parameter, the wider overload beside it was never tried, and the host saw a CLR OverflowException rather than a catchable JavaScript error (#​4123).

Intl's locale lookup stops paying for a culture it does not need. BestAvailableLocale resolved a CultureInfo on every truncation step even though the available-locale set answers almost every lookup by itself; it now resolves one only when the set cannot answer (#​4124).

Intl.Locale canonicalizes every Unicode extension keyword value. UTS #​35 canonicalizes a keyword's value in two halves — the CLDR bcp47 aliases, and the removal of a value of "true" — and Jint did only the first, while Intl.Locale's own tag scanner did neither. So en-u-ca-true kept its true, en-u-kb-yes kept its yes although the data aliases it to true, and en-u-ks-primary was never aliased to level1 on the tag path. The firstDayOfWeek option was read as a Number before a String and cast to int, so 0.5 resolved to "sun" where the spec rejects it, and NaN and Infinity became whatever the framework's cast made of them — which differed between .NET and .NET Framework (#​4156).

An object used as a rotating cache stops compacting forever. A property removed from an object's store leaves a tombstone, so that a re-added key keeps its creation order. Removing the newest entry already reclaimed its slot; removing the oldest — the shape of a bounded cache, a fresh name in and the oldest out — left a hole each time, and the table compacted every capacity − live additions although the live set never grew: a 16-key rotation settled on a capacity of 64 and compacted 209 times per 10,000 steps. The entries are now a window that may wrap around the array, so a removal at either end retires its slot; the same rotation never resizes and settles on 32 (#​4155).

Chains that script can make as long as it likes no longer end the process. Resolving a property through a prototype chain recursed one native frame per link, so a 20,000-deep { __proto__: x } chain overflowed the native stack on a read, a write, an in or a with lookup and ended the process — nothing thrown, nothing for a catch to see (#​4170, from #​4078; issue #​4076, reported by @​Tielem). [[Get]], [[Set]] and [[HasProperty]] now walk the chain in a loop, so an ordinary or shaped-host-prototype chain of any depth simply answers. Function.prototype.bind chains had the same shape in IsConstructor and in the realm lookup new and Reflect.construct perform, and those are loops now too (#​4169, from #​4165); on .NET Framework the JIT happened to turn both into tail calls, so the process death was a .NET 8 / .NET 10 one.

Two chains cannot be flattened, because each link has work of its own to do on the way back out: a proxy forwarding to a proxy, and host object wrappers stacked on each other (#​4170, from #​4125; issue #​4087). Those are probed instead, and raise a catchable RangeError — when Options.Constraints.StackOverflowGuard is on. On 4.x that guard remains opt-in (it becomes the default only in 5.0), so an engine left at its defaults still ends the process on a deep enough proxy chain. If you run script you do not control, turn the guard on; with it on, a 20,000-link proxy chain used as an array's constructor or as Reflect.construct's newTarget now raises RangeError where it used to end the process.

% stops allocating for numbers. The remainder operator now takes the unboxed numeric lane multiplication and division already used, so sum += i % 97 reads a numeric counter without materialising a JsNumber per step — on the benchmark's arithmetic loop, allocation per run drops from 2.87 MB to under 1 KB (#​4167, from #​4154).

Intl.Locale.prototype.getWeekInfo reads the region the specification picks. It read CLDR's week data for the tag's literal region subtag only, so a tag without one got the world's week and the -u-rg- and -u-sd- keywords were ignored. It now follows RegionPreference: a -u-rg- override, then the region subtag, then a -u-sd- subdivision's region, then the region Add Likely Subtags supplies, then 001. This changes answers — new Intl.Locale('en').getWeekInfo().firstDay is now 7 (en is likely en-US, where the week starts on Sunday) rather than 1, and en-US-u-rg-gbzzzz answers 1 rather than 7 — in each case to what the specification and every browser give (#​4168, from #​4163).

Verification

Every backport was verified failing-first: its tests were run against the unfixed 4.x tree on .NET 10 and .NET Framework 4.7.2, then with the change.

PR tests unfixed .NET Framework unfixed .NET 10 after
#​4120 (#​3531) whole-number literals, 22 15 fail 0 fail all pass
#​4120 (#​3535) string to number, 41; JsonTests, 170 22 + 8 fail 0 fail all pass
#​4120 (#​3538) fraction / exponent literals, 50 16 fail 0 fail all pass
#​4120 (#​3537) parseInt, 124; radix literals, 21 96 + 12 fail 96 + 12 fail all pass
#​4120 (#​3542) white space, 35 22 fail 22 fail all pass
#​4120 (#​3593) exponent clamp, 5 1 fail 1 fail all pass
#​4121 StringToBigInt, 46 16 fail 16 fail all pass
#​4122 constraint re-entrancy, 2 1 fail 1 fail all pass
#​4123 numeric overload range, 20 10 fail 10 fail all pass
#​4124 culture lookup count, 8 1 fail 1 fail all pass
#​4155 creation order across rotation, 53 6 fail 6 fail all pass
#​4156 Intl.Locale canonicalization, 81 30 fail 30 fail all pass
#​4167 modulo lane, 8 (semantics only) 0 fail 0 fail all pass — the lane is proven by allocation: 2,873,104 B → 784 B per run
#​4168 getWeekInfo region preference, 26; test262 getWeekInfo region files, 8 13 + 8 fail 13 + 8 fail all pass
#​4169 bound and proxy chain walks, 3 pass (JIT tail-calls) 3 end the process all pass
#​4170 deep prototype (9), shaped-prototype (8), trapless proxy (3) and wrapper (2) chain rows, plus the PlainObject census 12 end the process, 1 fails, census fails 19 end the process, census fails all pass

Release diagnostics on the tagged commit's tree (a19802dda703), in Release: Jint.Tests 7,655 (net10.0) and 7,570 (net472); Jint.Tests.PublicInterface 1,903 and 1,895; Jint.Tests.CommonScripts 28 and 28; Jint.Tests.SourceGenerators 52; the host-contract verification leg (JINT_HOST_CONTRACT_VERIFICATION=1) 7,655 / 7,570 and 1,907 / 1,899 — zero failures anywhere, and the PublicInterface surface snapshots unchanged. test262: 102,509 passed, 0 failed, 175 skipped — the 4.x control plus the eight getWeekInfo cases #​4168 un-excluded. CI passed the same tree on Linux x64, Linux ARM64, Windows, macOS and the host-contract leg.
... (truncated)

Commits viewable in compare view.

Updated MailKit from 4.18.0 to 4.18.1.

Release notes

Sourced from MailKit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Agents.AI.Abstractions from 1.22.0 to 1.24.0.

Release notes

Sourced from Microsoft.Agents.AI.Abstractions's releases.

1.24.0

Changes:

  • 245d4284a5018b7f446b5eac4d3add1fa5547229 .NET: Restore source-only release solution filter (#​9140) [ #​8537 ]
  • d0ccaa62761ec36c59c139940797978623fb630a .NET: Preserve explicit null session state across roundtrips (#​9012)
  • 279d97f75cb2e7eee885dcdc2c741ef7361ee903 .NET: Honor disabled recent search memory (#​9013)
  • 41e785fb9a3c853272ce0fbd2eb93364e9d1de13 .NET: Preserve lazy request messages through agent invocation (#​9017)
  • 9251bc9911d30f5035b4a75cd1c61f96c90f38a6 .NET: Update version for 1.24.0 release (#​9120)
  • 73a96cb1a90213dfc2b1d36e7c7250559fb28d5d .NET: Stabilize Anthropic agent package (#​9111) [ #​9110 ]
  • 0774607d8d3fa8a3f50cd5bda7b4c7ad400403f3 .NET: Reject sensitive declarative identifiers (#​9071)
  • 41c4f1c9b0242cfc3f2567db9f9c9a462982a4e7 .NET: Harden LocalCodeAct capability validation (#​9057)
See More
  • b9d24c8fb484c8330abe8bb9e7500ca3c3bbf46c .NET: test: add loopback destination regression coverage (#​9064)
  • bd5ab48cfdebb49b9223de0fc75c7141641927f3 .NET: Validate handoff request lifecycle before routing (#​8855)
  • 636e8562d1db4e678e0bb88f602e0bbc7318f6a4 .NET: Synchronize background task metadata and defer publication until session creation (#​8933)
  • 6ef0b73ed8ee5ae9a5cdc709edc5bfc9443d91cb .NET: Isolate GitHub Copilot attachment staging (#​8846)
  • 52fed574f05aa4c22ae4cc024679d501ec5f327a .NET: Preserve atomic cache creation across factory failures (#​8931)
  • a2f4506c0ba30cea7c9bbe907fc158c0db2cc6a3 .NET: Skip empty Foundry memory context messages (#​8932)
  • 501989469265894443ba0812264397aec986e4cd Improve MCP skill archive loading consistency (#​8937)
  • 2e8b58c06da252755c892963053f4e6b7a9417fc .NET: Return only the items between 'after' and 'before' when listing response input items (#​8872) [ #​8871 ]
  • a15c0197b2823f1197d3dc37f3411ffb0ba3cc15 .NET: document A2A authentication and tool authorization (#​8491)
  • d52db94e4b617e6fc76a13189b78d30546062481 .NET: Reject a MaxBatchSize outside 1..100 in CosmosChatHistoryProvider (#​8870) [ #​8869 ]
  • 99215f96dafa0e24491dcbc015d013f649a2b066 .NET: Update retired Claude model in 04_MultiModelService sample (#​8879) [ #​5074, #​8878 ]
  • 7634356a1de0fd5de287544113c34d32afeeba83 .NET: Fix Foundry MCP approval replay IDs (#​8873)
  • 2f5713f60e6e3036e2c21bf01068602ca1fa3a2e .NET: Preserve A2A run errors when session save fails (#​8877)
  • 2a7470a92c9bc5afb9581ccb90008f41c92a1a6a .NET: Publish synthetic terminal responses with their events (#​8885)
  • e23f3c89f29eed39ad921c21acc697a20fe066cd .NET: Validate HTTP header delimiters (#​8847)
  • 5343347312795ef589c8d8047326eb1b6ef3aa3c .NET: Allow compaction for per-service-call local chat history (#​8845)
  • 71e84a098dec7f4d4c2273759fb2ce5914419b91 .NET: Propagate ChatHistoryMemoryProvider caller cancellation (#​8813)
  • e626cef6c9536536d4dd8796ea7f1914af49596e .NET: Bind MCP approval headers to approved invocation (#​8834)
  • ba320332d496783c953246c00852f078e7594ea3 .NET: Reject protected values in declarative MCP invocations (#​8832)
  • 77f832ff1ac915ed3c4a1bddb12e43cb9aec0c86 .NET: fix(harness): honor cancellation while waiting for background agents (#​8805)
  • 202e85d0d8767180e24b5ef19e43f712a19e1953 .NET: Remove unused GitTag property (#​8827)
  • 763887452f371d8d03a67993ec7adcd95a0e18c2 .NET: Dispose AI context streaming enumerators (#​8812)
  • 7a98aa9f3c2136ce012e552f62286d7225b2f910 .NET: Honor a zero message limit in ValkeyChatHistoryProvider (#​8809)
  • 06e9b48937d5f6c46da8f89817e51364a10cfb19 .NET: Python: Add optional OAuth consent origin allowlist to Foundry hosting (#​8713)

This list of changes was auto generated.

1.23.0

Changes:

  • be01deccaf3dd7b85e03620145bc1a757c857827 .NET: Add origin pinning to Foundry toolbox MCP client (#​8721)
  • 0d6d2bb6b0b58f3aabdf170320ab90fc300d4c99 .NET: fix: declarative workflow http variables (#​8797)
  • 2024d4df4c4dd01b904fb9daaf56f5759801654a .NET: Fix workflow topology edge multiplicity comparison (#​8656)
  • 37ce872a85fed62cedfd7fffa2e0bd43f7d32b92 .NET: Store created external input messages (#​8606)
  • 1370903bd8e6eb8871781cd1fcc74f674c022e0b .NET: [BREAKING] Better support tool changes between runs (#​8754)
See More
  • 3f1f3b50b57ccabe7725f8a60539622d5f1ca7b4 .NET: Propagate TextSearchProvider caller cancellation (#​8796)
  • 238d7e2e9bb9b469be172460e612c89840aad1cc .NET: Validate Foundry client headers before transport (#​8715)
  • c804f32c983df56bacc9a8698fde9d50edc2df3e .NET: [BREAKING] Bump Azure.AI.Projects to 3.0.0-beta.3, OpenAI to 2.14.0, and MEAI to 10.10.1 (#​8730) [ dotnet/extensions#​7760, dotnet/extensions#​7761 ]
  • 93cf98a042c0f4eb8e1e180beeab9474bcd96811 .NET: Update AGUI SDK packages to 1.0.0 (#​8769)
  • 109234952ad417b0e9368beed633e438eb2e389d Clarify CodeAct guest packages and host network access (#​8781)
  • 6f1522a50b66f117da34cc25ea299ba24a528b15 Temporarily skip OpenAI integration tests while the CI API key is invalid (#​8767)
  • 2c46deb91e70ea6d7bbc99263147e0f470d52546 .NET: Clarify hosting authentication, authorization, and isolation guidance (#​8677)
  • 024dd9908bc19fa42f070cfaf7c3775c2b17f09b .NET/Python: Improve MCP skill resource validation (#​8690)
  • 8ff549d3f7219bac0a405621616ed72090ba13b9 .NET: Correct InvokeAzureAgent response output (#​8605)
  • 5ee3e87d6768eadb7c4cf91507659a6069850692 .NET: Remove redundant NuGet configuration (#​8719)
  • 622737258c73f730adca5130b7b82fbc03ff8838 Set better expecations for contributors (#​8706)
  • 30b9b8e06766b2038e366d32979357c2fc4b9def .NET: Only consume stored approval state when the run succeeds (#​8692)
  • 834eb7ff12c83aadee56d468e3b01b4f0fc4084c fix(dotnet): persist function results as user messages (#​8655)
  • 0bbb7245d408b6b7209eca58609ca53a52a66cec .NET: [BREAKING] fix: use allow list for configuration keys (#​8200)
  • a638ce136ed6e0457877373b0e377e1f1d33277d .NET: Fix forwarded request-port type validation (#​8657)
  • 76ccf3c44cee748aa582c446a7218f91289f2aac fix(dotnet): forward declarative Azure agent version (#​8658)
  • 11b8b80a2c904a36603c4445df5ddb07a55e6817 Use review App permissions for repair reactions (#​8669)
  • 74e8fe6da942ee991819ea861de1841243d7c0e1 Use the workflow token for fix-ci evidence (#​8667)
  • 173978ee93e0ffa5ef4ebdbfe2e94cd6f8e8a996 .NET: Add function replace support for function middleware (#​8615)
  • bf93c539d247a9df6f66055b711a3015438c8dce .NET: [BREAKING] Enforce approval response binding consistently (#​8641)
  • 646e116a4099a6dc0f689ff2dd8b41b31ba2bdae .NET: [BREAKING] Fix DevUI approval continuation (#​8423) [ #​6006 ]
  • 925f4f2c6c494eba2779f7f79de1ca95958f6d8a .NET: ci/dotnet vscode configuration (#​8537)
  • ec7114ffc8656a9b5c56be252f0411d22887c896 .NET: fix: a bug where invoke function tool could bypass approval (#​8403)
  • c5a8c8d37d7cf15b493fb838084f4954be6b0223 fix(core): distinguish absent tool call arguments from parse failures (#​8609)
  • 17b349f2150d5b90649998a32a067db07319649a docs(core): fix positional invocations in detect_media_type_from_base64 docstrings (#​8614)
  • eb74c8cceba97bc037413dcf25cfcf1aeab77634 fix(core): ensure add_usage_details returns copies and filters non-ints consistently (#​8613)
  • 02bd1ba1de43ca8d1206a5c61e86ffc0d6f44b12 fix(ag-ui): allow text events when response_format is a json schema dictionary (#​8604)
  • 7b626709dbce2c170030c388cea9e611738e5be5 ci: removes workflow based PR limit to use GitHub native feature (#​8603)
  • bb53fe15a8375426a98763bd43eed64762af3f07 test(ollama): narrow pytest.raises blocks to wrap only get_response in error tests (#​8611)
  • 894b0f6f0bd2d59202ef04d5898302e05cbb7264 samples: add McpDocsResearch declarative workflow showcasing agent-level MCP pattern (#​6054)
  • 42c22c001761340f47b279e89a4e06aedb5549d9 Bump GitHub.Copilot.SDK to 1.0.1 and forward session config properties (incl. per-session GitHubToken) (#​5735) [ #​6381 ]

This list of changes was auto generated.

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 7.1.0 to 7.1.1.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.1.1

This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.

Package version alignment: The SqlClient family packages share the 7.1.1 version:

  • Microsoft.Data.SqlClient
  • Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
  • Microsoft.Data.SqlClient.Extensions.Azure
  • Microsoft.Data.SqlClient.Extensions.Abstractions
  • Microsoft.Data.SqlClient.Internal.Logging

Microsoft.SqlServer.Server is versioned independently and is not part of this release. Applications should use matching 7.1.1 ve...

_Descript...

Description has been truncated

@dependabot
Bump the nuget-minor-patch group with 29 updates
5895dd0 
Bumps AngleSharp from 1.8.2 to 1.8.4
Bumps Aspire.Hosting from 13.5.4 to 13.6.1
Bumps AWSSDK.SecretsManager from 4.0.100.14 to 4.0.100.16
Bumps Azure.Security.KeyVault.Secrets from 4.11.1 to 4.11.2
Bumps Discord.Net from 3.20.1 to 3.20.2
Bumps dotnet-ef from 9.0.7 to 9.0.20
Bumps Jint from 4.16.3 to 4.17.0
Bumps MailKit from 4.18.0 to 4.18.1
Bumps Microsoft.Agents.AI.Abstractions from 1.22.0 to 1.24.0
Bumps Microsoft.Data.SqlClient from 7.1.0 to 7.1.1
Bumps Microsoft.Extensions.AI.Abstractions from 10.10.0 to 10.10.1
Bumps Microsoft.Extensions.AI.OpenAI from 10.10.0 to 10.10.1
Bumps Microsoft.ML.OnnxRuntime from 1.30.0 to 1.31.0
Bumps OpenTelemetry from 1.19.0 to 1.19.1
Bumps OpenTelemetry.Api from 1.19.0 to 1.19.1
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.19.0 to 1.19.1
Bumps OpenTelemetry.Extensions.Hosting from 1.19.0 to 1.19.1
Bumps SharpCompress from 0.50.4 to 0.50.5
Bumps StackExchange.Redis from 3.3.0 to 3.4.0
Bumps Testcontainers from 4.15.0 to 4.16.0
Bumps Testcontainers.MariaDb from 4.15.0 to 4.16.0
Bumps Testcontainers.MongoDb from 4.15.0 to 4.16.0
Bumps Testcontainers.MsSql from 4.15.0 to 4.16.0
Bumps Testcontainers.MySql from 4.15.0 to 4.16.0
Bumps Testcontainers.PostgreSql from 4.15.0 to 4.16.0
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1
Bumps xunit.v3 from 4.0.1 to 4.0.2
Bumps xunit.v3.assert from 4.0.1 to 4.0.2
Bumps xunit.v3.extensibility.core from 4.0.1 to 4.0.2

---
updated-dependencies:
- dependency-name: AngleSharp
  dependency-version: 1.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting
  dependency-version: 13.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: AWSSDK.SecretsManager
  dependency-version: 4.0.100.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Azure.Security.KeyVault.Secrets
  dependency-version: 4.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Discord.Net
  dependency-version: 3.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: dotnet-ef
  dependency-version: 9.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Jint
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: MailKit
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Agents.AI.Abstractions
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Data.SqlClient
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.AI.OpenAI
  dependency-version: 10.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.ML.OnnxRuntime
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Api
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: SharpCompress
  dependency-version: 0.50.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: StackExchange.Redis
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers.MariaDb
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers.MongoDb
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers.MsSql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers.MySql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers.PostgreSql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3.assert
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3.extensibility.core
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the .NET Pull requests that update .NET code label Oct 12, 2026
@dependabot
dependabot Bot requested a review from arion-orkeon as a code owner October 12, 2026 16:31
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Oct 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arion-orkeon arion-orkeon Awaiting requested review from arion-orkeon arion-orkeon is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

0 participants