Skip to content

Bump the nuget group with 4 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-c5e4b7e2b7
Open

Bump the nuget group with 4 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-c5e4b7e2b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown

Updated coverlet.collector from 6.0.4 to 10.1.0.

Release notes

Sourced from coverlet.collector's releases.

10.1.0

Improvements

  • Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #​2019
  • Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #​1946
  • Replace legacy .sln files with modern .slnx format #​1966
  • coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #​2005
  • Relax auto-property skip logic and improve coverage for records #​1941

Fixed

  • Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #​1980 #​1967
  • Fix Regression in branch coverage for lambda expressions #​1938
  • Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #​1979
  • Fix silent zero coverage on .NET Framework since 8.0.0 #​1985 by @​tobiwae
  • Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #​1987 #​1988 by @​bkoelman
  • Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #​2010
  • Fix use --config-file CLI arg in coverlet.MTP #​2030 by alexthornton1
  • Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #​2032 by @​Eljees

Diff between 10.0.1 and 10.1.0

10.0.1

Improvements

Fixed

  • Fix inconsistent paths in cobertura reports #​1723
  • Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #​1313
  • Fix Coverlet flagging a branch for an async functions finally block where none exists #​1337
  • Fix Coverlet Tracker Missing CompilerGeneratedAttribute #​1828

Maintenance

  • Add architecture docs and diagrams for all integrations #​1927
  • Update NuGet packages and .NET SDK versions #​1933

Diff between 10.0.0 and 10.0.1

10.0.0

Improvements

  • Unique Report Filenames (coverlet.MTP and AzDO) #​1866
  • Add --coverlet-file-prefix option for unique report files #​1869
  • Introduce .NET 10 support #​1823

Fixed

  • Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
  • Fix [BUG] Missing Coverage after moving to MTP #​1843
  • Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
  • Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
  • Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
  • Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
  • Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

  • Add comprehensive async method tests and documentation for issue #​1864
  • Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
  • Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

8.0.1

Fixed

  • Fix [BUG] TypeInitializationException when targeting .NET Framework #​1818
  • Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true #​1827

Improvements

  • Additional improvements needed for .NET Framework instrumentation type import #​1825

Diff between 8.0.0 and 8.0.1

8.0.0

Special Thanks: A huge thank you to @​Bertk for driving the majority of the work in this release! 🎉

Fixed

Improvements

  • Coverlet MTP extension feature #​1788
  • Generate SBOM for nuget packages #​1752
  • Use multi targets projects for coverlet.collector, coverlet.msbuild.tasks packages #​1742
  • Use .NET 8.0 target framework for coverlet.core and remove Newtonsoft.Json #​1733
  • Use latest System.CommandLine version #​1660
  • Upgraded minimum required .NET SDK and runtime to .NET 8.0 LTS (Long Term Support) (Breaking Change)
  • Use xunit.v3 for tests and example code

Diff between 6.0.4 and 8.0.0

Commits viewable in compare view.

Updated cyclonedx from 6.1.1 to 6.3.1.

Release notes

Sourced from cyclonedx's releases.

6.3.1

Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#​1139, #​1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @​wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0

Added

  • NuGet purls for project references (#​1137, fixes #​1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

  • Development dependency scopes (#​1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
  • --exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

  • Assembly-name resolution (#​1128, fixes #​917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
  • Exclusion filtering (#​1135, fixes #​1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
  • Target-framework regression coverage (#​1131, fixes #​1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

  • @​MichaelKopfMkf — NuGet purls for project references (#​1137, #​1136).
  • @​mtsfoni — development dependency scopes and compatible exclusion behavior (#​1138).
  • @​uo-uhbc — exclusion-filter orphan handling fix and reproduction (#​1135, #​1133).
  • @​mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#​1131).
  • @​Eljees — root-namespace assembly-name resolution fix (#​1128).
  • @​TobiDimmel — reported the assembly-name property resolution issue (#​917).
  • @​jasonlhills — reported the exclusion-filter failure (#​1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

  • @​MichaelKopfMkf made their first contribution in #​1137.
  • @​mgnslndh made their first contribution in #​1131.
  • @​Eljees made their first contribution in #​1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1

CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

  • Resolve dependency ranges with multiple matching package versions (#​1113, fixes #​1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
  • Fix hash computation for uncached NuGet packages (#​1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

  • Update .NET dependencies and CI tooling.
  • Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

  • Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

  • @​LukasChristel — fix hash computation for uncached NuGet packages (#​1099).
  • @​michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#​1110).
  • @​mtsfoni — dependency range resolution fix and regression coverage (#​1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

6.2.0

Added

  • `--configuration` / `-c` CLI option (#​1056, fixes #​1028) — passes `-p:Configuration=` to `dotnet restore` so MSBuild evaluates conditional `PackageReference` items during restore. Configuration-specific packages (e.g. debug-only `Avalonia.Diagnostics`) are no longer included in the SBOM when a Release configuration is requested.
  • NuGet license file support (#​1011, #​1002) — packages declaring `` now have their license file embedded as base64-encoded text in the BOM when `--include-license-text` is specified; without the flag the license is still detected but not embedded

Fixed

  • Suppress `aka.ms/deprecateLicenseUrl` stub URL (#​1011) — NuGet auto-injects `https://aka.ms/deprecateLicenseUrl\` into `` for packages packed with ``; this URL is now correctly ignored rather than being emitted as a license entry in the BOM
  • Fix null-URL license stub (#​1011) — packages with no `` no longer produce a spurious `License { Name="Unknown - See URL", Url=null }` node in the BOM
  • Fix `UNLICENSED` emitted as SPDX id (#​1004, fixes #​915) — `UNLICENSED` is a NuGet-specific token that is not a valid SPDX identifier; it is now emitted as `license.name` instead of `license.id` to keep BOM output valid

Changed

  • Upgrade CycloneDX.Core from 12.0.1 to 12.1.1 (#​1084)
  • Bump System.CommandLine from 2.0.0 to 2.0.5 (#​1083)

Contributors

Thanks to everyone who contributed to this release:

  • @​mus65 — NuGet license file support (#​1011)
  • @​jainlakshya — UNLICENSED license expression handling (#​1004, fixes #​915)
  • @​trivalik — requested NuGet license file support (#​1002)
  • @​alexandrehtrb — reported the conditional compilation issue that led to the `--configuration` flag (#​1028)
  • @​south11235 — reported the UNLICENSED invalid BOM issue (#​915)

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.BannedApiAnalyzers from 3.3.4 to 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.BannedApiAnalyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

5.0.1

Release Notes
Install Instructions

Repo

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

3.10.0-3.21201.20

Release

3.10.0-2.21153.36

Release

3.10.0-1.21102.26

Release

3.7.0-3.20312.3

Release Notes
Install Instructions

Repos

3.7.0-3.20269.11

Release Notes
Install Instructions

Repos

3.7.0-2.20277.1

Release Notes
Install Instructions

Repos

3.6.0

Release Notes
Install Instructions

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget group with 4 updates
78b820b 
Bumps coverlet.collector from 6.0.4 to 10.1.0
Bumps cyclonedx from 6.1.1 to 6.3.1
Bumps Microsoft.CodeAnalysis.BannedApiAnalyzers from 3.3.4 to 5.6.0
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.10.0 to 10.11.0

---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: cyclonedx
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.BannedApiAnalyzers
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: cyclonedx
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.BannedApiAnalyzers
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from PinnerSinner as a code owner October 18, 2026 01:20
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Oct 18, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PinnerSinner PinnerSinner Awaiting requested review from PinnerSinner PinnerSinner is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants