Skip to content

Bump the dependencies group with 10 updates#928

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dependencies-1db5a380b7
Closed

Bump the dependencies group with 10 updates#928
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dependencies-1db5a380b7

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 29, 2026

Updated Elastic.Clients.Elasticsearch from 9.3.4 to 9.4.1.

Release notes

Sourced from Elastic.Clients.Elasticsearch's releases.

9.4.1

What's Changed

  • Regenerate client by @​flobernd in [9.4] Regenerate client elastic/elasticsearch-net#8899 and [9.4] Regenerate client elastic/elasticsearch-net#8907
    • Fixes (de-)serialization of unions with three or more variants — previously, hand-rolled union converters could fail to select the correct variant
    • Search response shape fix in InnerHits: the Fields property is split into Field (single-field selector using Fields) and a new Fields collection of FieldAndFormat — existing usages of InnerHits.Fields = … may need to be retargeted to Field
    • DataStreamLifecycle gains EffectiveRetention and RetentionDeterminedBy; new GlobalRetention and RetentionSource types; GetDataLifecycleResponse now exposes GlobalRetention
    • Reindex rethrottle response now models parent task progress via the new ParentReindexStatus type
    • Inference and _mvt content-type alignment: chat_completion_unified / stream_completion send Content-Type: application/json; _mvt uses the versioned application/vnd.elasticsearch+vnd.mapbox-vector-tile Accept header

Full Changelog: elastic/elasticsearch-net@9.4.0...9.4.1

9.4.0

What's Changed

Initial 9.4.x release.

Full Changelog: elastic/elasticsearch-net@9.3.7...9.4.0

9.3.7

What's Changed

  • Regenerate client by @​flobernd in [9.3] Regenerate client elastic/elasticsearch-net#8898
    • Set explicit ContentType: application/json for ChatCompletionUnified and StreamCompletion streaming inference requests
    • Switch SearchMvt Accept header to application/vnd.elasticsearch+vnd.mapbox-vector-tile (Elasticsearch product-flavored content-type)
    • Bump Elastic.Transport to 0.17.1
    • Document default max_page_search_size values for pivot (500) and latest (5000) transforms

Full Changelog: elastic/elasticsearch-net@9.3.6...9.3.7

9.3.6

What's Changed

Full Changelog: elastic/elasticsearch-net@9.3.5...9.3.6

9.3.5

What's Changed

Full Changelog: elastic/elasticsearch-net@9.3.4...9.3.5

Commits viewable in compare view.

Updated log4net from 3.3.0 to 3.3.1.

Release notes

Sourced from log4net's releases.

3.3.1

What's Changed

New Contributors

Full Changelog: apache/logging-log4net@rel/3.3.0...rel/3.3.1
Nuget: https://www.nuget.org/packages/log4net/3.3.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.5.1 to 18.6.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.6.0

What's Changed

Changes to tests and infra

Commits viewable in compare view.

Updated RabbitMQ.Client from 6.8.1 to 7.2.1.

Release notes

Sourced from RabbitMQ.Client's releases.

7.2.1

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.2.0...v7.2.1

7.2.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.2...v7.2.0

7.1.2

GitHub milestone

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.1...v7.1.2

7.1.1

GitHub milestone

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.1.0...v7.1.1

7.1.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0

7.1.0-alpha.1

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0-alpha.1

7.1.0-alpha.0

GitHub milestone

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0...v7.1.0-alpha.0

7.0.0

GitHub milestone for RabbitMQ.Client version 7.0.0

What's Changed

7.0.0-rc.14

This is release candidate 14, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.13...v7.0.0-rc.14

7.0.0-rc.13

This is release candidate 13, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.12...v7.0.0-rc.13

7.0.0-rc.12

This is release candidate 12, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.11...v7.0.0-rc.12

7.0.0-rc.11

This is release candidate 11, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.10...v7.0.0-rc.11

7.0.0-rc.10

This is release candidate 10, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.9...v7.0.0-rc.10

7.0.0-rc.9

This is release candidate 9, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.8...v7.0.0-rc.9

7.0.0-rc.8

This is release candidate 8, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.7...v7.0.0-rc.8

7.0.0-rc.7

This is release candidate 7, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.6...v7.0.0-rc.7

7.0.0-rc.6

This is release candidate 6, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.5...v7.0.0-rc.6

7.0.0-rc.5

This is release candidate 5, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.4...v7.0.0-rc.5

7.0.0-rc.4

This is release candidate 4, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.3...v7.0.0-rc.4

7.0.0-rc.3

This is release candidate 3, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-rc.2...v7.0.0-rc.3

7.0.0-rc.2

This is release candidate 2, suitable for testing in pre-production environments

What's Changed

New Contributors

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.6...v7.0.0-rc.2

7.0.0-rc.1

This is release candidate 1, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.6...v7.0.0-rc.1

7.0.0-alpha.6

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.5...v7.0.0-alpha.6

7.0.0-alpha.5

This is an early alpha release, suitable for testing in pre-production environments

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.4...v7.0.0-alpha.5

7.0.0-alpha.4

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.3...v7.0.0-alpha.4

7.0.0-alpha.3

This is an early alpha release, suitable for testing in pre-production environments

What's Changed

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.2...v7.0.0-alpha.3

7.0.0-alpha.2

What's Changed

This is an early alpha release, suitable for testing in pre-production environments. This release fixes a stack overflow error in ExchangeDeclareAsync that was reported several times:

Other fixes:

Full Changelog: rabbitmq/rabbitmq-dotnet-client@v7.0.0-alpha.1...v7.0.0-alpha.2

7.0.0-alpha.1

GitHub Milestone

This alpha release includes changes from #​1347, which adds async methods to the public API, and is appropriate to test in your pre-production environments.

7.0.0-alpha.0

This is a very early pre-release of version 7. The goal is to test publishing the NuGet package from GitHub Actions.

https://www.nuget.org/packages/RabbitMQ.Client/7.0.0-alpha.0

Commits viewable in compare view.

Updated SonarAnalyzer.CSharp from 10.22.0.136894 to 10.27.0.140913.

Release notes

Sourced from SonarAnalyzer.CSharp's releases.

10.27.0.140913

Release notes - .NET Analyzers - 10.27

Feature

NET-1285 S2629: Add custom message for Log4Net and Castle.Core
NET-3666 Deprecate S5042 and move it from HotSpots to Code Smell
NET-3783 Update RSPEC before 10.27 release

False Positive

NET-2696 Fix S4260 FP: Extension Properties always raise

False Negative

NET-230 Fix S4056 FN: SpecifyIFormatProviderOrCultureInfo for C#​13 compatibility
NET-2692 Fix S2190 FN: Recursive extension properties
NET-2705 Fix S3343 FN: Partial Constructor with attribute in definition
NET-2732 Fix S1172 FN: Extension blocks
NET-2745 Fix S4144 FN: Extension Members
NET-2829 Fix S3241 FN: Extension methods and extension blocks
NET-3541 Fix S1117 FN: add CatchDeclaration coverage and adopt LocalDeclarationKinds

10.26.0.140279

Release notes - .NET Analyzers - 10.26

Feature

NET-3694 Update RSPEC before 10.26 release

False Positive

NET-2346 Fix S1854 FP: Variable used after another assignment in finally
NET-2347 Fix S1168 FP: Do not report on value types
NET-3698 Fix S1210 FP: file-scoped types should be exempt

False Negative

NET-1265 Fix S2930 FN: raise issues on non-disposed RegistryKeys
NET-2685 Fix S3604 FN: Field Keyword, Partial Constructors, NullConditional Assignment
NET-2812 Fix S4275 FN: Field Keyword
NET-2999 Fix S6672 FN: Mismatch in primary constructor is not recognized

10.25

?

Feature

  • NET-3613 - Support Cobertura coverage file format
    • Cobertura report paths can be passed via the sonar.cs.cobertura.reportsPaths parameter
  • NET-3665 - Update RSPEC before 10.25 release

False Positive

  • NET-3640 - Fix S3400 FP: Don't report function with conditional compilation body

10.24

 This release brings a batch of false negative fixes and analyzer crash fixes.

Bug Fixes

  • NET-3596 - Fix S1144 AD0001: Index out of range exception with type named Nullable
  • NET-3522 - Fix S1215 AD0001: ArgumentOutOfRangeException
  • NET-3521 - Fix S2053 AD0001: NRE
  • NET-3520 - Fix S3267 AD0001: NRE

False Positives

  • NET-2276 - Fix S1192 FP: EF migration classes

False Negatives

  • NET-3569 - Fix T0008 and T0009 FN: Support extension blocks
  • NET-2875 - Fix S2092 FN: Null Conditional Assignment
  • NET-2857 - Fix S3330 FN: Null Conditional Assignment
  • NET-2719 - Fix S4136 FN: Extension methods
  • NET-2688 - Fix S4433 FN: Null-conditional assignment in tracker
  • NET-2675 - Fix S6418 FN: Field keyword
  • NET-2667 - Fix S2934 FN: Null-conditional assignment and field keyword
  • NET-2658 - Fix S127 FN: BitShiftCompound

10.23

This release brings a bunch of fixes! Enjoy.

Bug Fixes

  • NET-3557 - Fix SE AD0001 when SyntaxTreeOptionsProvider is null
  • NET-3519 - Fix AD0001: NRE in PropertiesAccessCorrectField

False Positives

  • NET-3532 - Fix S2583 FP: Any called two times
  • NET-3468 - Fix S1144 FP: Erroneously flagged Add() method used in Collection Initializer
  • NET-3454 - Fix S3267 FP: ref struct in foreach body cannot be captured in LINQ lambda
  • NET-3164 - Fix S125 FP: Improve semicolon heuristic
  • NET-2559 - Fix S5944 FP: When method name is also a class name of generic argument
  • NET-2438 - Fix S1067 FP: Do not raise an issue inside Equals() implementation
  • NET-1565 - Fix S1192 FP: Shouldn't raise on Dapper parameters
  • NET-1168 - Fix S1172 FP: When parameter conditionally used in local function
  • NET-52 - Fix S4017 FP: Do not raise when implementing abstract class/interface

False Negatives

  • NET-1642 - Fix S3415, S2701, S2699, S2187 FN: Support NUnit 4.0
  • NET-348 - Fix S4144 FN: Methods with generic return types

Commits viewable in compare view.

Updated StackExchange.Redis from 2.12.14 to 2.13.17.

Release notes

Sourced from StackExchange.Redis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Diagnostics.EventLog from 10.0.5 to 10.0.8.

Release notes

Sourced from System.Diagnostics.EventLog's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Security.Permissions from 10.0.3 to 10.0.8.

Release notes

Sourced from System.Security.Permissions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Text.Encoding.CodePages from 10.0.5 to 10.0.8.

Release notes

Sourced from System.Text.Encoding.CodePages's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Text.Json from 10.0.5 to 10.0.8.

Release notes

Sourced from System.Text.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 10 updates
e5b8558 
Bumps Elastic.Clients.Elasticsearch from 9.3.4 to 9.4.1
Bumps log4net from 3.3.0 to 3.3.1
Bumps Microsoft.NET.Test.Sdk from 18.5.1 to 18.6.0
Bumps RabbitMQ.Client from 6.8.1 to 7.2.1
Bumps SonarAnalyzer.CSharp from 10.22.0.136894 to 10.27.0.140913
Bumps StackExchange.Redis from 2.12.14 to 2.13.17
Bumps System.Diagnostics.EventLog from 10.0.5 to 10.0.8
Bumps System.Security.Permissions from 10.0.3 to 10.0.8
Bumps System.Text.Encoding.CodePages from 10.0.5 to 10.0.8
Bumps System.Text.Json from 10.0.5 to 10.0.8

---
updated-dependencies:
- dependency-name: Elastic.Clients.Elasticsearch
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: log4net
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: RabbitMQ.Client
  dependency-version: 7.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.27.0.140913
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: StackExchange.Redis
  dependency-version: 2.13.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: System.Diagnostics.EventLog
  dependency-version: 10.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Security.Permissions
  dependency-version: 10.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Text.Encoding.CodePages
  dependency-version: 10.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: System.Text.Json
  dependency-version: 10.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file nuget packages labels May 29, 2026
@dependabot dependabot Bot mentioned this pull request May 29, 2026
Closed
@github-actions github-actions Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label May 29, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 29, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednuget/​system.text.json@​10.0.5 ⏵ 10.0.8401009010070
Updatednuget/​sonaranalyzer.csharp@​10.22.0.136894 ⏵ 10.27.0.14091399 -11009010070
Updatednuget/​system.text.encoding.codepages@​10.0.5 ⏵ 10.0.8961009010070
Updatednuget/​system.diagnostics.eventlog@​10.0.5 ⏵ 10.0.8941009010070
Updatednuget/​system.security.permissions@​10.0.3 ⏵ 10.0.896 -41009010070
Updatednuget/​elastic.clients.elasticsearch@​9.3.4 ⏵ 9.4.110010090100100
Updatednuget/​log4net@​3.3.0 ⏵ 3.3.19810090100100
Updatednuget/​rabbitmq.client@​6.8.1 ⏵ 7.2.1981009010090
Updatednuget/​stackexchange.redis@​2.12.14 ⏵ 2.13.179210090100100
Updatednuget/​microsoft.net.test.sdk@​18.5.1 ⏵ 18.6.010010090100100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 29, 2026

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Dynamic code execution: nuget elastic.esql

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csproj → nuget/elastic.clients.elasticsearch@9.4.1 → nuget/elastic.esql@0.11.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.esql@0.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget elastic.transport

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csproj → nuget/elastic.clients.elasticsearch@9.4.1 → nuget/elastic.transport@0.17.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.transport@0.17.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget elastic.transport

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csproj → nuget/elastic.clients.elasticsearch@9.4.1 → nuget/elastic.transport@0.17.1

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.transport@0.17.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csproj → nuget/sonaranalyzer.csharp@10.27.0.140913

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.27.0.140913. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csproj → nuget/sonaranalyzer.csharp@10.27.0.140913

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.27.0.140913. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csproj → nuget/sonaranalyzer.csharp@10.27.0.140913

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.27.0.140913. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget system.threading.ratelimiting

Location: Package overview

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/system.threading.ratelimiting@8.0.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.ratelimiting@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget system.threading.ratelimiting

Location: Package overview

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/system.threading.ratelimiting@8.0.0

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.ratelimiting@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget system.windows.extensions

Location: Package overview

From: Src/CrispyWaffle/CrispyWaffle.csproj → nuget/system.security.permissions@10.0.8 → nuget/system.windows.extensions@10.0.8

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget system.windows.extensions

Location: Package overview

From: Src/CrispyWaffle/CrispyWaffle.csproj → nuget/system.security.permissions@10.0.8 → nuget/system.windows.extensions@10.0.8

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget system.windows.extensions

Location: Package overview

From: Src/CrispyWaffle/CrispyWaffle.csproj → nuget/system.security.permissions@10.0.8 → nuget/system.windows.extensions@10.0.8

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: nuget elastic.esql

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csproj → nuget/elastic.clients.elasticsearch@9.4.1 → nuget/elastic.esql@0.11.0

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.esql@0.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: nuget elastic.transport

Location: Package overview

From: Src/CrispyWaffle.ElasticSearch/CrispyWaffle.ElasticSearch.csproj → nuget/elastic.clients.elasticsearch@9.4.1 → nuget/elastic.transport@0.17.1

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/elastic.transport@0.17.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): nuget microsoft.bcl.asyncinterfaces is 100.0% likely to have a medium risk anomaly

Notes: The fragment is not conventional executable source code; it is a binary-like payload rich in signing-related data (certificates, OCSP/CRL references) with references to NuGet/Microsoft ecosystems. This necessitates provenance verification and strict supply-chain validation to prevent misuse or tampering in a package delivery context. Further context about how this artifact is consumed is required to determine actual risk in a given project.

Confidence: 1.00

Severity: 0.60

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/microsoft.bcl.asyncinterfaces@8.0.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.bcl.asyncinterfaces@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: nuget sonaranalyzer.csharp

Location: Package overview

From: Src/CrispyWaffle.Configuration/CrispyWaffle.Configuration.csproj → nuget/sonaranalyzer.csharp@10.27.0.140913

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/sonaranalyzer.csharp@10.27.0.140913. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): nuget system.io.pipelines is 100.0% likely to have a medium risk anomaly

Notes: This is a .p7s file, which contains a digital signature for a document or email, using the PKCS #7 standard, which serves to verify the sender's identity and ensure the content hasn't been altered in transit.

Confidence: 1.00

Severity: 0.60

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/stackexchange.redis@2.13.17 → nuget/system.io.pipelines@8.0.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.io.pipelines@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
License exception: nuget system.threading.channels with Classpath-exception-2.0

Exception: Classpath-exception-2.0

Comments:

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/system.threading.channels@8.0.0

ℹ Read more on: This package | This alert | What is a license exception?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: License exceptions should be carefully reviewed.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.channels@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
License exception: nuget system.threading.ratelimiting with Classpath-exception-2.0

Exception: Classpath-exception-2.0

Comments:

From: Src/CrispyWaffle.RabbitMQ/CrispyWaffle.RabbitMQ.csproj → nuget/rabbitmq.client@7.2.1 → nuget/system.threading.ratelimiting@8.0.0

ℹ Read more on: This package | This alert | What is a license exception?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: License exceptions should be carefully reviewed.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.threading.ratelimiting@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: nuget system.windows.extensions

Location: Package overview

From: Src/CrispyWaffle/CrispyWaffle.csproj → nuget/system.security.permissions@10.0.8 → nuget/system.windows.extensions@10.0.8

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.windows.extensions@10.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 29, 2026

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs 
2026-05-29T18:37:37Z INF scanning for exposed secrets...
6:37PM INF 801 commits scanned.
2026-05-29T18:37:39Z INF scan completed in 1.13s
2026-05-29T18:37:39Z INF no leaks found

@guibranco guibranco enabled auto-merge (squash) June 2, 2026 15:46
@gstraccini gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Jun 2, 2026
guibranco
guibranco approved these changes Jun 4, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@guibranco guibranco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by gstraccini[bot]

@gstraccini gstraccini Bot added the 🤖 bot Automated processes or integrations label Jun 4, 2026
@guibranco guibranco closed this Jun 4, 2026
auto-merge was automatically disabled June 4, 2026 12:23

Pull request was closed

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Jun 4, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@guibranco guibranco deleted the dependabot/nuget/dependencies-1db5a380b7 branch June 4, 2026 12:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gstraccini gstraccini[bot] gstraccini[bot] approved these changes

@guibranco guibranco guibranco approved these changes

Assignees

@guibranco guibranco

Labels

☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) 🤖 bot Automated processes or integrations dependencies Pull requests that update a dependency file .NET Pull requests that update .net code nuget packages size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Behavioral regression: SearchResponse for expired PIT (HTTP 404) now reports IsValidResponse=true

1 participant

@guibranco