Skip to content

Bump the dotnet-minor-patch group with 8 updates - #205

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/screendrafts.api/dotnet-minor-patch-42979f7127
Open

Bump the dotnet-minor-patch group with 8 updates#205
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/screendrafts.api/dotnet-minor-patch-42979f7127

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Updated AWSSDK.S3 from 4.0.104.6 to 4.0.104.8.

Release notes

Sourced from AWSSDK.S3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated MongoDB.Driver from 3.12.0 to 3.13.0.

Release notes

Sourced from MongoDB.Driver's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

  • CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
    • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
  • CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
    • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
  • CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
    • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
  • CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
    • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
  • CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
  • CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
    • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
  • CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
    • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
  • CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
    • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
  • CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
    • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
  • CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
    • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
  • CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
    • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

  • CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

  • CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
  • CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
  • CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

  • CSHARP-6225: Latest server binary downloads require private S3
  • CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.20.1

1.20.1-rc.1

1.20.1-beta.1

1.20.1-alpha.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.20.1

1.20.1-rc.1

1.20.1-beta.1

1.20.1-alpha.1

Commits viewable in compare view.

Updated Polly from 8.8.0 to 8.9.0.

Release notes

Sourced from Polly's releases.

8.9.0

What's Changed

Full Changelog: App-vNext/Polly@8.8.1...8.9.0

8.8.1

Highlights

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.8.0...8.8.1

Commits viewable in compare view.

Updated Quartz from 3.22.7 to 3.22.9.

Release notes

Sourced from Quartz's releases.

3.22.9

Two fixes for the 3.x line. There is no public API change and no schema change.

Fixed

  • Legacy time zone names resolve on a system without tzdata-legacy, such as Ubuntu 26.04. On .NET 8 and later, without the TimeZoneConverter plugin, seven Windows ids (FLE, India, Argentina, Greenland, Myanmar, Nepal and US Eastern Standard Time) and tzdata's legacy IANA names, such as Asia/Calcutta and Europe/Kiev, threw TimeZoneNotFoundException there. Quartz now maps a legacy name to its canonical zone through tzdata 2026e's backward links, and resolves it under the id asked for, so the id a store writes does not depend on the host. (#​4181, from #​4172)
  • A serial job's late trigger is not left BLOCKED by a custom driver delegate. With a delegate that implements IDriverDelegate but does not derive from StdAdoDelegate, the completion of a [DisallowConcurrentExecution] job could store a late trigger it let go of as BLOCKED. If that was the job's only trigger, it never fired again. Every delegate Quartz ships was unaffected. (#​4182, from #​4175)

Behaviour change

  • With the TimeZoneConverter plugin on such a host, 3.22.8 stored the canonical name (Europe/Kyiv for FLE Standard Time). 3.22.9 resolves the id before the plugin is asked, so it stores the id asked for. Rows already stored read back either way.

What's Changed

Full Changelog: quartznet/quartznet@v3.22.8...v3.22.9

3.22.8

Fixes for the 3.x line, including a regression in 3.22.7 that made TriggerJob slower the more triggers its job had stored. There is no public API change and no schema change.

Fixed

  • TriggerJob no longer slows down as its job's backlog grows (regression in 3.22.7). 3.22.7 gave a manual firing the execution group its job's triggers share (#​4110), and found that group by loading every stored trigger of the job, three statements per trigger. A queued manual firing is a stored trigger too, so each call cost more than the one before. The group is now read with one statement. (#​4170, from #​4167)
  • A [DisallowConcurrentExecution] job's completion reads only the triggers that misfired (since 3.17.0). Each completion loaded every remaining trigger of the job under TRIGGER_ACCESS to apply the misfire policy to the late ones, so draining a backlog was quadratic in statements, and ScheduleJob and TriggerJob waited behind the lock. The completion now asks the database only for the job's misfired triggers, with the misfire handler's predicate. (#​4168, from #​4167)
  • A restart keeps a declared trigger's fire count and an individual pause. A start re-applies every AddTrigger and ScheduleJob registration and every scheduling file through RescheduleJob. That reset TimesTriggered, so a finite WithRepeatCount ran again from the beginning, and it resumed a trigger an operator had paused on its own. Both are now kept while the declared schedule is unchanged; a changed schedule starts fresh. An application's own RescheduleJob still ends an individual pause. (#​4149, from #​4128)

The #​4167 workload on SQL Server: 400 queued triggers on one serial job with a 50 ms body, which would drain in 20 s with no scheduler overhead.

Version Drain time Misfire events TriggerJob median
3.16.1 58 s 0 58 ms
3.22.7 212 s 137 1.4 s
3.22.8 50 s 0 58 ms

Against a remote database every one of those statements is a round trip, so the difference grows with latency.

Behaviour changes

  • A serial job's completion no longer reports a late IgnoreMisfirePolicy trigger to ITriggerListener.TriggerMisfired, and no longer writes it back unchanged. Acquisition fires it, as the misfire handler and RAMJobStore already did. (#​4168)
  • The completion no longer calls the protected virtual JobStoreSupport.GetTriggersForJob(conn, …) and UpdateMisfiredTrigger(conn, key, …). A subclass that overrode either to change what a completion does is bypassed there; ResumeTrigger still calls UpdateMisfiredTrigger. (#​4168)

Thanks to @​kostekk88 for the report and the repro in #​4167.

What's Changed

Other changes

Full Changelog: quartznet/quartznet@v3.22.7...v3.22.8

Commits viewable in compare view.

Updated Quartz.Extensions.Hosting from 3.22.7 to 3.22.9.

Release notes

Sourced from Quartz.Extensions.Hosting's releases.

3.22.9

Two fixes for the 3.x line. There is no public API change and no schema change.

Fixed

  • Legacy time zone names resolve on a system without tzdata-legacy, such as Ubuntu 26.04. On .NET 8 and later, without the TimeZoneConverter plugin, seven Windows ids (FLE, India, Argentina, Greenland, Myanmar, Nepal and US Eastern Standard Time) and tzdata's legacy IANA names, such as Asia/Calcutta and Europe/Kiev, threw TimeZoneNotFoundException there. Quartz now maps a legacy name to its canonical zone through tzdata 2026e's backward links, and resolves it under the id asked for, so the id a store writes does not depend on the host. (#​4181, from #​4172)
  • A serial job's late trigger is not left BLOCKED by a custom driver delegate. With a delegate that implements IDriverDelegate but does not derive from StdAdoDelegate, the completion of a [DisallowConcurrentExecution] job could store a late trigger it let go of as BLOCKED. If that was the job's only trigger, it never fired again. Every delegate Quartz ships was unaffected. (#​4182, from #​4175)

Behaviour change

  • With the TimeZoneConverter plugin on such a host, 3.22.8 stored the canonical name (Europe/Kyiv for FLE Standard Time). 3.22.9 resolves the id before the plugin is asked, so it stores the id asked for. Rows already stored read back either way.

What's Changed

Full Changelog: quartznet/quartznet@v3.22.8...v3.22.9

3.22.8

Fixes for the 3.x line, including a regression in 3.22.7 that made TriggerJob slower the more triggers its job had stored. There is no public API change and no schema change.

Fixed

  • TriggerJob no longer slows down as its job's backlog grows (regression in 3.22.7). 3.22.7 gave a manual firing the execution group its job's triggers share (#​4110), and found that group by loading every stored trigger of the job, three statements per trigger. A queued manual firing is a stored trigger too, so each call cost more than the one before. The group is now read with one statement. (#​4170, from #​4167)
  • A [DisallowConcurrentExecution] job's completion reads only the triggers that misfired (since 3.17.0). Each completion loaded every remaining trigger of the job under TRIGGER_ACCESS to apply the misfire policy to the late ones, so draining a backlog was quadratic in statements, and ScheduleJob and TriggerJob waited behind the lock. The completion now asks the database only for the job's misfired triggers, with the misfire handler's predicate. (#​4168, from #​4167)
  • A restart keeps a declared trigger's fire count and an individual pause. A start re-applies every AddTrigger and ScheduleJob registration and every scheduling file through RescheduleJob. That reset TimesTriggered, so a finite WithRepeatCount ran again from the beginning, and it resumed a trigger an operator had paused on its own. Both are now kept while the declared schedule is unchanged; a changed schedule starts fresh. An application's own RescheduleJob still ends an individual pause. (#​4149, from #​4128)

The #​4167 workload on SQL Server: 400 queued triggers on one serial job with a 50 ms body, which would drain in 20 s with no scheduler overhead.

Version Drain time Misfire events TriggerJob median
3.16.1 58 s 0 58 ms
3.22.7 212 s 137 1.4 s
3.22.8 50 s 0 58 ms

Against a remote database every one of those statements is a round trip, so the difference grows with latency.

Behaviour changes

  • A serial job's completion no longer reports a late IgnoreMisfirePolicy trigger to ITriggerListener.TriggerMisfired, and no longer writes it back unchanged. Acquisition fires it, as the misfire handler and RAMJobStore already did. (#​4168)
  • The completion no longer calls the protected virtual JobStoreSupport.GetTriggersForJob(conn, …) and UpdateMisfiredTrigger(conn, key, …). A subclass that overrode either to change what a completion does is bypassed there; ResumeTrigger still calls UpdateMisfiredTrigger. (#​4168)

Thanks to @​kostekk88 for the report and the repro in #​4167.

What's Changed

Other changes

Full Changelog: quartznet/quartznet@v3.22.7...v3.22.8

Commits viewable in compare view.

Updated Scalar.AspNetCore from 2.18.3 to 2.18.7.

Release notes

Sourced from Scalar.AspNetCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dotnet-minor-patch group with 8 updates
171d53f 
Bumps AWSSDK.S3 from 4.0.104.6 to 4.0.104.8
Bumps MongoDB.Driver from 3.12.0 to 3.13.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.20.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Http from 1.20.0 to 1.20.1
Bumps Polly from 8.8.0 to 8.9.0
Bumps Quartz from 3.22.7 to 3.22.9
Bumps Quartz.Extensions.Hosting from 3.22.7 to 3.22.9
Bumps Scalar.AspNetCore from 2.18.3 to 2.18.7

---
updated-dependencies:
- dependency-name: AWSSDK.S3
  dependency-version: 4.0.104.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Polly
  dependency-version: 8.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: Quartz
  dependency-version: 3.22.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Quartz.Extensions.Hosting
  dependency-version: 3.22.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.18.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
screen-drafts Ready Ready Preview Nov 2, 2026 4:42pm UTC

@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 2, 2026

This branch was successfully deployed

1 active deployment
Preview — 171d53ff Deployed Nov 2, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants