chore(deps): Bump the nuget-minor-patch group with 5 updates - #135
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): Bump the nuget-minor-patch group with 5 updates#135dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps Microsoft.Agents.AI from 1.15.0 to 1.16.0 Bumps Microsoft.Agents.AI.OpenAI from 1.15.0 to 1.16.0 Bumps Microsoft.Agents.AI.Workflows from 1.15.0 to 1.16.0 Bumps Scalar.AspNetCore from 2.16.16 to 2.16.17 Bumps System.IdentityModel.Tokens.Jwt from 8.21.0 to 8.22.0 --- updated-dependencies: - dependency-name: Microsoft.Agents.AI dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.Agents.AI.OpenAI dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.Agents.AI.Workflows dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Scalar.AspNetCore dependency-version: 2.16.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: System.IdentityModel.Tokens.Jwt dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
10 tasks
Owner
|
Superseded by #139, which consolidates this bump with the other three open dependency PRs into one batch verified together (Release build 0 warnings, 832 tests green, Api host booted and /mcp probed). The MCP client and ASP.NET Core server packages in particular could not merge independently without splitting the SDK across a major boundary. |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
hoangsnowy
added a commit
that referenced
this pull request
Aug 9, 2026
…139) * chore(deps): Consolidate four dependency PRs and raise MCP to 2.1.0 Supersedes the four open Dependabot PRs (#135, #136, #137, #138) with one verified batch. #136 and #137 could not merge independently anyway: the MCP client and ASP.NET Core server packages must move together or the SDK is split across a major boundary. Where this differs from what Dependabot proposed: - ModelContextProtocol / .AspNetCore go to 2.1.0, not 2.0.0. The 2.x line makes the client probe `server/discover` before falling back to the legacy `initialize` handshake; 2.1.0 is the first version that recovers that fallback when discover fails at the HTTP layer and keeps the AutoDetect channel open after a provisional SSE failure. Those are exactly the down-level servers McpClientHost connects to (GitHub MCP, filesystem MCP), so 2.0.0 is the wrong floor for this repo. - Microsoft.Agents.AI* go to 1.17.0 and Scalar.AspNetCore to 2.16.18 rather than the 1.16.0 / 2.16.17 Dependabot had opened against, which are already stale. No source change was required for the MCP major. The two behaviour changes that reach this repo are both wanted: MapMcp("/mcp") now serves sessionless Streamable HTTP (the exposed run_pipeline / list_runs / get_run tools are request-scoped, and the standalone SSE GET/DELETE stream was never used), and the deprecated Roots/Sampling/Logging surfaces (MCP9005) plus stateful-only options (MCP9006) are unused here, so the Release build stays warning-clean under TreatWarningsAsErrors. Directory.Packages.props documents this. Verification: Release build 0 warnings / 0 errors; 832 tests pass, 14 skipped. The Api host was booted on the new SDK and probed: /health 200, /openapi/v1.json 200, and POST /mcp returns 401 for both a legacy `initialize` body and a 2026-07-28 `server/discover` body, confirming the endpoint is mapped and still authorization-gated under the new transport defaults. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(security): Clear every open advisory in the VS Code runner lockfile The undici bump this batch already carried closes five of the six open Dependabot alerts on main. The sixth, GHSA-7p8r-x3mc-p8w7 (high, fast-uri < 3.1.5), had no PR open against it, and `npm audit` surfaced two more highs Dependabot had not raised yet: GHSA-rgw5-rvv9-x895 (brace-expansion DoS, bypasses the CVE-2026-14257 mitigation) and GHSA-5p4m-2wfm-xmqj (js-yaml quadratic CPU in !!omap resolution). All three are transitive dev dependencies of the extension toolchain, so this is a lockfile-only fix (`npm audit fix --package-lock-only`): fast-uri 3.1.4 -> 3.1.5, brace-expansion 5.0.8 -> 5.0.9, js-yaml 4.3.0 -> 4.3.1. package.json is untouched, so no declared range moves. Verification: `npm audit` reports 0 vulnerabilities, `npm ci` installs cleanly from the new lockfile, and `npm run build` still emits dist/extension.js. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Microsoft.Agents.AI from 1.15.0 to 1.16.0.
Release notes
Sourced from Microsoft.Agents.AI's releases.
1.16.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0
Commits viewable in compare view.
Updated Microsoft.Agents.AI.OpenAI from 1.15.0 to 1.16.0.
Release notes
Sourced from Microsoft.Agents.AI.OpenAI's releases.
1.16.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0
Commits viewable in compare view.
Updated Microsoft.Agents.AI.Workflows from 1.15.0 to 1.16.0.
Release notes
Sourced from Microsoft.Agents.AI.Workflows's releases.
1.16.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0
Commits viewable in compare view.
Updated Scalar.AspNetCore from 2.16.16 to 2.16.17.
Release notes
Sourced from Scalar.AspNetCore's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated System.IdentityModel.Tokens.Jwt from 8.21.0 to 8.22.0.
Release notes
Sourced from System.IdentityModel.Tokens.Jwt's releases.
8.22.0
What's Changed
Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions