Skip to content

Bump the nuget group with 34 updates - #87

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-80c479c47e
Open

Bump the nuget group with 34 updates#87
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-80c479c47e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Updated dotnet-coverage from 18.7.0 to 18.9.0.

Release notes

Sourced from dotnet-coverage's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated dotnet-reportgenerator-globaltool from 5.5.10 to 5.5.11.

Release notes

Sourced from dotnet-reportgenerator-globaltool's releases.

5.5.11

Changes:

  • #​786 Improved HTML table layout for Firefox
  • #​785 Changed hover color for table rows in HTML reports to improve readability in dark mode

This release requires .NET Framework 4.7 or .NET 8.0/9.0/10.0

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.122 to 3.0.138.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.138

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.138

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.137...3.0.138

3.0.137

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.137

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.136...3.0.137

3.0.136

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.136

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.135...3.0.136

3.0.135

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.135

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.134...3.0.135

3.0.134

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.134

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.133...3.0.134

3.0.133

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.133

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.132...3.0.133

3.0.132

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.132

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.130...3.0.132

3.0.131

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.131

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.129...3.0.131

3.0.130

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.130

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.129...3.0.130

3.0.129

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.129

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.128...3.0.129

3.0.128

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.128

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.127...3.0.128

3.0.127

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.127

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.126...3.0.127

3.0.126

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.126

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.125...3.0.126

3.0.125

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.125

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.124...3.0.125

3.0.124

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.124

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.123...3.0.124

3.0.123

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.123

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.122...3.0.123

Commits viewable in compare view.

Updated Microsoft.AgentGovernance from 3.7.0 to 5.0.0.

Release notes

Sourced from Microsoft.AgentGovernance's releases.

4.1.0

What's New in v4.1.0

Agent OS (Nexus)

  • Ed25519 signature verification for agent registration and deregistration
  • Escrow signing support in ProofOfOutcome
  • Crewai adapter fixes

Policy Engine

  • Dynamic policy conditions with time-based and cost-aware rules
  • Updated Cedar policy versions
  • agt-policies 5.0.0

All Packages

See CHANGELOG for full details.

4.0.0

Agent Governance Toolkit v4.0.0

Ship agents to production without losing sleep -- now with consolidated packages, TEE key management, and Entra JWT verification across the mesh.

Highlights

Python Package Consolidation (Breaking)

45 Python packages consolidated into 5 clean distributions:

Distribution What is included
agent-governance-toolkit-core Policy engine, capability model, audit, MCP gateway, identity, trust scoring
agent-governance-toolkit-runtime Privilege rings, saga orchestration, termination control
agent-governance-toolkit-sre SLOs, error budgets, chaos engineering, circuit breakers
agent-governance-toolkit-cli agt CLI, OWASP verification, integrity checks, policy linting
agent-governance-toolkit[full] Meta-package installing all of the above

Old package names (agent-os-kernel, agentmesh-platform, etc.) remain as stub redirects for migration.

New Capabilities

  • TEE keystore abstraction (ADR 0010): async key management with TEEKeyHandle, SoftwareKeyHandle, and attested key store adapters
  • Entra-signed JWT verification for mesh-relay WebSocket connections and mesh-registry agent verification
  • Wire-protocol-aware policy evaluation for SQL and Kubernetes across TypeScript, Rust, Go, and .NET
  • Credential injection and offload across all four SDK languages
  • Expanded credential redaction across C#, Python, TypeScript, and Rust
  • Sandbox subprocess code scanner and OpenShell shell interception
  • LangGraph v1.0 governance adapter with stale-auth fingerprinting
  • New CLI governance packages: OpenCode, Antigravity CLI, Claude Code
  • AGT test replay engine for policy regression testing

Security (15+ fixes)

  • Closed authorization bypasses in stateless kernel and execute API
  • Proof-of-possession enforcement on registry endpoints
  • Trust boundary hardening: POP, capability grant auth, signing-oracle, unknown-DID auto-trust
  • JWKS/revocation trust-fetch hardening and URL allowlist matching
  • In-process sandbox hardening against stdlib escape paths
  • Mute-agent: 11 red-team regression tests
  • setuptools minimum raised to 78.1.1 for CVE fix

Documentation

  • README rewrite, docs site refresh, architecture diagrams
  • ADR-0026 (Foundry AI Gateway PDP), ADR-0028 (AGT Studio), ADR-0029 (policy distribution)
  • NSA MCP compliance mapping, zh-TW translations
  • 60+ tutorial improvements

Install

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Agents.AI from 1.13.0 to 1.16.0.

Release notes

Sourced from Microsoft.Agents.AI's releases.

1.16.0

What's Changed

New Contributors

Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0

1.15.0

What's Changed

New Contributors

Full Changelog: microsoft/agent-framework@python-1.12.0...dotnet-1.15.0

1.14.0

What's Changed

Full Changelog: microsoft/agent-framework@python-1.11.0...dotnet-1.14.0

Commits viewable in compare view.

Updated Microsoft.Agents.AI.Workflows from 1.13.0 to 1.16.0.

Release notes

Sourced from Microsoft.Agents.AI.Workflows's releases.

1.16.0

What's Changed

New Contributors

Full Changelog: microsoft/agent-framework@python-github-copilot-1.0.0...dotnet-1.16.0

1.15.0

What's Changed

New Contributors

Full Changelog: microsoft/agent-framework@python-1.12.0...dotnet-1.15.0

1.14.0

What's Changed

Full Changelog: microsoft/agent-framework@python-1.11.0...dotnet-1.14.0

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.Web from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Components.Web's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.AI from 10.7.0 to 10.8.3.

Release notes

Sourced from Microsoft.Extensions.AI's releases.

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version Note
Microsoft.Extensions.VectorData.Abstractions 10.8.2 Published August 7, 2026
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

Update: August 7, 2026
The Microsoft.Extensions.VectorData.Abstractions package was initially excluded from this release by mistake. Because Microsoft.Extensions.VectorData.ConformanceTests has a dependency on Microsoft.Extensions.VectorData.Abstractions, that led to failures when updating to Microsoft.Extensions.VectorData.ConformanceTests 10.8.2.

Microsoft.Extensions.VectorData.Abstractions was published August 7, 2026 to resolve that issue.

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
  • Update Agent Framework to 1.13.0 #​7613 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.OpenAI from 10.7.0 to 10.8.3.

Release notes

Sourced from Microsoft.Extensions.AI.OpenAI's releases.

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version Note
Microsoft.Extensions.VectorData.Abstractions 10.8.2 Published August 7, 2026
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

Update: August 7, 2026
The Microsoft.Extensions.VectorData.Abstractions package was initially excluded from this release by mistake. Because Microsoft.Extensions.VectorData.ConformanceTests has a dependency on Microsoft.Extensions.VectorData.Abstractions, that led to failures when updating to Microsoft.Extensions.VectorData.ConformanceTests 10.8.2.

Microsoft.Extensions.VectorData.Abstractions was published August 7, 2026 to resolve that issue.

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
  • Update Agent Framework to 1.13.0 #​7613 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Binder from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.Binder's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.EnvironmentVariables's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.JsonWebTokens's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.1 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 8.19.1 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

Commits viewable in compare view.

Updated ModelContextProtocol from 1.4.1 to 2.0.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

  1. Default to stateless HTTP and discovery-first negotiation #​1610
    • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
    • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
    • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
  2. Deprecate Roots, Sampling, and Logging APIs #​1651
    • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
    • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
  3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
    • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
    • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
  4. Strengthen OAuth callback and issuer validation #​1605
    • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
    • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
  5. Emit non-object structured tool results directly #​1568
    • Tools with UseStructuredContent = true and a non-object return type now emit the raw value and matching schema, such as structuredContent: 72, instead of wrapping it as { "result": 72 }.
    • Update clients to read the value according to the advertised output schema rather than assuming a result property.
  6. Require Tool.inputSchema during deserialization #​1600
    • Deserializing a Tool payload without inputSchema now throws JsonException instead of silently defaulting the schema.
    • Custom servers, proxies, and test fixtures that produce tool JSON must include inputSchema; an empty {} is sufficient.
  7. Require explicit PKCE S256 support in OAuth metadata #​1700
    • OAuth authorization now fails when authorization-server metadata does not advertise S256 in code_challenge_methods_supported.
    • Update the authorization server metadata to declare PKCE S256 support.
  8. Send application_type during dynamic client registration #​1613
    • Dynamic client registration requests now include an inferred application_type.
    • Authorization servers that validate the request shape must accept this standard field; set DynamicClientRegistrationOptions.ApplicationType explicitly when the inferred value is not appropriate.
  9. Propagate underlying SSE connection exceptions #​1432
    • Explicit SSE connections now surface the underlying HttpRequestException, TimeoutException, or genuine I/O exception instead of always wrapping failures in IOException.
    • Update connection error handling that depends on the old IOException("Failed to connect transport.") wrapper. In AutoDetect mode, inspect the outer HttpRequestException and its inner SSE failure.
  10. Fail OAuth step-up when a challenge makes no progress #​1591
    • A repeated insufficient_scope challenge that introduces no new scopes now throws McpException instead of retrying indefinitely.
    • Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

What's Changed

  • Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73
  • Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
  • Implement SEP-2243 HTTP header standardization #​1553 by @​mikekistler (co-authored by @​tarekgh @​Copilot)
  • Append offline_access to authorization scope when advertised (SEP-2207) #​1479 by @​stephentoub (co-authored by @​Copilot)
  • Deprecate McpErrorCode.ResourceNotFound per SEP-2164 #​1558 by @​jayaraman-venkatesan
  • Add APIs for pre-populating the McpClient tool cache #​1590 by @​tarekgh
  • Add ScopeSelectorDelegate to OAuth options #​1596 by @​halllo
  • Validate the authenticated user on Streamable HTTP session deletion #​1604 by @​halter73
    ... (truncated)

2.0.0-rc.2

This second 2.0 release candidate advances the SDK’s 2026-07-28 protocol support, expands Tasks extension conformance tests, strengthens OAuth and transport behavior, and expands 2.0 guidance ahead of general availability.

Thank you to the community for using the preview and release-candidate builds and for sharing feedback and issue reports that shape this release!

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

  1. Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752
    • Aligns with protocol adjustment #​3002.
    • DiscoverResult.ServerInfo is removed; read and deserialize Meta[MetaKeys.ServerInfo] instead.
    • On 2026-07-28, replace legacy initialization, ping, logging, and resource-subscription methods with server/discover, _meta log level, and subscriptions/listen.
  2. Validate OAuth authorization state #​1726
    • Custom authorization callback handlers must propagate the redirect state through AuthorizationResult.State, and should return Code, State, and Iss.
  3. Fix SSE session transport shutdown behavior #​1432
    • Handle the underlying transport exception rather than depending on an IOException wrapper.

What's Changed

  • Fix SSE session transport shutdown behavior #​1432 by @​xue-cai (co-authored by @​Copilot)
  • Validate OAuth authorization state #​1726 by @​halter73 (co-authored by @​Copilot)
  • Add configurable Tasks execution modes and complete conformance support #​1741 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Gate 2026-07-28 result fields by negotiated protocol version #​1753 by @​tarekgh
  • Align the 2026-07-28 wire protocol and SEP-2575 HTTP statuses #​1752 by @​pcarleton (co-authored by @​tarekgh @​Copilot)
  • Reauthorize tools changed by call-tool filters #​1737 by @​PranavSenthilnathan (co-authored by @​Copilot)

Documentation Updates

  • Refine 2.0.0 concept documentation #​1742 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

  • Resolve test-server paths deterministically #​1735 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Add MCP Apps NativeAOT coverage #​1711 by @​lntutor
  • Add MCP Apps _meta.ui serialization round-trip tests #​1698 by @​yayayouyou

Repository Infrastructure Updates

  • Bump actions/setup-node from 6.4.0 to 7.0.0 #​1717
  • Bump coverlet.collector from 10.0.0 to 10.0.1 #​1582
  • Bump qs from 6.14.2 to 6.15.2 #​1597
  • Bump actions/setup-dotnet from 5.2.0 to 6.0.0 #​1716
  • Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.5 to 5.5.10 #​1569
  • Bump actions/checkout from 6 to 7 #​1665
  • Rename MCPEXP002 extensibility constants #​1739 by @​arimu1
  • Bump the testing-frameworks group #​1746
  • Bump the serilog-testing group #​1748
  • Bump actions/checkout from 7.0.0 to 7.0.1 #​1745
  • Bump Anthropic from 12.17.0 to 12.39.0 #​1750
  • ...

Description has been truncated

@dependabot
Bump the nuget group with 34 updates
e1b09bb 
Bumps dotnet-coverage from 18.7.0 to 18.9.0
Bumps dotnet-reportgenerator-globaltool from 5.5.10 to 5.5.11
Bumps Meziantou.Analyzer from 3.0.122 to 3.0.138
Bumps Microsoft.AgentGovernance from 3.7.0 to 5.0.0
Bumps Microsoft.Agents.AI from 1.13.0 to 1.16.0
Bumps Microsoft.Agents.AI.Workflows from 1.13.0 to 1.16.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10
Bumps Microsoft.AspNetCore.Components.Web from 10.0.9 to 10.0.10
Bumps Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.AI from 10.7.0 to 10.8.3
Bumps Microsoft.Extensions.AI.OpenAI from 10.7.0 to 10.8.3
Bumps Microsoft.Extensions.Configuration from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.Binder from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Hosting from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Http from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Logging from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.22.0
Bumps Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.1 to 8.22.0
Bumps Microsoft.IdentityModel.Tokens from 8.19.1 to 8.22.0
Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1
Bumps ModelContextProtocol from 1.4.1 to 2.0.0
Bumps ModelContextProtocol.AspNetCore from 1.4.1 to 2.0.0
Bumps NSubstitute from 5.3.0 to 6.0.0
Bumps OpenTelemetry from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.16.0 to 1.17.0
Bumps System.IdentityModel.Tokens.Jwt from 8.19.1 to 8.22.0

---
updated-dependencies:
- dependency-name: dotnet-coverage
  dependency-version: 18.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: dotnet-reportgenerator-globaltool
  dependency-version: 5.5.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.138
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AgentGovernance
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: Microsoft.Agents.AI
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Agents.AI.Workflows
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.Components.Web
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.AI
  dependency-version: 10.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.AI.OpenAI
  dependency-version: 10.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Hosting
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Http
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.Protocols.OpenIdConnect
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: ModelContextProtocol
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: ModelContextProtocol.AspNetCore
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: OpenTelemetry
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Stale dependencies, need updates label Aug 10, 2026
@dependabot dependabot Bot mentioned this pull request Aug 10, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Stale dependencies, need updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants