Bump the all-nuget group with 21 updates by dependabot[bot] · Pull Request #51 · navalerakesh/mcp-validation-security

dependabot · 2026-05-18T20:17:36Z

Updated coverlet.collector from 10.0.0 to 10.0.1.

Release notes

Sourced from coverlet.collector's releases.

10.0.1

Improvements

Coverlet with MTP 2 doesn't show test coverage statistic in console #1907
Avoid unnecessary testhost restarts #1912 by https://github.com/mawosoft

Fixed

Fix inconsistent paths in cobertura reports #1723
Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #1313
Fix Coverlet flagging a branch for an async functions finally block where none exists #1337
Fix Coverlet Tracker Missing CompilerGeneratedAttribute #1828

Maintenance

Add architecture docs and diagrams for all integrations #1927
Update NuGet packages and .NET SDK versions #1933

Diff between 10.0.0 and 10.0.1

Commits viewable in compare view.

Updated FluentAssertions from 8.9.0 to 8.10.0.

Release notes

Sourced from FluentAssertions's releases.

8.10.0 What's Changed

Commits viewable in compare view.

Updated JsonSchema.Net from 9.2.0 to 9.2.1.

Release notes

Sourced from JsonSchema.Net's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 8.0.26 to 8.0.27.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

8.0.27

Release

What's Changed

[release/8.0] Update branding to 8.0.27 by @vseanreesermsft in [release/8.0] Update branding to 8.0.27 dotnet/aspnetcore#66205
[release/8.0] Update NPM dependencies by @wtgodbe in [release/8.0] Update NPM dependencies dotnet/aspnetcore#66052
[release/8.0] Move off of dead-lettered Windows preview helix queue by @wtgodbe in [release/8.0] Move off of dead-lettered Windows preview helix queue dotnet/aspnetcore#66220
[release/8.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 by @dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 dotnet/aspnetcore#66087
[release/8.0] Replace dn-bot-dnceng-build-rw-code-rw PAT with WIF service connection in mirror-within-azdo by @missymessa in [release/8.0] Replace dn-bot-dnceng-build-rw-code-rw PAT with WIF service connection in mirror-within-azdo dotnet/aspnetcore#66115
[release/8.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#66216
[release/8.0] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#66081
[release/8.0] Update dependencies from dotnet/source-build-reference-packages by @dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-reference-packages dotnet/aspnetcore#66131
[release/8.0] Update @azure/msal-browser from 2.x to 4.x by @wtgodbe in [release/8.0] Update @azure/msal-browser from 2.x to 4.x dotnet/aspnetcore#66236
[release/8.0] Use source-build-assets repo by @NikolaMilosavljevic in [release/8.0] Use source-build-assets repo dotnet/aspnetcore#66276
Merging internal commits for release/8.0 by @vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#66317

Full Changelog: dotnet/aspnetcore@v8.0.26...v8.0.27

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.CommandLine from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Configuration.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Json from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.7 to 10.0.8.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Client from 4.83.3 to 4.84.0.

Release notes

Sourced from Microsoft.Identity.Client's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated ModelContextProtocol from 1.2.0 to 1.3.0.

Release notes

Sourced from ModelContextProtocol's releases.

1.3.0

v1.3.0 focuses on improved transport diagnostics and security-focused documentation. The new public ClientTransportClosedException gives stdio and HTTP clients structured access to transport closure details (exit codes, process IDs, stderr tails, HTTP status codes) without parsing exception messages. Two reliability fixes harden the stdio process pipeline (preventing host crashes from user StandardErrorLines callbacks) and correct the stateless HTTP transport's capability advertisement. New conceptual documentation covers role/identity propagation in tool execution, allowed-hosts and CORS guidance for HTTP servers, and aligns the docs information architecture with the MCP specification structure.

What's Changed

Make ClientTransportClosedException public and unify transport exception handling #1467 by @stephentoub (co-authored by @halter73 @Copilot)
- As part of this unification, SSE/HTTP client connection failures from McpClient.CreateAsync(...) now surface as IOException (the new ClientTransportClosedException derives from IOException) rather than InvalidOperationException. Caller-triggered OperationCanceledException is also no longer wrapped, matching standard async cancellation semantics.
Fix process crash when testing Stderr #1449 by @ericstj (co-authored by @Copilot)
Fix stateless HTTP transport advertising listChanged capability #1509 by @jayaraman-venkatesan

Documentation Updates

docs: align docs IA with MCP specification structure #1481 by @jeffhandley (co-authored by @mikekistler @Copilot)
Document recommended pattern for role/identity propagation in MCP tool execution #1497 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)
Document and demonstrate allowed hosts and CORS policy guidance #1554 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)

Test Improvements

Fix flaky OutgoingFilter_MultipleFilters_ExecuteInOrder test #1488 by @ericstj (co-authored by @Copilot)

Repository Infrastructure Updates

Bump the opentelemetry-testing group with 5 updates #1478
Bump actions/deploy-pages from 4.0.5 to 5.0.0 #1477
Bump actions/download-artifact from 8.0.0 to 8.0.1 #1437
Bump actions/setup-dotnet from 5.1.0 to 5.2.0 #1418
Bump actions/setup-node from 6.2.0 to 6.3.0 #1419
Bump the testing-frameworks group with 1 update #1459
Bump the npm_and_yarn group across 1 directory with 2 updates #1410
Switch to custom CodeQL workflow #1489 by @jeffhandley
Block Release Publishing workflow from automatically running on forks #1450 by @jeffhandley (co-authored by @Copilot)
Bump actions/checkout from 4 to 6 #1504
Add testing guidelines, update copilot instructions for tests #1507 by @ericstj
Bump OpenTelemetry and 3 others #1514
Bump the opentelemetry-testing group with 6 updates #1533
Bump actions/setup-node from 6.3.0 to 6.4.0 #1522
Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #1511
Bump the npm_and_yarn group across 1 directory with 5 updates #1500
Bump Anthropic from 12.9.0 to 12.11.0 #1506
Bump actions/upload-artifact from 7.0.0 to 7.0.1 #1512
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.4 to 5.5.5 #1521
Bump the testing-frameworks group with 2 updates #1523
Bump the other-testing group with 2 updates #1534
Bump Microsoft.Extensions.AI from 10.4.1 to 10.5.0 #1525
Remove extraneous labels from dependabot.yml #1535 by @mikekistler
Bump Anthropic from 12.11.0 to 12.17.0 #1544
Fix dev container configuration to work in codespaces #1555 by @mikekistler
Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #1543
Bump the npm_and_yarn group across 1 directory with 3 updates #1565
Bump Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.5.2 #1561

... (truncated)

Commits viewable in compare view.

Updated ModelContextProtocol.Core from 1.2.0 to 1.3.0.

Release notes

Sourced from ModelContextProtocol.Core's releases.

1.3.0

v1.3.0 focuses on improved transport diagnostics and security-focused documentation. The new public ClientTransportClosedException gives stdio and HTTP clients structured access to transport closure details (exit codes, process IDs, stderr tails, HTTP status codes) without parsing exception messages. Two reliability fixes harden the stdio process pipeline (preventing host crashes from user StandardErrorLines callbacks) and correct the stateless HTTP transport's capability advertisement. New conceptual documentation covers role/identity propagation in tool execution, allowed-hosts and CORS guidance for HTTP servers, and aligns the docs information architecture with the MCP specification structure.

What's Changed

Make ClientTransportClosedException public and unify transport exception handling #1467 by @stephentoub (co-authored by @halter73 @Copilot)
- As part of this unification, SSE/HTTP client connection failures from McpClient.CreateAsync(...) now surface as IOException (the new ClientTransportClosedException derives from IOException) rather than InvalidOperationException. Caller-triggered OperationCanceledException is also no longer wrapped, matching standard async cancellation semantics.
Fix process crash when testing Stderr #1449 by @ericstj (co-authored by @Copilot)
Fix stateless HTTP transport advertising listChanged capability #1509 by @jayaraman-venkatesan

Documentation Updates

docs: align docs IA with MCP specification structure #1481 by @jeffhandley (co-authored by @mikekistler @Copilot)
Document recommended pattern for role/identity propagation in MCP tool execution #1497 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)
Document and demonstrate allowed hosts and CORS policy guidance #1554 by @jeffhandley (co-authored by @halter73 @mikekistler @Copilot)

Test Improvements

Fix flaky OutgoingFilter_MultipleFilters_ExecuteInOrder test #1488 by @ericstj (co-authored by @Copilot)

Repository Infrastructure Updates

Bump the opentelemetry-testing group with 5 updates #1478
Bump actions/deploy-pages from 4.0.5 to 5.0.0 #1477
Bump actions/download-artifact from 8.0.0 to 8.0.1 #1437
Bump actions/setup-dotnet from 5.1.0 to 5.2.0 #1418
Bump actions/setup-node from 6.2.0 to 6.3.0 #1419
Bump the testing-frameworks group with 1 update #1459
Bump the npm_and_yarn group across 1 directory with 2 updates #1410
Switch to custom CodeQL workflow #1489 by @jeffhandley
Block Release Publishing workflow from automatically running on forks #1450 by @jeffhandley (co-authored by @Copilot)
Bump actions/checkout from 4 to 6 #1504
Add testing guidelines, update copilot instructions for tests #1507 by @ericstj
Bump OpenTelemetry and 3 others #1514
Bump the opentelemetry-testing group with 6 updates #1533
Bump actions/setup-node from 6.3.0 to 6.4.0 #1522
Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #1511
Bump the npm_and_yarn group across 1 directory with 5 updates #1500
Bump Anthropic from 12.9.0 to 12.11.0 #1506
Bump actions/upload-artifact from 7.0.0 to 7.0.1 #1512
Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.4 to 5.5.5 #1521
Bump the testing-frameworks group with 2 updates #1523
Bump the other-testing group with 2 updates #1534
Bump Microsoft.Extensions.AI from 10.4.1 to 10.5.0 #1525
Remove extraneous labels from dependabot.yml #1535 by @mikekistler
Bump Anthropic from 12.11.0 to 12.17.0 #1544
Fix dev container configuration to work in codespaces #1555 by @mikekistler
Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #1543
Bump the npm_and_yarn group across 1 directory with 3 updates #1565
Bump Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.5.2 #1561

... (truncated)

Commits viewable in compare view.

Updated System.CommandLine from 2.0.7 to 2.0.8.

Release notes

Sourced from System.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Text.Json from 10.0.7 to 10.0.8.

Release notes

Sourced from System.Text.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated WireMock.Net from 2.4.0 to 2.6.0.

Release notes

Sourced from WireMock.Net's releases.

2.6.0 What's Changed

Fix request storing when RequestLogExpirationDuration is set [bug] by @pbenko-xitaso in Fix request storing when RequestLogExpirationDuration is set [bug] wiremock/WireMock.Net#1455

New Contributors

@pbenko-xitaso made their first contribution in Fix request storing when RequestLogExpirationDuration is set [bug] wiremock/WireMock.Net#1455

Full Changelog: wiremock/WireMock.Net@2.5.0...2.6.0

2.5.0 What's Changed

Bump log4net from 2.0.15 to 3.3.0 in example console app by @dependabot[bot] in Bump log4net from 2.0.15 to 3.3.0 in example console app wiremock/WireMock.Net#1452
Fix CVE-2026-40021: upgrade log4net to 3.3.0 in examples/WireMock.Net.Service/packages.config by @Copilot in Fix CVE-2026-40021: upgrade log4net to 3.3.0 in examples/WireMock.Net.Service/packages.config wiremock/WireMock.Net#1453
Feature/early mismatch by @Stepami in Feature/early mismatch wiremock/WireMock.Net#1451

New Contributors

@Copilot made their first contribution in Fix CVE-2026-40021: upgrade log4net to 3.3.0 in examples/WireMock.Net.Service/packages.config wiremock/WireMock.Net#1453
@Stepami made their first contribution in Feature/early mismatch wiremock/WireMock.Net#1451

Full Changelog: wiremock/WireMock.Net@2.4.0...2.5.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps coverlet.collector from 10.0.0 to 10.0.1 Bumps FluentAssertions from 8.9.0 to 8.10.0 Bumps JsonSchema.Net from 9.2.0 to 9.2.1 Bumps Microsoft.AspNetCore.Mvc.Testing from 8.0.26 to 8.0.27 Bumps Microsoft.Extensions.Configuration from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Configuration.Abstractions from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Configuration.CommandLine from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Configuration.Json from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.DependencyInjection from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Hosting from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Http from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Logging from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.7 to 10.0.8 Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.7 to 10.0.8 Bumps Microsoft.Identity.Client from 4.83.3 to 4.84.0 Bumps ModelContextProtocol from 1.2.0 to 1.3.0 Bumps ModelContextProtocol.Core from 1.2.0 to 1.3.0 Bumps System.CommandLine from 2.0.7 to 2.0.8 Bumps System.Text.Json from 10.0.7 to 10.0.8 Bumps WireMock.Net from 2.4.0 to 2.6.0 --- updated-dependencies: - dependency-name: coverlet.collector dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: FluentAssertions dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-nuget - dependency-name: JsonSchema.Net dependency-version: 9.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 8.0.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Configuration dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Configuration.Abstractions dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Configuration.CommandLine dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Hosting dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: Microsoft.Identity.Client dependency-version: 4.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-nuget - dependency-name: ModelContextProtocol dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-nuget - dependency-name: ModelContextProtocol.Core dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-nuget - dependency-name: System.CommandLine dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: System.Text.Json dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-nuget - dependency-name: WireMock.Net dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-nuget ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels May 18, 2026

dependabot Bot requested a review from navalerakesh as a code owner May 18, 2026 20:17

dependabot Bot mentioned this pull request May 18, 2026

Bump the all-nuget group with 4 updates #49

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the all-nuget group with 21 updates#51

Bump the all-nuget group with 21 updates#51
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Mcp.Benchmark.CLI/all-nuget-7ff9685d3c

dependabot Bot commented on behalf of github May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 18, 2026

10.0.1

Improvements

Fixed

Maintenance

8.10.0

What's Changed

Improvements

Documentation

Others

8.0.27

What's Changed

1.3.0

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

1.3.0

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

2.6.0

What's Changed

New Contributors

2.5.0

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants