Bump the nuget-catalog group with 7 updates

[dependabot]

Updated Azure.Identity from 1.19.0 to 1.20.0.

Release notes

Sourced from Azure.Identity's releases.

1.20.0

1.20.0 (2026-03-30)

Features Added

• Added a JSON schema segment to the NuGet package that provides IntelliSense and validation for Azure.Identity credential configuration in appsettings.json.

Breaking Changes

• AddAzureClient, AddKeyedAzureClient, and WithAzureCredential return type changed from IHostApplicationBuilder to IClientBuilder to align with the IClientBuilder composition change in System.ClientModel.

Commits viewable in compare view.

Updated Azure.Monitor.OpenTelemetry.Exporter from 1.6.0 to 1.7.0.

Release notes

Sourced from Azure.Monitor.OpenTelemetry.Exporter's releases.

1.7.0

1.7.0 (2026-03-27)

Features Added

• Added ApplicationInsightsRestClientSettings to support creating a ApplicationInsightsRestClient from IConfiguration, including configuration-based credential resolution and dependency injection registration.
  (#​56891)

Bugs Fixed

• Fixed AOT warning regression by using the source generator for ConfigurationBinder calls.
  (#​56368)

Other Changes

• Update OpenTelemetry dependencies
  • OpenTelemetry 1.15.1
  • OpenTelemetry.Extensions.Hosting 1.15.1
    (#​57549)
• Made AzureMonitorLogExporter, AzureMonitorMetricExporter, and AzureMonitorTraceExporter public for direct use when configuring OpenTelemetry.
  (#​56344)
• Made options EnablePerformanceCounters and EnableStandardMetrics public in AzureMonitorExporterOptions.
  (#​56344)

1.6.2

1.6.2 (2026-04-02)

Other Changes

• Upgraded dependent Azure.Core to 1.52.0.
• Upgraded dependent Azure.ResourceManager to 1.14.0.
• Migrated from AutoRest/Swagger to TypeSpec-based generation.

1.6.1

1.6.1 (2026-03-10)

Bugs Fixed

• Fixed ActiveDirectoryDomainGuid deserialization to handle empty string values returned by the service (#​56903)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 3.5.0 to 3.5.1.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 1.1.0 to 1.2.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

1.2.0

This release improves stateless HTTP transport defaults and documentation with a breaking behavioral change that we are considering as a server reliability fix and therefore not bumping the major version with this release. Legacy SSE endpoints are now disabled by default with a new HttpServerTransportOptions.EnableLegacySse property available to opt back into responding to the SSE endpoints; the property is marked as an [Obsolete] warning as we expect to remove this property in a future major version.

A warning-level [Obsolete] attribute is also applied to the RequestContext(McpServer, JsonRpcRequest) constructor, and the RequestContext(McpServer, JsonRpcRequest, TParams) overload should be used instead. This change contributes to fixes including DI scope lifetime in task-augmented tools, meta/progress combination failures, and outgoing message filter routing. We plan to remove the obsolete overload in a future major version.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Disable legacy SSE by default #​1468

MapMcp() no longer maps /sse and /message endpoints by default. Servers whose clients connect via SSE will find those endpoints removed.

Migrating from legacy SSE

If your clients connect to a /sse endpoint (e.g., https://my-server.example.com/sse), they were using the legacy SSE transport--if not running in Stateless mode. The /sse and /message endpoints are now disabled by default (EnableLegacySse is false and marked [Obsolete] with diagnostic MCP9004). Upgrading the server SDK without updating clients will break SSE connections.

Client-side migration. Change the client Endpoint from the /sse path to the root MCP endpoint — the same URL your server passes to MapMcp(). For example:

// Before (legacy SSE):
Endpoint = new Uri("https://my-server.example.com/sse")

// After (Streamable HTTP):
Endpoint = new Uri("https://my-server.example.com/")

With the default HttpTransportMode.AutoDetect transport mode, the client automatically tries Streamable HTTP first. You can also set TransportMode = HttpTransportMode.StreamableHttp explicitly if you know the server supports it.

Server-side migration. If you previously relied on /sse being mapped automatically, you now need EnableLegacySse = true (suppressing the MCP9004 warning) to keep serving those endpoints. The recommended path is to migrate all clients to Streamable HTTP and then remove EnableLegacySse.

Transition period. If some clients still need SSE while others have already migrated to Streamable HTTP, set EnableLegacySse = true with Stateless = false. Both transports are served simultaneously by MapMcp() — Streamable HTTP on the root endpoint and SSE on /sse and /message. Once all clients have migrated, remove EnableLegacySse and optionally switch to Stateless = true.

SSE (legacy — opt-in only)

Legacy SSE endpoints are now disabled by default and must be explicitly enabled via HttpServerTransportOptions.EnableLegacySse. This is the primary reason they are disabled — the SSE transport has no built-in HTTP-level backpressure.

The legacy SSE transport separates the request and response channels: clients POST JSON-RPC messages to /message and receive responses through a long-lived GET SSE stream on /sse. The POST endpoint returns 202 Accepted immediately after queuing the message — it does not wait for the handler to complete. This means there is no HTTP-level backpressure on handler concurrency, because each POST frees its connection immediately regardless of how long the handler runs.

Internally, handlers are dispatched with a fire-and-forget pattern. A client can send unlimited POST requests to /message while keeping the GET stream open, and each one spawns a concurrent handler with no built-in limit.

The GET stream does provide session lifetime bounds: handler cancellation tokens are linked to the GET request's HttpContext.RequestAborted, so when the client disconnects the SSE stream, all in-flight handlers are cancelled. This is similar to SignalR's connection-bound lifetime model — but unlike SignalR, there is no per-client concurrency limit like MaximumParallelInvocationsPerClient. The GET stream provides cleanup on disconnect, not rate-limiting during the connection.

2. Obsolete 2-arg RequestContext constructor #​1462

The RequestContext(McpServer, JsonRpcRequest) constructor is now [Obsolete] with diagnostic MCP9003, producing build warnings. The Params property is also changed from TParams? to TParams.

Migration: Use the new 3-arg constructor: new RequestContext(server, request, parameters).

What's Changed

• Support specifying OutputSchema independently of return type for tools returning CallToolResult #​1425 by @​stephentoub (co-authored by @​Copilot)
• Add 3-arg RequestContext constructor and obsolete 2-arg to eliminate null-forgiving operator usage #​1462 by @​halter73 (co-authored by @​Copilot)
  ... (truncated)

Commits viewable in compare view.

Updated NetBricks from 2.0.3 to 2.0.4.

Release notes

Sourced from NetBricks's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenTelemetry from 1.15.0 to 1.15.1.

Release notes

Sourced from OpenTelemetry's releases.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

• NuGet: OpenTelemetry v1.15.1

  • Fixed Tracer.StartSpan() leaving the new span as Activity.Current when
    the previous activity was stopped by another thread during span creation.
    (#​6257)

  • Fixed OverflowException in TraceIdRatioBasedSampler when trace ID bytes
    produced long.MinValue.
    ([#​6928])

  • Fixed precision issues when using Histogram<float> with custom
    HistogramBucketBoundaries.
    (#​6866)

  • Fixed a thread-safety issue in LogRecordSharedPool.Rent().
    (#​6833)

  • Fixed observable instruments (ObservableCounter, ObservableUpDownCounter,
    ObservableGauge) continuing to export stale data points after a callback
    stops reporting a series.
    (#​5950)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.15.1

  • Breaking change: The Baggage API implements the latest Baggage API
    specification,
    which disallows empty baggage names and treats baggage names and values as case
    sensitive.
    (#​6931)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.1

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Console v1.15.1

  No notable changes.

  See CHANGELOG for details.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.15.1-beta.1

  • This package is deprecated and it will stop receiving any updates in
    March 2027. Use the OpenTelemetry API and SDK directly instead of the OpenTracing
    shims.
    (#​6976)

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.15.0 to 1.15.1.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

• NuGet: OpenTelemetry v1.15.1

  • Fixed Tracer.StartSpan() leaving the new span as Activity.Current when
    the previous activity was stopped by another thread during span creation.
    (#​6257)

  • Fixed OverflowException in TraceIdRatioBasedSampler when trace ID bytes
    produced long.MinValue.
    ([#​6928])

  • Fixed precision issues when using Histogram<float> with custom
    HistogramBucketBoundaries.
    (#​6866)

  • Fixed a thread-safety issue in LogRecordSharedPool.Rent().
    (#​6833)

  • Fixed observable instruments (ObservableCounter, ObservableUpDownCounter,
    ObservableGauge) continuing to export stale data points after a callback
    stops reporting a series.
    (#​5950)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.15.1

  • Breaking change: The Baggage API implements the latest Baggage API
    specification,
    which disallows empty baggage names and treats baggage names and values as case
    sensitive.
    (#​6931)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.1

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Console v1.15.1

  No notable changes.

  See CHANGELOG for details.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.15.1-beta.1

  • This package is deprecated and it will stop receiving any updates in
    March 2027. Use the OpenTelemetry API and SDK directly instead of the OpenTracing
    shims.
    (#​6976)

  • Updated OpenTelemetry core component version(s) to 1.15.1.
    (#​7010)

  See CHANGELOG for details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions