deps: Bump the dotnet-dependencies group with 12 updates by dependabot[bot] · Pull Request #77 · scottgal/mostlylucid.consoleimage

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

Release SSE response stream reference when GET request ends #1628 by @halter73 (co-authored by @joelmforsyth @Copilot)

Acknowledgements

@slomangino123 submitted issue #766 (resolved by #1628)

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

Commits viewable in compare view.

Updated SharpCompress from 0.49.1 to 0.50.4.

Release notes

Sourced from SharpCompress's releases.

0.50.3 What's Changed

Fix RAR5 async decompression corruption in UnpWriteBufAsync by @adamhathcock in Fix RAR5 async decompression corruption in UnpWriteBufAsync adamhathcock/sharpcompress#1396

Full Changelog: adamhathcock/sharpcompress@0.50.2...0.50.3

0.50.2 What's Changed

Fix SeekableSharpCompressStream.StopRecording() to rewind to recorded… by @adamhathcock in Fix SeekableSharpCompressStream.StopRecording() to rewind to recorded… adamhathcock/sharpcompress#1393

Full Changelog: adamhathcock/sharpcompress@0.50.1...0.50.2

0.50.1 What's Changed

Fix ArgumentException in ZlibBaseStream when disposing mid-stream GZip probe in ReaderFactory by @adamhathcock with @Copilot in Fix ArgumentException in ZlibBaseStream when disposing mid-stream GZip probe in ReaderFactory adamhathcock/sharpcompress#1371
Fixes ZipWriter to be fully forward only by @adamhathcock in Fixes ZipWriter to be fully forward only adamhathcock/sharpcompress#1372
Fix tar.gz reader detection for GZip archive entry streams by @adamhathcock with @Copilot in Fix tar.gz reader detection for GZip archive entry streams adamhathcock/sharpcompress#1376

Thanks for reporting!

Full Changelog: adamhathcock/sharpcompress@0.50.0...0.50.1

0.50.0

Breaking changes:

Tar Archive does not try to decompress streams anymore. TarReader will still do this.
Detection API changed.
CRC should be more complete and enabled by default

What's Changed

Reduce LZMA Allocations by @adamhathcock in Reduce LZMA Allocations adamhathcock/sharpcompress#1335
Minor updates by @adamhathcock in Minor updates adamhathcock/sharpcompress#1345
Reduce rar allocations by @adamhathcock in Reduce rar allocations adamhathcock/sharpcompress#1336
LeaveOpen wasn't respected by GZip by @adamhathcock in LeaveOpen wasn't respected by GZip adamhathcock/sharpcompress#1346
Add pooling for arrays for deflate by @adamhathcock in Add pooling for arrays for deflate adamhathcock/sharpcompress#1347
updates docs for latest changes and ArchiveInfo by @adamhathcock in updates docs for latest changes and ArchiveInfo adamhathcock/sharpcompress#1349
Instanced buffer size by @adamhathcock in Instanced buffer size adamhathcock/sharpcompress#1354
more complete CRC checking by @adamhathcock in more complete CRC checking adamhathcock/sharpcompress#1357
xz crc check by @adamhathcock in xz crc check adamhathcock/sharpcompress#1356
BZip2: add opt-in tolerateTruncatedStream to decode a footerless/partial stream by @fiddyschmitt in BZip2: add opt-in tolerateTruncatedStream to decode a footerless/partial stream adamhathcock/sharpcompress#1358
Zip: fix Zip64 streaming reader corrupting entry size/CRC and failing on non-seekable streams by @pathartl in Zip: fix Zip64 streaming reader corrupting entry size/CRC and failing on non-seekable streams adamhathcock/sharpcompress#1362
Remove compressed tar archive by @adamhathcock in Remove compressed tar archive adamhathcock/sharpcompress#1360

New Contributors

@fiddyschmitt made their first contribution in BZip2: add opt-in tolerateTruncatedStream to decode a footerless/partial stream adamhathcock/sharpcompress#1358

Full Changelog: adamhathcock/sharpcompress@0.49.1...0.50.0

Commits viewable in compare view.

Updated System.CommandLine from 2.0.9 to 2.0.10.

Release notes

Sourced from System.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Tmds.DBus.Protocol from 0.21.3 to 0.94.2.

Release notes

Sourced from Tmds.DBus.Protocol's releases.

0.94.2

Tmds.DBus.Generator

Support interfaces with more than 64 readable properties (#447).

0.94.1

Tmds.DBus.Generator

Fixed DBusHandler code only being generated for the last interface when generating handler types for multiple interfaces (#445).

0.94.0

Tmds.DBus.Protocol

Func<ValueTask> handler overloads added to avoid async void in user code (#440).

Tmds.DBus.Generator

[Breaking] IReadableXxxProperties has been replaced with a unified IXxxProperties interface. Write-only properties are uncommon and the separate interface made explicit interface implementations more verbose (#441).
Fix code generation for single-field D-Bus structs (#439).
DBusHandler.ParseInterface now ignores missing interface string on Properties requests (#442).

Documentation

Documentation rewritten into a single guide (#443).

0.93.0

Tmds.DBus.Protocol

[Breaking] Previously obsoleted types and APIs have been removed (#426):
- Connection - use DBusConnection instead.
- ConnectionOptions - use DBusConnectionOptions instead.
- ClientConnectionOptions - use DBusConnectionOptions instead.
- ClientSetupResult - use DBusConnectionOptions.SetupResult instead.
- Address - use DBusAddress instead.
- ActionException - use ObserverHandler instead.
- IMethodHandler - use IPathMethodHandler instead.
- DBusException - use DBusErrorReplyException instead.
- DisconnectedException - use DBusConnectionClosedException instead.
- ConnectException - use DBusConnectFailedException instead.
- ProtocolException - use DBusUnexpectedValueException instead.
- MethodContext.Connection - use MethodContext.DBusConnection instead.
AddMatchAsync overloads that accept Action<Exception?, T, object?, object?> are marked Obsolete. Use the new Action<Notification<T>> overloads instead (#427).
Notification<T> / Notification / NotificationType: new callback API for signal observers, replacing the Action<Exception?, T, ...> pattern. Notifications distinguish between value, owner change, and completion events (#427).
NameOwnerWatcher: tracks name ownership changes when calling methods and watching signals, enabling detection of service restarts. A DBusOwnerChangedException
is thrown when a method call targets an owner identifier from NameOwnerWatcher and the owner has changed (#425).
OnException handler on DBusConnectionOptions: provides exception reporting and disconnect control via the new ExceptionContext / ExceptionSource types (#431).

Tmds.DBus.Generator

The generator can now produce handler (server-side) types for implementing D-Bus interfaces. To generate handlers, set the DBusGeneratorMode property to Handler, to generate proxies set it to Proxy. (#429, #433)
[Breaking] Instead of a single action overload that accepts Action<Exception?, T>, the generator generates a simple overload that accepts Action<T> for users that are not interested in completion notifications, and an Action<Notification<T>> overload to be notified of completions. (#427)
[Breaking] To enable handler code to generate an IXxxProperties interface, the generated proxy code changed as follows:
- The GetPropertiesAsync method now returns the concrete XxxProperties class. When trying to get properties that were not set the get accessor throws. Alternatively, users can call GetNullablePropertiesAsync which returns an INullableXxxProperties interface which returns null for properties that are not set.
- The WatchPropertiesChanged methods use a new IChangedXxxProperties interface.

0.92.0

This release addresses vulnerabilities from malicious senders in Tmds.DBus and Tmds.DBus.Protocol:

Check the signal sender is the owner of the well-known name (fb41b95, b429873)
Prevent spilling of unix fds to the next message and limit the number to 16 per message (4800917, f90642d)
Prevent unhandled exceptions on SynchronizationContext due to a malformed body sent by a malicious sender. (f0d9d0b, a64b8b9)

Advisory: GHSA-xrw6-gwf8-vvr9

0.91.1

Tmds.DBus.Generator/Tmds.DBus.Tool:

ProtocolGenerator: fix alignment when reading structs. (ProtocolGenerator: fix alignment when reading structs. tmds/Tmds.DBus#422)

0.91.0

Changes:

Protocol: SignatureReader: mark type as Obsolete and remove dead code. (Protocol: SignatureReader: mark type as Obsolete and remove dead code. tmds/Tmds.DBus#416)

Bug fixes/improvements:

Protocol: change send message methods to be void instead of ValueTask. (Protocol: change send message methods to be void instead of ValueTask. tmds/Tmds.DBus#404)
Protocol: Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. (Reader: fix ReverseDoubleEndianness returning unreversed value on pre-.NET8 targets. tmds/Tmds.DBus#407)
Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). (Protocol.Reader: limit array sizes to D-Bus max array length (64 MiB). tmds/Tmds.DBus#408)
Protocol.Message: skip unknown header fields. (Protocol.Message: skip unknown header fields. tmds/Tmds.DBus#409)
Protocol: enforce D-Bus max message length (128 MiB) (Protocol: enforce D-Bus max message length (128 MiB) tmds/Tmds.DBus#410)
Fix DBusType.Signature alignment from 4 to 1. (Fix DBusType.Signature alignment from 4 to 1. tmds/Tmds.DBus#411)
Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. (Protocol: AddressReader: fix Unescape and TryGetNext off-by-one errors. tmds/Tmds.DBus#412)
Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. (Protocol: DBusAddress: improve resource cleanup for X11/Windows, refactor system/session address initialization. tmds/Tmds.DBus#413)
Protocol: Reader: enforce max recursion depth (64) when reading variant values. (Protocol: Reader: enforce max recursion depth (64) when reading variant values. tmds/Tmds.DBus#415)
Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. (Protocol: Reader: ensure ReadSpan throws DBusReadException when null terminator byte is missing. tmds/Tmds.DBus#414)
Protocol: Array/Struct/Dict: fix check for unsupported composite types. (Protocol: Array/Struct/Dict: fix check for unsupported composite types. tmds/Tmds.DBus#418)
Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. (Protocol: VariantValue: fix GetDictionaryEntry type check, fix GetStructFieldType out-of-bounds check. tmds/Tmds.DBus#417)
Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. (Protocol: MessageWriter: use Unsafe.SizeOf for JIT constant size. tmds/Tmds.DBus#419)
Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. (Protocol: PathNodeDictionary: simplify batch RemoveMethodHandlers. tmds/Tmds.DBus#420)

0.90.3

Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. (Revert the 0.90.0 change that passes reader/handler exceptions back to the handler. tmds/Tmds.DBus#403)

0.90.2

Tmds.DBus.Generator/Tmds.DBus.Tool:

ProtocolGenerator: fix codegen causing (string?)null-conversion instead of returning default(ObjectPath?) for ObjectPath properties. (ProtocolGenerator: fix codegen causing (string?)null-conversion instead of returning default(ObjectPath?) for ObjectPath properties. tmds/Tmds.DBus#402)

0.90.1

Tmds.DBus.Generator:

Lower expected version of Microsoft.CodeAnalysis.CSharp to 4.12.0 (Downgrade Microsoft.CodeAnalysis.CSharp to version 4.12.0 tmds/Tmds.DBus#400)

0.90.0 Tmds.DBus.Protocol

This release does some refactoring which requires changes from the user. The version is binary compatible with the previous version. Obsolete attributes indicate what changes a user should make.

These types have been renamed to be less generic:

`Connection` -> `DBusConnection` (https://github.com/tmds/Tmds.DBus/pull/373)
`Address` -> `DBusAddress` (https://github.com/tmds/Tmds.DBus/pull/372)
`ActionException` -> `ObserverHandler` (https://github.com/tmds/Tmds.DBus/pull/371)

When you have code that requires the Connection type, you can call DBusConnection.AsConnection().

The exception types have been refactored. A base type is introduced for connection related errors, and one for errors related to a received message. These base types also share a common base. (Protocol: refactor exception types. tmds/Tmds.DBus#370, Protocol: add DBusReaderException and throw it when the Read operation and data being read mismatch. tmds/Tmds.DBus#385, Protocol: add DBusReplyException that deprecates ProtocolException, and which serves as a base for DBusReplyException (previously: DBusException/DBusMethodException). tmds/Tmds.DBus#386, Protocol: fiddle with the exception types a bit more. tmds/Tmds.DBus#387).

DBusExceptionBase
├── DBusConnectionException
│   ├── DBusConnectionClosedException
│   │   └── DisconnectedException (obsolete -> DBusConnectionClosedException)
│   └── DBusConnectFailedException
│       └── ConnectException (obsolete -> DBusConnectFailedException)
└── DBusMessageException
    ├── DBusReadException
    ├── DBusErrorReplyException
    │   └── DBusException (obsolete -> DBusErrorReplyException)
    └── DBusUnexpectedValueException
        └── ProtocolException (obsolete -> DBusUnexpectedValueException)

Behavioral changes:

The Reader throws DBusReadException when the message body and the read operations mismatch. When trying to read a handle that was already read, it throws DBusUnexpectedValueException. (Protocol: add DBusReaderException and throw it when the Read operation and data being read mismatch. tmds/Tmds.DBus#385, Protocol: throw DBusUnexpectedValueException instead of InvalidOperationException when handle was already read. tmds/Tmds.DBus#399)
When an observer reader/handler throws, we stop observing and pass the exception to the handler. (Protocol: when reader/handler throw, stop observing and pass the exception to the handler. tmds/Tmds.DBus#395)
Message.SignatureAsString return an empty string when the signature header is omitted. (Protocol: Message: make SignatureAsString return an empty string when the header is omitted. tmds/Tmds.DBus#384)
Reader.ReadHandle methods return a non-null handle to avoid user having to do null-handling. (Protocol: make ReadHandle methods return a non-null handle to avoid user having to do null-handling. tmds/Tmds.DBus#364)

New APIs:

A new DBusService type represents a peer reachable via the connection. (Protocol: add DBusService type which represents a named connection. tmds/Tmds.DBus#374)
A new DBusObject type may be used as a base class for proxy classes. (Protocol: add a DBusObject base class. Add connection methods for watching signals and property changes. tmds/Tmds.DBus#376)
A new SkipSafeHandle type may be used with the Reader.ReadHandle/VariantValue.ReadHandle method to indicate a handle should not be read. This enables letting the user decide to skip reading the handle or not through what generic argument they are passing. (Protocol: add SkipSafeHandle class as a way to skip reading handles so other readers can still consume them. tmds/Tmds.DBus#363)
New methods are added to DBusConnection for watching signals and property changes. (Protocol: add a DBusObject base class. Add connection methods for watching signals and property changes. tmds/Tmds.DBus#376)

Tmds.DBus.Generator

This new package provides a Roslyn source generator that performs code generation for the Tmds.DBus.Protocol API. Only proxies are supported. (Add Tmds.DBus.Protocol.SourceGenerator: a source generator for the Protocol library. tmds/Tmds.DBus#378)

Documentation

... (truncated)

0.23.0

Tmds.DBus.Protocol:

Protocol: add hierarchical path support and improved async handling for method handling. (#360)
Protocol: use non-blocking SynchronizationContext.Post instead of Send for callbacks. (#361)

0.22.0

Tmds.DBus:

Fix libX11 library name. (Fix libX11 library name. tmds/Tmds.DBus#353)

Tmds.DBus.Protocol:

Use .NET 9 System.Threading.Lock (Use .NET 9 System.Threading.Lock. tmds/Tmds.DBus#331)
Fix libX11 library name. (Fix libX11 library name. tmds/Tmds.DBus#353)
Remove obsolete APIs (Protocol: Remove obsolete code tmds/Tmds.DBus#355)
Add request/release name APIs (Protocol: add request/release name APIs (similar to those of Tmds.DBus). tmds/Tmds.DBus#356)

Tmds.DBus.Tool:

codegen: remove unused invalidated list (Protocol: remove unused invalidated list tmds/Tmds.DBus#334)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Avalonia from 11.3.18 to 11.3.19 Bumps Avalonia.Desktop from 11.3.18 to 11.3.19 Bumps Avalonia.Fonts.Inter from 11.3.18 to 11.3.19 Bumps Avalonia.Themes.Fluent from 11.3.18 to 11.3.19 Bumps Microsoft.Extensions.Configuration.Binder from 10.0.9 to 10.0.10 Bumps Microsoft.Extensions.FileSystemGlobbing from 10.0.9 to 10.0.10 Bumps Microsoft.Extensions.Hosting from 10.0.9 to 10.0.10 Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1 Bumps ModelContextProtocol from 1.4.0 to 1.4.1 Bumps SharpCompress from 0.49.1 to 0.50.4 Bumps System.CommandLine from 2.0.9 to 2.0.10 Bumps Tmds.DBus.Protocol from 0.21.3 to 0.94.2 --- updated-dependencies: - dependency-name: Avalonia dependency-version: 11.3.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Avalonia.Desktop dependency-version: 11.3.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Avalonia.Fonts.Inter dependency-version: 11.3.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Avalonia.Themes.Fluent dependency-version: 11.3.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Extensions.FileSystemGlobbing dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Extensions.Hosting dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: ModelContextProtocol dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: SharpCompress dependency-version: 0.50.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: System.CommandLine dependency-version: 2.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Tmds.DBus.Protocol dependency-version: 0.94.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-10T02:41:36Z

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026

Navigation Menu

deps: Bump the dotnet-dependencies group with 12 updates - #77

deps: Bump the dotnet-dependencies group with 12 updates#77
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/ConsoleImage.Core.Tests/dotnet-dependencies-b9f4db4e77

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

18.8.1

What's Changed

18.8.0

What's Changed

1.4.1

What's Changed

Acknowledgements

0.50.3

What's Changed

0.50.2

What's Changed

0.50.1

What's Changed

0.50.0

What's Changed

New Contributors

0.94.2

Tmds.DBus.Generator

0.94.1

Tmds.DBus.Generator

0.94.0

Tmds.DBus.Protocol

Tmds.DBus.Generator

Documentation

0.93.0

0.93.0

Tmds.DBus.Protocol

Tmds.DBus.Generator

0.92.0

0.91.1

0.91.0

0.90.3

0.90.2

0.90.1

0.90.0

Tmds.DBus.Protocol

Tmds.DBus.Generator

Documentation

0.23.0

0.22.0

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants