chore(deps): Bump the nuget-nonbreaking group with 4 updates

[dependabot]

Updated AWSSDK.S3 from 4.0.23.3 to 4.0.23.6.

Release notes

Sourced from AWSSDK.S3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated FluentFTP from 54.1.2 to 54.2.0.

Release notes

Sourced from FluentFTP's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated MessagePack from 3.1.4 to 3.1.6.

Release notes

Sourced from MessagePack's releases.

3.1.6

What's Changed

• Add several known unsafe 'gadgets' to the disallow list by @​AArnott in Add several known unsafe 'gadgets' to the disallow list MessagePack-CSharp/MessagePack-CSharp#2270

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

3.1.5

What's Changed

• Remove unneeded GetTypeInfo() calls by @​Bykiev in Remove unneeded GetTypeInfo() calls MessagePack-CSharp/MessagePack-CSharp#2206
• Use 'Write' instead of 'WriteInt32' for union type keys by @​VictorNicollet in Use 'Write' instead of 'WriteInt32' for union type keys MessagePack-CSharp/MessagePack-CSharp#2212
• Fix various disposable issues by @​Bykiev in Fix various disposable issues MessagePack-CSharp/MessagePack-CSharp#2224
• fix: prevent StackOverflow in Equals with recursive generic constraints by @​khuongntrd in fix: prevent StackOverflow in Equals with recursive generic constraints MessagePack-CSharp/MessagePack-CSharp#2226
• Add more types to the default disallow list of named types to be deserialized by @​AArnott in Add more types to the default disallow list of named types to be deserialized MessagePack-CSharp/MessagePack-CSharp#2256
• Fix release workflow by @​AArnott in Fix release workflow MessagePack-CSharp/MessagePack-CSharp#2268
• Fix Incorrect DateTimeOffset Serializer by @​T0PP1ng in Fix Incorrect DateTimeOffset Serializer MessagePack-CSharp/MessagePack-CSharp#2225
• Revert DateTimeOffset encoding change by @​AArnott in Revert DateTimeOffset encoding change MessagePack-CSharp/MessagePack-CSharp#2262

New Contributors

• @​Bykiev made their first contribution in Remove unneeded GetTypeInfo() calls MessagePack-CSharp/MessagePack-CSharp#2206
• @​VictorNicollet made their first contribution in Use 'Write' instead of 'WriteInt32' for union type keys MessagePack-CSharp/MessagePack-CSharp#2212
• @​T0PP1ng made their first contribution in Fix Incorrect DateTimeOffset Serializer MessagePack-CSharp/MessagePack-CSharp#2225
• @​khuongntrd made their first contribution in fix: prevent StackOverflow in Equals with recursive generic constraints MessagePack-CSharp/MessagePack-CSharp#2226

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore from 10.1.7 to 10.2.1.

Release notes

Sourced from Swashbuckle.AspNetCore's releases.

10.2.1

What's Changed

• Update Microsoft.OpenApi to 2.7.5 to pick up fix for GHSA-v5pm-xwqc-g5wc by @​martincostello in Update Microsoft.OpenApi to 2.7.5 domaindrivendev/Swashbuckle.AspNetCore#3974

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.0...v10.2.1

10.2.0

What's Changed

• Add MapSwaggerUI and MapReDoc to support endpoint routing by @​Strepto in Add MapSwaggerUI and MapReDoc to support endpoint routing domaindrivendev/Swashbuckle.AspNetCore#3822
• Bump version to 10.2.0 by @​martincostello in Bump version to 10.2.0 domaindrivendev/Swashbuckle.AspNetCore#3872
• Bump swagger-ui-dist from 5.32.1 to 5.32.2 by @​dependabot in Bump swagger-ui-dist from 5.32.1 to 5.32.2 in /src/Swashbuckle.AspNetCore.SwaggerUI domaindrivendev/Swashbuckle.AspNetCore#3883
• Support HEAD requests by @​snebjorn in Support HEAD requests domaindrivendev/Swashbuckle.AspNetCore#3887
• Use IAsyncSwaggerProvider in CLI tofile command by @​bt-Knodel in Use IAsyncSwaggerProvider in CLI tofile command domaindrivendev/Swashbuckle.AspNetCore#3910
• Pin runner images by @​martincostello in Pin runner images domaindrivendev/Swashbuckle.AspNetCore#3944
• Disable npm install scripts by @​martincostello in Disable npm install scripts domaindrivendev/Swashbuckle.AspNetCore#3946
• Bump redoc from 2.5.2 to 2.5.3 by @​dependabot in Bump redoc from 2.5.2 to 2.5.3 in /src/Swashbuckle.AspNetCore.ReDoc domaindrivendev/Swashbuckle.AspNetCore#3967

New Contributors

• @​Strepto made their first contribution in Add MapSwaggerUI and MapReDoc to support endpoint routing domaindrivendev/Swashbuckle.AspNetCore#3822
• @​snebjorn made their first contribution in Support HEAD requests domaindrivendev/Swashbuckle.AspNetCore#3887
• @​bt-Knodel made their first contribution in Use IAsyncSwaggerProvider in CLI tofile command domaindrivendev/Swashbuckle.AspNetCore#3910

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.7...v10.2.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This is an automated Dependabot PR updating NuGet packages. No code changes, only version number updates in src/slskd/slskd.csproj.

Security Analysis

Package	Old → New	Security Notes
MessagePack	3.1.4 → 3.1.6	Includes deserialization security hardening (adding unsafe gadgets to disallow list)
Swashbuckle.AspNetCore	10.1.7 → 10.2.1	CRITICAL SECURITY FIX: Includes fix for GHSA-v5pm-xwqc-g5wc via Microsoft.OpenApi 2.7.5
FluentFTP	54.1.2 → 54.2.0	Minor feature update
AWSSDK.S3	4.0.23.3 → 4.0.23.6	Patch update

Recommendation

APPROVED for merge. This PR updates Microsoft.OpenApi through Swashbuckle.AspNetCore with a critical security fix that should be prioritized. The MessagePack update also adds important deserialization security hardening.

Files Reviewed (1 file)

• src/slskd/slskd.csproj - Dependency version updates only

---

_{Reviewed by laguna-m.1-20260312:free · 638,951 tokens}