Skip to content

Bump FastEndpoints and 30 others - #19

Merged
w0rldx merged 2 commits into
developfrom
dependabot/nuget/develop/nuget-remaining-26ec8ed005
Aug 23, 2026
Merged

Bump FastEndpoints and 30 others#19
w0rldx merged 2 commits into
developfrom
dependabot/nuget/develop/nuget-remaining-26ec8ed005

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pinned FastEndpoints at 8.3.0.

Release notes

Sourced from FastEndpoints's releases.

8.3

⚠️ Goal Sponsorship Level Not Yet Met ⚠️

Please join the discussion here and help out if you can.

New 🎉

'FastEndpoints.CommandRules' package for rule-based command dispatch

A new FastEndpoints.CommandRules package is now available for turning arbitrary input into one or more commands using small, ordered rules.

It's useful when an application event, webhook payload, request DTO, or domain object needs to fan out into different command-bus actions without putting branching logic in endpoints or handlers. Rules evaluate the input, build a command plan, and the dispatcher executes the selected commands immediately or queues them as jobs.

// map input model to a rule
bld.Services.AddCommandRules(o => o.Register<OrderPlaced, OrderPlacedRule>());

// define the rule to specify which commands should execute
sealed class OrderPlacedRule : CommandRule<OrderPlaced>
{
    public override bool CanHandle(OrderPlaced input)
        => input.IsPaid;

    public override IEnumerable<PlannedCommand> Build(OrderPlaced input)
    {
        yield return PlannedCommand.Create(new ReserveStock(input.OrderId));

        if (input.SendReceipt)
        {
            yield return new PlannedCommand(new SendReceipt(input.OrderId))
            {
                Mode = CommandDispatchMode.QueueAsJob
            };
        }
    }
}

// inject ICommandDispatcher<OrderPlaced> where the event/input is handled
await dispatcher.DispatchAsync(orderPlaced, ct);
Cached 'AppFixture' WAF disposal hook

... (truncated)

Commits viewable in compare view.

Pinned FastEndpoints.Swagger at 8.3.0.

Release notes

Sourced from FastEndpoints.Swagger's releases.

8.3

⚠️ Goal Sponsorship Level Not Yet Met ⚠️

Please join the discussion here and help out if you can.

New 🎉

'FastEndpoints.CommandRules' package for rule-based command dispatch

A new FastEndpoints.CommandRules package is now available for turning arbitrary input into one or more commands using small, ordered rules.

It's useful when an application event, webhook payload, request DTO, or domain object needs to fan out into different command-bus actions without putting branching logic in endpoints or handlers. Rules evaluate the input, build a command plan, and the dispatcher executes the selected commands immediately or queues them as jobs.

// map input model to a rule
bld.Services.AddCommandRules(o => o.Register<OrderPlaced, OrderPlacedRule>());

// define the rule to specify which commands should execute
sealed class OrderPlacedRule : CommandRule<OrderPlaced>
{
    public override bool CanHandle(OrderPlaced input)
        => input.IsPaid;

    public override IEnumerable<PlannedCommand> Build(OrderPlaced input)
    {
        yield return PlannedCommand.Create(new ReserveStock(input.OrderId));

        if (input.SendReceipt)
        {
            yield return new PlannedCommand(new SendReceipt(input.OrderId))
            {
                Mode = CommandDispatchMode.QueueAsJob
            };
        }
    }
}

// inject ICommandDispatcher<OrderPlaced> where the event/input is handled
await dispatcher.DispatchAsync(orderPlaced, ct);
Cached 'AppFixture' WAF disposal hook

... (truncated)

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.151 to 3.0.177.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.177

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.177

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.176...3.0.177

3.0.176

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.176

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.175...3.0.176

3.0.175

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.175

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.174...3.0.175

3.0.174

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.174

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.173...3.0.174

3.0.173

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.173

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.172...3.0.173

3.0.172

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.172

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.171...3.0.172

3.0.171

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.171

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.170...3.0.171

3.0.170

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.170

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.169...3.0.170

3.0.169

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.169

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.168...3.0.169

3.0.168

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.168

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.167...3.0.168

3.0.167

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.167

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.166...3.0.167

3.0.166

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.166

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.165...3.0.166

3.0.165

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.165

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.164...3.0.165

3.0.164

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.164

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.163...3.0.164

3.0.163

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.163

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.162...3.0.163

3.0.162

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.162

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.161...3.0.162

3.0.161

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.161

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.159...3.0.161

3.0.159

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.159

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.158...3.0.159

3.0.158

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.158

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.157...3.0.158

3.0.157

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.157

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.156...3.0.157

3.0.156

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.156

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.155...3.0.156

3.0.155

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.155

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.154...3.0.155

3.0.154

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.154

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.153...3.0.154

3.0.153

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.153

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.152...3.0.153

3.0.152

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.152

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.151...3.0.152

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.Identity.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.SignalR.Client from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.SignalR.Client's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Sqlite from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Tools from 10.0.9 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Tools's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Client from 4.85.2 to 4.88.0.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.88.0

New Features

  • Added user-assigned managed identity support for Azure Arc, including selecting the identity by client ID and validating the identity returned in the token response. #​6128
  • Added WithRequestOverMtls() to managed identity token requests, enabling attested bearer-token acquisition over the IMDSv2 mTLS transport. #​6086

Bug Fixes

  • Fixed token-cache key collisions by length-prefixing additional cache-key components before hashing. #​6137
  • Populated authentication-result telemetry metadata on proactive background-refresh results. #​6157
  • Fixed mTLS PoP authority validation incorrectly rejecting sovereign-cloud aliases such as login.chinacloudapi.cn and login.usgovcloudapi.net. #​6153

4.87.0

What's Changed

  • Expose MsalServiceException.ErrorCodesForLogging for diagnostics in #​6138
  • Expose WithOtelTagsEnricher for managed identity requests in #​6144
  • Forward OpenTelemetry tags enricher to the client-assertion callback in #​6142
  • Add client-side opaque-token log scrubber in #​6119
  • Populate ExecutionResult.Exception for non-MSAL failures in #​6139
  • Use PSS padding in KeyGuard liveness probe (CodeQL SM03799) in #​6141
  • Remove managed identity support from WithClaimsFromClient (confidential-client only) in #​6113
  • Remove experimental features from client setup in #​6143
  • Update Azure Arc managed identity API version from 2019-11-01 to 2020-06-01 in #​6130

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.86.1...4.87.0

4.86.1

Bug Fixes

  • Fixed the mTLS Proof-of-Possession token cache to key on the certificate's full DER (x5t#S256) instead of only the public key, preventing a stale token (and AADSTS500181) after a same-key certificate renewal. #​6123
  • Fell back to RS256 when a certificate's PSS signing operation is rejected by RSACryptoServiceProvider, rebuilding the client assertion so authentication can proceed. #​6126
  • Detect and reject symbolic links in the Unix cache-file write path (lstat pre-check plus O_NOFOLLOW), closing a TOCTOU window. #​6115
  • Corrected misleading "region required" error messages and doc comments in the mTLS PoP flow. #​6127

4.86.0

What's Changed

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.2...4.86.0

Commits viewable in compare view.

Updated Microsoft.Identity.Client.Extensions.Msal from 4.85.2 to 4.88.0.

Release notes

Sourced from Microsoft.Identity.Client.Extensions.Msal's releases.

4.88.0

New Features

  • Added user-assigned managed identity support for Azure Arc, including selecting the identity by client ID and validating the identity returned in the token response. #​6128
  • Added WithRequestOverMtls() to managed identity token requests, enabling attested bearer-token acquisition over the IMDSv2 mTLS transport. #​6086

Bug Fixes

  • Fixed token-cache key collisions by length-prefixing additional cache-key components before hashing. #​6137
  • Populated authentication-result telemetry metadata on proactive background-refresh results. #​6157
  • Fixed mTLS PoP authority validation incorrectly rejecting sovereign-cloud aliases such as login.chinacloudapi.cn and login.usgovcloudapi.net. #​6153

4.87.0

What's Changed

  • Expose MsalServiceException.ErrorCodesForLogging for diagnostics in #​6138
  • Expose WithOtelTagsEnricher for managed identity requests in #​6144
  • Forward OpenTelemetry tags enricher to the client-assertion callback in #​6142
  • Add client-side opaque-token log scrubber in #​6119
  • Populate ExecutionResult.Exception for non-MSAL failures in #​6139
  • Use PSS padding in KeyGuard liveness probe (CodeQL SM03799) in #​6141
  • Remove managed identity support from WithClaimsFromClient (confidential-client only) in #​6113
  • Remove experimental features from client setup in #​6143
  • Update Azure Arc managed identity API version from 2019-11-01 to 2020-06-01 in #​6130

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.86.1...4.87.0

4.86.1

Bug Fixes

  • Fixed the mTLS Proof-of-Possession token cache to key on the certificate's full DER (x5t#S256) instead of only the public key, preventing a stale token (and AADSTS500181) after a same-key certificate renewal. #​6123
  • Fell back to RS256 when a certificate's PSS signing operation is rejected by RSACryptoServiceProvider, rebuilding the client assertion so authentication can proceed. #​6126
  • Detect and reject symbolic links in the Unix cache-file write path (lstat pre-check plus O_NOFOLLOW), closing a TOCTOU window. #​6115
  • Corrected misleading "region required" error messages and doc comments in the mTLS PoP flow. #​6127

4.86.0

What's Changed

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.2...4.86.0

Commits viewable in compare view.

Updated Microsoft.IdentityModel.JsonWebTokens from 8.19.2 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.JsonWebTokens's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

Commits viewable in compare view.

Updated Microsoft.Playwright from 1.61.0 to 1.62.0.

Release notes

Sourced from Microsoft.Playwright's releases.

1.62.0

🖼️ WebP screenshots

page.screenshot() and locator.screenshot() can now capture screenshots in the WebP format — Playwright infers the format from a .webp file extension, or you can set the type explicitly. Quality 100 (the default) is lossless, while lower values use lossy compression:

await Page.ScreenshotAsync(new() { Path = "homepage.webp", Quality = 50 });

New APIs

  • New Scroll option (Auto | None) on actions to opt out of Playwright's automatic scroll-into-view.
  • New Locator.WaitForFunctionAsync() waits until a function — called with the matching element — returns a truthy value.
  • New APIResponse.TimingAsync() returns resource timing information for an API response.

Announcements

  • 📋 The clipboard is now isolated from the operating system in headless mode, so tests that use navigator.clipboard no longer read or overwrite the clipboard of the machine running them.
  • ⚠️ Debian 11 is not supported anymore.

Browser Versions

  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151

Commits viewable in compare view.

Updated ModelContextProtocol from 2.0.0 to 2.2.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

  • Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #​1796 by @​saicharanpardhu (co-authored by @​Copilot @​jeffhandley)
  • Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #​1805 by @​latent-9

Test Improvements

  • Fix duplicated word in test comment #​1809 by @​latent-9

Repository Infrastructure Updates

  • Enable package validation for the MCP extension packages #​1793 by @​jeffhandley (co-authored by @​Copilot)
  • Add a release-manager agent that orchestrates the release skills #​1794 by @​jeffhandley (co-authored by @​Copilot)
  • Bump Anthropic from 12.39.0 to 12.40.0 #​1808
  • Bump @​hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #​1812
  • Fix dead relative link to versioning docs in bump-version skill #​1807 by @​latent-9

Acknowledgements

  • @​latent-9 made their first contribution in #​1807
  • @​saicharanpardhu made their first contribution in #​1796
  • @​saicharanpardhu submitted issue #​1777 (resolved by #​1796)
  • @​jeffhandley @​tarekgh @​halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

  • Keep AutoDetect channel open after provisional SSE failure #​1768 by @​PranavSenthilnathan
  • Preserve HTTP status codes across target frameworks #​1767 by @​PranavSenthilnathan
  • Fall back to initialize when server/discover fails at the HTTP layer #​1766 by @​rbstp
  • Add public subscriptions/listen server handler (SEP-2575) #​1775 by @​tarekgh

Documentation Updates

  • Add README for the InMemoryTransport sample #​1769 by @​AkbarDizaji
  • Add Application Insights telemetry example #​1778 by @​lntutor
  • Clarify client handling of embedded binary tool resources #​1762 by @​luisangelrod

Test Improvements

  • Speed up CLI argument escaping tests #​1773 by @​PranavSenthilnathan

Repository Infrastructure Updates

  • Clarify AI disclosure format with a > [!NOTE] alert example #​1771 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Bump the npm_and_yarn group across 1 directory with 6 updates #​1787
  • Avoid reading Configuration in Directory.Build.props #​1776 by @​lntutor
  • Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #​1784

Acknowledgements

  • @​AkbarDizaji made their first contribution in #​1769
  • @​luisangelrod made their first contribution in #​1762
  • @​rbstp submitted issue #​1765 (resolved by #​1766)
  • @​TomasHubelbauer submitted issue #​1026 (resolved by #​1778)
  • @​Youssef1313 submitted issue #​995 (resolved by #​1766)
  • @​eng-marani submitted issue #​1261 (resolved by #​1762)
  • @​jeffhandley @​tarekgh @​halter73 @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

Commits viewable in compare view.

Pinned OpenTelemetry.Exporter.OpenTelemetryProtocol at 1.18.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0-rc.1

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0-rc.1

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0-rc.1

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

    See CHANGELOG for details.

... (truncated)

1.18.0-beta.1

The following changes are from the previous release 1.17.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • Fixed the interaction between PrometheusAspNetCoreOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

    • Fixed a race where a slow scrape could return an HTTP 200 instead of 408.
      (#​7615)

    • Updated OpenTelemetry core component version(s) to 1.18.0.
      (#​7674)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • A scrape which is still collecting when the listener is disposed now returns an HTTP 503 response.
      (#​7587)

    • Shutting down the listener no longer waits indefinitely for its request processing loop to stop, and no longer throws if the loop faulted.
      (#​7587)

    • Fixed the interaction between PrometheusHttpListenerOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

... (truncated)

Commits viewable in compare view.

Pinned OpenTelemetry.Extensions.Hosting at 1.18.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0-rc.1

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0-rc.1

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0-rc.1

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

    See CHANGELOG for details.

... (truncated)

1.18.0-beta.1

The following changes are from the previous release 1.17.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • Fixed the interaction between PrometheusAspNetCoreOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

    • Fixed a race where a slow scrape could return an HTTP 200 instead of 408.
      (#​7615)

    • Updated OpenTelemetry core component version(s) to 1.18.0.
      (#​7674)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • A scrape which is still collecting when the listener is disposed now returns an HTTP 503 response.
      (#​7587)

    • Shutting down the listener no longer waits indefinitely for its request processing loop to stop, and no longer throws if the loop faulted.
      (#​7587)

    • Fixed the interaction between PrometheusHttpListenerOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

... (truncated)

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.AspNetCore at 1.18.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.18.0

1.18.0-rc.1

1.18.0-beta.2

1.18.0-beta.1

  • NuGet: OpenTelemetry.Exporter.Geneva v1.18.0-beta.1

    • Fixed a metric TLV serialization issue where an exemplar whose filtered tags
      serialized to more than 255 bytes caused the payload to be corrupted.
      (#​4856)

    • Renamed the PrivatePreviewEnableOtlpProtobufEncoding connection string switch
      to EnableOtlpProtobufEncoding. The old PrivatePreviewEnableOtlpProtobufEncoding
      switch is no longer supported.
      (#​4920)

    • Fixed a regression introduced in 1.17.0 where EtwDataTransport prepended a
      synthetic 4-byte length field to the ETW payload for logs and traces, causing
      the agent to reject the data with "Bad forward protocol format". The raw
      payload is once again written as a single unframed field.
      (#​4941)

    See CHANGELOG for details.

1.18.0-alpha.1

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.Http at 1.18.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.18.0

1.18.0-rc.1

1.18.0-beta.2

1.18.0-beta.1

  • NuGet: OpenTelemetry.Exporter.Geneva v1.18.0-beta.1

    • Fixed a metric TLV serialization issue where an exemplar whose filtered tags
      serialized to more than 255 bytes caused the payload to be corrupted.
      (#​4856)

    • Renamed the PrivatePreviewEnableOtlpProtobufEncoding connection string switch
      to EnableOtlpProtobufEncoding. The old PrivatePreviewEnableOtlpProtobufEncoding
      switch is no longer supported.
      (#​4920)

    • Fixed a regression introduced in 1.17.0 where EtwDataTransport prepended a
      synthetic 4-byte length field to the ETW payload for logs and traces, causing
      the agent to reject the data with "Bad forward protocol format". The raw
      payload is once again written as a single unframed field.
      (#​4941)

    See CHANGELOG for details.

1.18.0-alpha.1

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.Runtime at 1.18.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.18.0

1.18.0-rc.1

1.18.0-beta.2

Description has been truncated

@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 22, 2026
@dependabot
dependabot Bot requested a review from w0rldx as a code owner August 22, 2026 17:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Aug 22, 2026
@dependabot dependabot Bot changed the title Bump the nuget-remaining group with 31 updates Bump FastEndpoints and 30 others Aug 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/nuget/develop/nuget-remaining-26ec8ed005 branch 2 times, most recently from b32c507 to b3a5a16 Compare August 22, 2026 23:52
@w0rldx

w0rldx commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Added a maintainer commit (4d482f7) bumping ModelContextProtocol.AspNetCore to 2.2.0 alongside ModelContextProtocol. AspNetCore takes an exact dependency on the matching build, so the split bump failed restore everywhere (NU1608/NU1107) — which also blocked the license generator. Also regenerated the license manifest for all 31 moves. Verified locally: clean restore, Release build 0 errors, licenses/openapi/validate gates pass.

@w0rldx

w0rldx commented Aug 23, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@w0rldx
w0rldx force-pushed the dependabot/nuget/develop/nuget-remaining-26ec8ed005 branch from 4d482f7 to 1827f95 Compare August 23, 2026 17:53
@w0rldx

w0rldx commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Dependabot declined to rebase this branch (it carries a maintainer commit), so I rebased it manually onto develop @9dc04636 — which now includes #18, #20, #21, #23, #26 and #27. Microsoft.Agents.AI.Abstractions 1.19.0 from #18 is preserved, the ModelContextProtocol pair stays in lockstep at 2.2.0, and third-party-licenses.generated.json was regenerated against the new develop rather than merged textually. Verified locally on the rebased head: clean restore, Release build 0 errors, licenses:check / openapi:check / validate all pass, and the full backend suite at 6865 pass / 0 fail.

@w0rldx w0rldx mentioned this pull request Aug 23, 2026
Merged
dependabot Bot and others added 2 commits August 23, 2026 21:40
@dependabot @w0rldx
Bump FastEndpoints and 30 others
60dab78 
Bumps FastEndpoints from 8.2.0 to 8.3.0
Bumps FastEndpoints.Swagger from 8.2.0 to 8.3.0
Bumps Meziantou.Analyzer from 3.0.151 to 3.0.177
Bumps Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.9 to 10.0.11
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.9 to 10.0.11
Bumps Microsoft.AspNetCore.SignalR.Client from 10.0.9 to 10.0.11
Bumps Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.11
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.11
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.9 to 10.0.11
Bumps Microsoft.EntityFrameworkCore.Tools from 10.0.9 to 10.0.11
Bumps Microsoft.Identity.Client from 4.85.2 to 4.88.0
Bumps Microsoft.Identity.Client.Extensions.Msal from 4.85.2 to 4.88.0
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.19.2 to 8.22.0
Bumps Microsoft.Playwright from 1.61.0 to 1.62.0
Bumps ModelContextProtocol from 2.0.0 to 2.2.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.17.0 to 1.18.0
Bumps PdfPig from 0.1.15 to 0.1.16
Bumps Quartz from 3.18.2 to 3.19.1
Bumps Quartz.Extensions.Hosting from 3.18.2 to 3.19.1
Bumps Quartz.Plugins from 3.18.2 to 3.19.1
Bumps Quartz.Plugins.TimeZoneConverter from 3.18.2 to 3.19.1
Bumps Quartz.Serialization.SystemTextJson from 3.18.2 to 3.19.1
Bumps Serilog from 4.3.1 to 4.4.0
Bumps SonarAnalyzer.CSharp from 10.32.0.713 to 10.33.0.1635
Bumps System.Numerics.Tensors from 10.0.10 to 10.0.11
Bumps TUnit from 1.65.0 to 1.65.38
Bumps UTF.Unknown from 2.6.0 to 2.7.0

---
updated-dependencies:
- dependency-name: FastEndpoints
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: FastEndpoints.Swagger
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.177
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.AspNetCore.SignalR.Client
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.EntityFrameworkCore.Tools
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Microsoft.Identity.Client
  dependency-version: 4.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Microsoft.Identity.Client.Extensions.Msal
  dependency-version: 4.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Microsoft.Playwright
  dependency-version: 1.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: ModelContextProtocol
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: PdfPig
  dependency-version: 0.1.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: Quartz
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Quartz.Extensions.Hosting
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Quartz.Plugins
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Quartz.Plugins.TimeZoneConverter
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Quartz.Serialization.SystemTextJson
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: Serilog
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.33.0.1635
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
- dependency-name: System.Numerics.Tensors
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: TUnit
  dependency-version: 1.65.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-remaining
- dependency-name: UTF.Unknown
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-remaining
...

Signed-off-by: dependabot[bot] <support@github.com>
@w0rldx
fix(deps): move ModelContextProtocol.AspNetCore with ModelContextProt…
b22f6d0 
…ocol

The group bumped ModelContextProtocol to 2.2.0 and left
ModelContextProtocol.AspNetCore on 2.0.0, which takes an exact dependency
on ModelContextProtocol 2.0.0. Under central transitive pinning that is
NU1608 in four test projects and NU1107 in the client, so every project
failed to restore and the license generator could not enumerate the
backend packages either.

Bump the pair together and regenerate the license manifest for all 31
package moves. 2.2.0 still pulls Microsoft.Extensions.Hosting.Abstractions
10.0.10, so the pin above it stands; the comment naming 2.0.0 is refreshed.

Newtonsoft.Json 13.0.4 is new in the manifest as a design-time transitive
of Microsoft.EntityFrameworkCore.Design 10.0.11; 13.0.3 was already there
under FastEndpoints.Swagger. No license field changes.
@w0rldx
w0rldx force-pushed the dependabot/nuget/develop/nuget-remaining-26ec8ed005 branch from 1827f95 to b22f6d0 Compare August 23, 2026 19:42
@w0rldx

w0rldx commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Rebased onto develop @d08096d6, which now carries the group2 test-isolation fix (#28). Head is b22f6d07.

Replayed clean. Verified rather than assumed: the ModelContextProtocol pair is still in lockstep at 2.2.0, Microsoft.Agents.AI.Abstractions is still 1.19.0 from #18, and the license manifest needs no regeneration — #28 touched only test files and docs/agent-knowledge.md, and the manifest is byte-identical across that merge. The diff against develop is still exactly the two expected files. Clean restore and a Release build with 0 errors locally.

@w0rldx
w0rldx merged commit 09aaaf5 into develop Aug 23, 2026
9 checks passed
@dependabot
dependabot Bot deleted the dependabot/nuget/develop/nuget-remaining-26ec8ed005 branch August 23, 2026 20:02
w0rldx added a commit that referenced this pull request Aug 23, 2026
@w0rldx
chore(deps): keep the ModelContextProtocol packages on one version
6509d45 
ModelContextProtocol.AspNetCore takes an exact dependency on the matching
ModelContextProtocol build, so the nuget-remaining catch-all could bump one
without the other. Dependabot #19 did exactly that (2.2.0 against a pinned
2.0.0) and every project failed restore with NU1107/NU1608 under central
transitive pinning.

Group the pair the way the Aspire and Agents families already are, and lock
the tuple with a test so the split fails locally instead of in CI restore.
w0rldx added a commit that referenced this pull request Aug 24, 2026
@w0rldx
fix(compliance): map the bumped NuGet licenses to their upstream texts
f5ca110 
The v1.0.0-rc.2 release run failed the linux build-pack job at "Generate
exact backend NuGet legal corpus":

  ValueError: package FastEndpoints/8.3.0 has author-only MIT metadata and
  no exact upstream license mapping

generate_backend_license_corpus.py keys its curated license texts on the
exact (package, version, expression) triple, so a dependency bump silently
invalidates the mapping until the curated text is re-pinned. The PR #19
dependency wave moved three families past their pins. The generator fails
on the first offender, so the log named only FastEndpoints; reproducing the
step locally and walking the whole selection found nine shipped packages
across three families:

  - FastEndpoints and its six sibling packages 8.2.0 -> 8.3.0
  - TimeZoneConverter 7.0.0 -> 7.2.0
  - UTF.Unknown 2.6.0 -> 2.7.0 (MPL-1.1 text plus its source-availability
    notice, which carries the pinned upstream commit)

Each curated text is re-fetched from the upstream release commit and
recorded with the existing provenance convention (raw.githubusercontent
URL pinned at an immutable commit, retrieval date, SHA-256). All three
license texts are byte-identical to the versions they replace; only the
provenance pin moves. FastEndpoints tags stable releases as v8.3, matching
how the superseded 8.2.0 pin resolved to the v8.2 tag commit.

Also refreshed, because they state the shipped version and would otherwise
misdirect the release operator:

  - the UTF.Unknown override in nuget-license-overrides.json, still pinned
    at 2.6.0 and therefore no longer applied (nuget-license reported
    LicenseInformationOrigin 0, the nuspec, instead of 4, the override)
  - docs/compliance/utf-unknown-mpl-source-availability.md, whose component
    table contradicted Directory.Packages.props
  - the UTF.Unknown item in docs/release-publication-checklist.md, which
    named the superseded tag and commit to verify

Verified for both RIDs: the generator now exits 0 over 131 shipped packages
for linux-x64 and win-x64.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@w0rldx w0rldx Awaiting requested review from w0rldx w0rldx is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@w0rldx