Visitar URL original
Bump the nuget-minor-and-patch group with 11 updates by dependabot[bot] · Pull Request #349 · bjschafer/pfapi · GitHub
Skip to content

Bump the nuget-minor-and-patch group with 11 updates - #349

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-minor-and-patch-7ea1940d07
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-minor-and-patch-7ea1940d07

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Updated AutoMapper from 16.1.1 to 16.3.0.

Release notes

Sourced from AutoMapper's releases.

16.3.0

Security

This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass MaxDepth and exhaust the stack. The resulting StackOverflowException can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data.

  • GHSA-6vhm-j9h7-f9gh: MaxDepth wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @​mcambria for the report.
  • GHSA-gpwp-5797-mjff: other recursion paths bypassed MaxDepth: derived maps, object and interface members, dictionary and dynamic sources, and recursive type converters.

CVE IDs have been requested and will be added here once they're assigned.

Behavior changes

  • Recursion that MaxDepth can't limit now throws a catchable InsufficientExecutionStackException instead of crashing the process.
  • Derived maps (Include / IncludeBase) now inherit MaxDepth and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set MaxDepth explicitly.
  • Constructor mapping now stops at the same depth as property mapping.
  • Condition on ForAllMembers, or any condition whose member parameter is object or a base type, now receives the source member value instead of the value converted to the destination type, when those types differ. This matches the documented contract. A null in a nullable source member is now seen as null rather than 0 or false (#​4655).

Other highlights

  • Fixed Context.Items are only available... exceptions with MaxDepth, which depended on registration or warmup order (#​4651)

  • License keys get a 30-day renewal grace period, which logs a warning instead of an error (#​4667)

  • Clearer license validation messages for malformed keys, client platforms and IdentityModel version mismatches (#​4670)

  • Whitespace is stripped from license keys (#​4663), and license validation is isolated from the host app's CryptoProviderFactory (#​4674)

  • What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v16.2.0...v16.3.0

16.2.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.1...v16.2.0

Commits viewable in compare view.

Updated dotnet-outdated-tool from 4.6.9 to 4.9.0.

Release notes

Sourced from dotnet-outdated-tool's releases.

4.9.0

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.8.1...v4.9.0

4.8.1

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.8.0...v4.8.1

4.8.0

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.7.2...v4.8.0

4.7.2

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.7.1...v4.7.2

4.7.1

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.7.0...v4.7.1

4.7.0

What's Changed

New Contributors

Full Changelog: dotnet-outdated/dotnet-outdated@v4.6.9...v4.7.0

Commits viewable in compare view.

Updated EntityFramework from 6.5.1 to 6.5.2.

Release notes

Sourced from EntityFramework's releases.

6.5.2

What's Changed

Full Changelog: dotnet/ef6@v6.5.1...v6.5.2

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.9 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.3 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Sqlite from 10.0.2 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.2 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Tools from 10.0.2 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Tools's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.0.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

18.10.1

What's Changed

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

18.10.0

What's Changed

Full Changelog: microsoft/vstest@v18.9.0...v18.10.0

18.9.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

Changes to tests and infra

18.5.1

What's Changed

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

18.4.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

18.3.0

What's Changed

Internal fixes and updates

New Contributors

Commits viewable in compare view.

Updated Npgsql.EntityFrameworkCore.PostgreSQL from 10.0.0 to 10.0.3.

Release notes

Sourced from Npgsql.EntityFrameworkCore.PostgreSQL's releases.

10.0.3

What's Changed

Full Changelog: npgsql/efcore.pg@v10.0.2...v10.0.3

10.0.2

Milestone issue

What's Changed

Full Changelog: npgsql/efcore.pg@v10.0.1...v10.0.2

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore from 10.1.2 to 10.3.1.

Release notes

Sourced from Swashbuckle.AspNetCore's releases.

10.3.1

What's Changed

Deprecations

[!IMPORTANT]
Swashbuckle.AspNetCore.ApiTesting.Xunit depended on Xunit v2, which is no longer supported.

The package has been removed and no further versions will be released.

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.3.0...v10.3.1

10.3.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.3...v10.3.0

10.2.3

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.2...v10.2.3

10.2.2

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.1...v10.2.2

10.2.1

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.0...v10.2.1

10.2.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.7...v10.2.0

10.1.7

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.6...v10.1.7

10.1.6

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.5...v10.1.6

10.1.5

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.4...v10.1.5

10.1.4

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.3...v10.1.4

10.1.3

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.2...v10.1.3

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps AutoMapper from 16.1.1 to 16.3.0
Bumps dotnet-outdated-tool from 4.6.9 to 4.9.0
Bumps EntityFramework from 6.5.1 to 6.5.2
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.9 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.3 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.2 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.2 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Tools from 10.0.2 to 10.0.14
Bumps Microsoft.NET.Test.Sdk from 18.0.1 to 18.11.0
Bumps Npgsql.EntityFrameworkCore.PostgreSQL from 10.0.0 to 10.0.3
Bumps Swashbuckle.AspNetCore from 10.1.2 to 10.3.1

---
updated-dependencies:
- dependency-name: AutoMapper
  dependency-version: 16.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: dotnet-outdated-tool
  dependency-version: 4.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: EntityFramework
  dependency-version: 6.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Tools
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: Npgsql.EntityFrameworkCore.PostgreSQL
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Swashbuckle.AspNetCore
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants