Visitar URL original
Bump the minor-and-patch group with 21 updates by dependabot[bot] · Pull Request #14 · crafters-cloud/crafters-cloud-core · GitHub
Skip to content

Bump the minor-and-patch group with 21 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-7355cc1501
Open

Bump the minor-and-patch group with 21 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/minor-and-patch-7355cc1501

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 14, 2026

Copy link
Copy Markdown

Updated Aspire.Hosting.Testing from 13.6.0 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

13.6.1

What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.

🐛 Fixes

  • 📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #​20725. (#​20747, backport of #​20736, @​JamesNK)

  • 📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #​20728. (#​20762, backport of #​20758, @​heyysiri)

  • 🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#​20545, backport of #​20527, @​JamesNK)

  • 🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical Watch task over Kubernetes ContainerExec resources terminated unexpectedly error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#​20664, backport of #​20466, @​radical)

  • 🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through dotnet run or dotnet watch now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and aspire stop flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #​20495. (#​20514, backport of #​20494, @​danegsta)

Full Changelog: v13.6.0...v13.6.1

Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8

Commits viewable in compare view.

Updated FluentValidation from 12.1.1 to 12.2.0.

Release notes

Sourced from FluentValidation's releases.

12.2.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.2.0

  • Add Lithuanian language (#​2350)
  • Add Belarusian language (#​2356)
  • Add GetParentChain() to PropertyChain (#​2358)
  • Fix ArgumentNullException in TestValidationResult when a failure has a null PropertyName (#​2362)
  • Reject an inverted range when the comparer returns a negative other than -1 in RangeValidator (#​2370)
  • Change EnumValidator to work under native AOT (#​2371)
  • Fix PropertyChain.IsChildChainOf for sibling chains that share a name prefix (#​2372)
  • Fix PropertyPath is incorrect in .When() on RuleForEach (#​2363)

Changes in 12.1.0

  • Add Tamil language (#​2334)
  • Add Telugu language (#​2333)
  • Fixes to Japanese translations (#​2340)

Changes in 12.0.0

  • Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
  • Add support for dependent rules for custom rules (#​2170)
  • Removes deprecated DI extensions
  • Removes deprecated transform methods (#​2027)
  • Remove the ability to disable the root-model null check (#​2069)
  • Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
  • Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Caching.Abstractions from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Caching.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Caching.StackExchangeRedis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.FileExtensions from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Configuration.FileExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Json from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Diagnostics.Testing from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.Testing's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.12.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.12.0

Security fix

This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

Full Changelog: microsoft/vstest@v18.11.0...v18.12.0

18.11.1

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0.
Fixed in: Microsoft.TestPlatform.CLI 18.11.1.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

Full Changelog: microsoft/vstest@v18.11.0...v18.11.1

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

18.10.2

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.10.0 and 18.10.1.
Fixed in: Microsoft.TestPlatform.CLI 18.10.2.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

Full Changelog: microsoft/vstest@v18.10.1...v18.10.2

Commits viewable in compare view.

Updated NSwag.AspNetCore from 14.7.1 to 14.8.0.

Release notes

Sourced from NSwag.AspNetCore's releases.

14.8.0

[!IMPORTANT]
An nswag.json without an explicit runtime field now defaults to Net100 instead of Net80.

.NET 8 reached end of life on 2026-11-10, so the default moved to the active LTS. A document that omits runtime and is executed with $(NSwagExe_Net80) or nswag.cmd /runtime:net80 now fails with:

InvalidOperationException: The specified runtime in the document (Net100) differs
from the current process runtime (Net80).

Either pin the runtime in the document ("runtime": "Net80") or move to $(NSwagExe_Net100) / /runtime:Net100. Documents that already specify runtime are unaffected.

.NET 11 support

.NET 11 reached GA on 2026-11-10 and is now a fully supported NSwag runtime.

Runtime support is additive — net8.0, net9.0, net10.0 and net11.0 all ship. Nothing was removed, so every existing NSwagExe_* property and /runtime: value keeps working.

  • $(NSwagExe_Net110) and $(NSwagDir_Net110) in NSwag.MSBuild
  • /runtime:Net110 in the command line tool, the nswag NPM package (the legacy --core 11.0 form also works) and NSwagStudio
  • A Net110 folder in the MSBuild tools/ layout and in the NPM package

NJsonSchema v11.6.2 (potentially breaking changes)

This release bundles NJsonSchema v11.6.2 and Namotion.Reflection v3.5.1. Two changes there can affect generated output:

  • Swagger2 documents: properties that are both required and nullable now emit x-nullable: true instead of silently losing their declared nullability (NJsonSchema#​1931). This applies when the property is marked required by a presence-only marker — the C# required keyword, [JsonRequired], [DataMember(IsRequired = true)] or Newtonsoft Required.AllowNull. [Required] from DataAnnotations is unaffected. C# clients generated from such documents may now produce nullable types where they previously produced non-nullable ones.
  • UseRequiredKeyword = true: default-value initializers are now suppressed only on the properties that actually receive the required keyword, so optional properties regain their initializers (NJsonSchema#​1926). The default (UseRequiredKeyword = false) is unaffected.

New C# generator settings also become available: IntegerType, AdditionalPropertiesValueType and PropertyAttributeFactory. See the NJsonSchema v11.6.2 release notes for the full list.

Dependency and security updates

Packages carrying known vulnerability advisories moved to the current servicing release of their line:

  • Microsoft.AspNetCore.* for net462 / netstandard2.0: 2.3.0 (Kestrel.Core 2.3.6) → 2.3.14
  • Microsoft.AspNetCore.OpenApi and .TestHost: 8.0.34, 9.0.23, 10.0.15 and 11.0.0 per target framework
  • Build-only: System.Security.Cryptography.Xml and .Pkcs → 10.0.15

Other changes

  • The release binaries (NSwag.zip and NSwagStudio.msi) are now attached to the GitHub release automatically by the tagged build.
  • A hang in project metadata lookup was fixed: dotnet msbuild --getProperty output was read only after the process exited, which could deadlock, and MSBuild worker nodes kept for reuse could hold the pipes open indefinitely.

What's Changed

Commits viewable in compare view.

Updated NSwag.Generation.AspNetCore from 14.7.1 to 14.8.0.

Release notes

Sourced from NSwag.Generation.AspNetCore's releases.

14.8.0

[!IMPORTANT]
An nswag.json without an explicit runtime field now defaults to Net100 instead of Net80.

.NET 8 reached end of life on 2026-11-10, so the default moved to the active LTS. A document that omits runtime and is executed with $(NSwagExe_Net80) or nswag.cmd /runtime:net80 now fails with:

InvalidOperationException: The specified runtime in the document (Net100) differs
from the current process runtime (Net80).

Either pin the runtime in the document ("runtime": "Net80") or move to $(NSwagExe_Net100) / /runtime:Net100. Documents that already specify runtime are unaffected.

.NET 11 support

.NET 11 reached GA on 2026-11-10 and is now a fully supported NSwag runtime.

Runtime support is additive — net8.0, net9.0, net10.0 and net11.0 all ship. Nothing was removed, so every existing NSwagExe_* property and /runtime: value keeps working.

  • $(NSwagExe_Net110) and $(NSwagDir_Net110) in NSwag.MSBuild
  • /runtime:Net110 in the command line tool, the nswag NPM package (the legacy --core 11.0 form also works) and NSwagStudio
  • A Net110 folder in the MSBuild tools/ layout and in the NPM package

NJsonSchema v11.6.2 (potentially breaking changes)

This release bundles NJsonSchema v11.6.2 and Namotion.Reflection v3.5.1. Two changes there can affect generated output:

  • Swagger2 documents: properties that are both required and nullable now emit x-nullable: true instead of silently losing their declared nullability (NJsonSchema#​1931). This applies when the property is marked required by a presence-only marker — the C# required keyword, [JsonRequired], [DataMember(IsRequired = true)] or Newtonsoft Required.AllowNull. [Required] from DataAnnotations is unaffected. C# clients generated from such documents may now produce nullable types where they previously produced non-nullable ones.
  • UseRequiredKeyword = true: default-value initializers are now suppressed only on the properties that actually receive the required keyword, so optional properties regain their initializers (NJsonSchema#​1926). The default (UseRequiredKeyword = false) is unaffected.

New C# generator settings also become available: IntegerType, AdditionalPropertiesValueType and PropertyAttributeFactory. See the NJsonSchema v11.6.2 release notes for the full list.

Dependency and security updates

Packages carrying known vulnerability advisories moved to the current servicing release of their line:

  • Microsoft.AspNetCore.* for net462 / netstandard2.0: 2.3.0 (Kestrel.Core 2.3.6) → 2.3.14
  • Microsoft.AspNetCore.OpenApi and .TestHost: 8.0.34, 9.0.23, 10.0.15 and 11.0.0 per target framework
  • Build-only: System.Security.Cryptography.Xml and .Pkcs → 10.0.15

Other changes

  • The release binaries (NSwag.zip and NSwagStudio.msi) are now attached to the GitHub release automatically by the tagged build.
  • A hang in project metadata lookup was fixed: dotnet msbuild --getProperty output was read only after the process exited, which could deadlock, and MSBuild worker nodes kept for reuse could hold the pipes open indefinitely.

What's Changed

Commits viewable in compare view.

Updated NUnit3TestAdapter from 6.3.0 to 6.3.1.

Release notes

Sourced from NUnit3TestAdapter's releases.

6.3.1

This is a hotfix release for issue 1504

Commits viewable in compare view.

Updated StackExchange.Redis from 3.3.1 to 3.4.35.

Release notes

Sourced from StackExchange.Redis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group with 21 updates
17bd854 
Bumps Aspire.Hosting.Testing from 13.6.0 to 13.6.5
Bumps FluentValidation from 12.1.1 to 12.2.0
Bumps Microsoft.EntityFrameworkCore from 10.0.12 to 10.0.15
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.12 to 10.0.15
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Caching.Abstractions from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Configuration from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Configuration.FileExtensions from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Configuration.Json from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.DependencyInjection from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Diagnostics.Testing from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.Logging from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.12 to 10.0.15
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.12.0
Bumps NSwag.AspNetCore from 14.7.1 to 14.8.0
Bumps NSwag.Generation.AspNetCore from 14.7.1 to 14.8.0
Bumps NUnit3TestAdapter from 6.3.0 to 6.3.1
Bumps StackExchange.Redis from 3.3.1 to 3.4.35

---
updated-dependencies:
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: FluentValidation
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Caching.Abstractions
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Caching.StackExchangeRedis
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.FileExtensions
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Configuration.Json
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Diagnostics.Testing
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: NSwag.AspNetCore
  dependency-version: 14.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: NSwag.Generation.AspNetCore
  dependency-version: 14.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: NUnit3TestAdapter
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: StackExchange.Redis
  dependency-version: 3.4.35
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 14, 2026
@dependabot dependabot Bot mentioned this pull request Nov 14, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

0 participants