Visitar URL original
Bump the nuget-minor-and-patch group with 7 updates by dependabot[bot] · Pull Request #2967 · mock-server/mockserver-monorepo · GitHub
Skip to content

Bump the nuget-minor-and-patch group with 7 updates - #2967

Merged
github-actions[bot] merged 1 commit into
masterfrom
dependabot/nuget/mockserver-client-dotnet/src/MockServer.Client/nuget-minor-and-patch-87e3714f4f
Nov 12, 2026
Merged

Bump the nuget-minor-and-patch group with 7 updates#2967
github-actions[bot] merged 1 commit into
masterfrom
dependabot/nuget/mockserver-client-dotnet/src/MockServer.Client/nuget-minor-and-patch-87e3714f4f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Updated FluentAssertions from 7.0.0 to 7.2.2.

Release notes

Sourced from FluentAssertions's releases.

7.2.2

What's Changed

Fixes

Building

Full Changelog: fluentassertions/fluentassertions@7.2.1...7.2.2

7.2.1

What's Changed

Fixes

Full Changelog: fluentassertions/fluentassertions@7.2.0...7.2.1

7.2.0

What's Changed

Improvements

Fixes

Others

Full Changelog: fluentassertions/fluentassertions@7.1.0...7.2.0

7.1.0

What's Changed

Improvements

Others

Full Changelog: fluentassertions/fluentassertions@7.0.0...7.1.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.11.1 to 17.14.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

Will probably revert before release:

New Contributors

Full Changelog: microsoft/vstest@v17.13.0...v17.14.0-preview-25107-01

17.13.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.12.0...v17.13.0

17.12.0

What's Changed

Internal and infrastructure fixes:

Full Changelog: microsoft/vstest@v17.11.1...v17.12.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.12.0 to 17.14.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

Will probably revert before release:

New Contributors

Full Changelog: microsoft/vstest@v17.13.0...v17.14.0-preview-25107-01

17.13.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.12.0...v17.13.0

Commits viewable in compare view.

Updated MockServerClient from 7.1.0 to 7.6.0.

Release notes

Sourced from MockServerClient's releases.

7.6.0

[7.6.0] - 2026-08-17

Changed

  • The three Kubernetes container-integration cases that need Java-built images — helm_sidecar_injection
    (admission-webhook sidecar injection), helm_clustered_convergence, and helm_jgroups_dns_ping (both the
    -clustered Infinispan image) — now run blocking in CI instead of recording a skip. Previously the CI helm step
    ran with no JDK and never built those images, so all three recorded an honest but permanent SKIP — coverage that
    looked green while proving nothing. A new :maven: build container-test images (jars) step in the
    mockserver-container-tests pipeline builds the mockserver-netty, mockserver-k8s-webhook, and
    mockserver-state-infinispan jars from the tree (once, via the Maven-in-Docker reactor) and hands them to the
    helm step as Buildkite artifacts; the helm step downloads them and does cheap docker builds (a COPY into
    distroless) to produce the -clustered and mockserver-webhook images, then runs the suite. The jars travel as
    artifacts (~200 MB total) rather than docker saved images (~1.3 GB), mirroring the node-launcher / WAR hand-off. Both
    layers fail closed: the helm step exits non-zero if any jar artifact is absent, and the harness runs with
    REQUIRE_CLUSTERED_IMAGE=true/REQUIRE_WEBHOOK_IMAGE=true so an image that is expected-but-absent is recorded as a
    FAILURE, never a skip — a skip in CI is now impossible. Local container_integration_tests/integration_tests.sh
    is unchanged for a developer without the images: it still records a comprehensible SKIP (no fail-closed flag set),
    and the harness now also builds the mockserver-webhook image locally (build_webhook_docker) so the sidecar case
    runs blocking in local dev too — it was never built by the harness before, so that case had always skipped.

Added

  • Two new rules in the always-on check-false-green-guards.sh CI gate. Rule 4 fails the build if a CI step runs the
    container-integration harness with the helm/k3d cases active but does not export both REQUIRE_CLUSTERED_IMAGE=true and
    REQUIRE_WEBHOOK_IMAGE=true — the exact way the three image-dependent Kubernetes cases could silently revert to a green
    SKIP. It is keyed on the step's behaviour (invokes integration_tests.sh without SKIP_HELM_TESTS=true), not on a
    filename, so a rename or a second helm-running step is covered automatically. Rule 5 fails the build if a
    mockserver-core test that performs a JVM-global logging side effect (reaching LogManager.readConfiguration's handler
    reset() via the static ConfigurationProperties logging setters or a forced fresh <clinit>) is not in the
    sequential-tests include list — the shape behind a release-blocking flake that ParallelStaticStateGuardTest
    structurally cannot catch. Both rules fail closed on an empty corpus and carry a rotating allow-list. See
    docs/operations/false-green-guards.md.
  • A jarPath launcher option and matching MOCKSERVER_JAR_PATH environment variable for mockserver-node, pointing
    start_mockserver at a pre-provisioned mockserver-netty jar-with-dependencies instead of downloading one from
    Maven Central. When set, that exact jar is launched and no download is attempted; a configured-but-missing path is a
    hard error (... refusing to fall back to downloading a release) rather than a silent fall-back to a released
    jar, so a missing artifact fails loudly. Mirrors the existing MOCKSERVER_BINARY_BASE_URL bring-your-own-artifact
    path for the standalone binary, and serves air-gapped/corporate installs as well as testing a locally-built jar
    (jarPath takes precedence over mockServerVersion/artifactory*; the option beats the env var). The Node launcher
    integration tests now use it in CI: a new :maven: build node launcher jar step builds the jar from the tree and
    the launcher-test step downloads it as an artifact and launches it via MOCKSERVER_JAR_PATH — so the suite finally
    tests the repo's own code instead of the last release. Previously it ran a downloaded release chosen by
    package.json's version, so a mockserver-core fix could not green it and a regression could not red it; that
    released jar also carried the shipped dynamic-CA generation race (fixed on master in 4cff56e61) and flaked ~8% of
    runs. The launcher step fails closed if the tree-built jar is absent rather than reverting to a download, and
    local npm test outside CI is unchanged (with neither the option nor the env var set it still downloads as before).
  • A structural wire-contract test for the LLM provider codecs (LlmCodecStructuralContractTest), breaking the
    self-derivation weakness in the golden-file drift test. LlmCodecGoldenFileTest regenerates its golden bodies
    from the codec itself (-Dmockserver.updateLlmGoldens=true), so a structural codec defect — a renamed field, a
    wrong SSE event name, a dropped finish_reason — bakes straight into its own golden and the byte-for-byte drift
    test then passes forever, confirming only that the codec is consistent with itself (token counts were already
    ... (truncated)

7.5.0

[7.5.0] - 2026-07-29

Security

  • BREAKING: response templates can no longer reach arbitrary Java classes by default, closing the
    template remote-code-execution path reported as
    GHSA-7pwj-xvc2-hfpc.
    A caller who can reach the management API can register an expectation, and a response template was able
    to load java.lang.Runtime and execute OS commands in the MockServer process. Both engines that could
    do this are now sandboxed out of the box:
    • velocityDisallowClassLoading now defaults to true (was false), installing Velocity's
      SecureUberspector so a template cannot reach classes through $request.class.classLoader.loadClass(...).
      This is the more exposed half of the issue, and the half the report did not cover: Velocity ships in
      the DEFAULT distribution, whereas the JavaScript engine does not.
    • JavaScript templates now resolve no Java classes unless an operator grants them. Previously an
      empty javascriptAllowedClasses and empty javascriptDisallowedClasses meant unrestricted
      Java.type(...) access; that combination — the out-of-the-box state — now denies every class.
    • The GraalJS guest context no longer grants access to the members of java.lang.Class or
      java.lang.ClassLoader. Denying classes at Java.type(...) alone was not sufficient: real host
      objects are bound into the context (faker and the other built-in helpers), and under the previous
      HostAccess.ALL a template could walk from one of them to a classloader —
      faker.getClass().getClassLoader().loadClass('java.lang.Runtime') — reaching Runtime without the
      class filter ever being consulted. That walk is now closed, so host-class lookup is the single complete
      gate; a regression test drives four such walks (including through request) and fails if any resolves.
      Velocity's SecureUberspector already blocked the equivalent walk through its own bound helpers, which
      is now covered by a test too.
      Both flips are fully reversible with one property and remove no functionality: set
      mockserver.velocityDisallowClassLoading=false, or list the classes your templates need in
      mockserver.javascriptAllowedClasses (the single entry * lets any class resolve again). Templates that
      do not touch Java classes are unaffected, which is the overwhelming majority — JavaScript templates have
      the full ES2023 standard library available regardless of this setting. A refused class is logged once at
      WARN naming the class and the property to set, because GraalJS otherwise surfaces a refusal only as the
      class being undefined ("... is not a function"); the log is bounded and de-duplicated so a hostile
      template cannot flood it. mockserver.javascriptAllowedClasses is now also settable through the Spring
      test listener's @​MockServerTest properties, which it was not before — it was a nice-to-have while the
      default was unrestricted, and is the only way to grant a class now that it is not. The insecure-mode WARN
      now fires when an operator has explicitly opened the
      sandbox rather than when it is closed. Proven end-to-end by a Netty integration test that registers the
      reported payload through the real management API and asserts the OS command creates no marker file, with
      a negative control on a deliberately unsandboxed server that DOES create it — so a regression cannot pass
      as an inert payload. This lands DEF-2 and DEF-3 of docs/plans/later/security-defaults.md ahead of the
      other default flips listed there; JavaScript went further than that plan proposed (deny everything, not a
      built-in "safe types" allow-list) because deny-by-default is the only form that stays safe as the JDK
      grows new reachable classes.

Fixed

  • A property file that cannot be read is now reported instead of ignored in silence
    (#​2358).     When a
    mockserver.propertyFile an operator had explicitly configured could not be read, MockServer applied
    none of its properties and said nothing about it — at any log level. The only symptom was that every
    property in the file appeared to be at its default, which surfaces far downstream as unexplained
    ... (truncated)

7.4.0

[7.4.0] - 2026-07-04

Added

  • Dashboard: every language tab now generates typed client code. The composer's Java, Node.js, Python, Go,
    C#, Ruby, and Rust tabs construct each client's typed model — fluent builders and typed constructors matching
    the website examples — instead of embedding raw JSON, including full LLM response actions in Java. Every
    language's generated output is proven equivalent by executing or compiling it against the real client and
    comparing the serialized expectation with the registered JSON, and a CI gate compiles the generated Java
    against the built client on every build.

  • Every client library now round-trips the full expectation model, proven by a shared fidelity harness. The
    Go, Rust, C#, Python, Ruby, and Node clients gained typed support for every expectation feature they previously
    dropped silently — chaos profiles, rate limits, forward-with-fallback and forward-validate actions, gRPC bidi
    responses, before/after actions, steps, capture rules, namespaces, LLM response payloads including moderation,
    rerank, and content filters, WebSocket frame matchers, response trailers, DNS matchers, and all body matcher
    variants. Forty-four server-validated kitchen-sink fixtures now run as round-trip tests inside each client's own
    test suite, with a ratcheting known-gaps ledger that fails CI if a documented gap silently regresses or a fixed
    gap is still excused.

  • Dashboard: JWT and all-of body matchers are now authorable in the composer. The Advanced request form gains a
    JWT section (claims, issuer, audience, algorithm) and an all-of body matcher composing multiple sub-matchers,
    emitted in the exact server wire format and round-tripping on edit.

  • Dashboard: the Java code tab is now complete and type-safe. Generated Java uses the real client API for
    priority, times, and time-to-live, scenario bindings, namespaces, and capture rules — proven by compiling a
    kitchen-sink snippet against the built client — and the Java client gains matching withNamespace and withCapture
    fluent methods. Actions the Java builder preview cannot represent show an honest notice instead of fabricated code.

  • Dashboard: every captured flow is now a launchpad. A "Create From This" menu on traffic detail panes and
    log rows fans out into every subsystem pre-filled from that flow — create a mock in the composer, set a
    breakpoint, prefill a verification, or add chaos for the host. The traffic inspector also gains structured
    Request/Response tabs (headers tables and pretty-printed bodies, with the raw JSON tree kept as a tab),
    "Copy as curl" with shell-safe quoting and masked credentials, a Charles-style "Repeat" action (iterations,
    bounded concurrency, delay, live progress and cancel), a Proxyman-style diff pool with an editable ignored-headers
    list, an unmatched-count chip with why-didn't-this-match and generate-stub actions, and bulk
    "Promote to Mocks" over recorded traffic (PUT /mockserver/recordings/promote).

  • Dashboard: previously server-only capabilities are now reachable from the UI. Validate recorded traffic
    against an OpenAPI spec (/trafficValidate), import GraphQL SDL schemas and mock SCIM providers, import Pact
    contracts, generate HTTP expectations from AsyncAPI specs, dry-run WASM modules against a sample request,
    reload persisted recording archives (NDJSON or from server disk), a preemption-simulation card and experiment
    history in Service Chaos, a control-plane Audit view, a standalone Scenarios view in the navigation, and a
    read-only Server Info tab (effective configuration with source tiers, bound ports plus bind-additional-port,
    proxy setup with CA download) alongside a server-side decoded-prompt LLM run diff.

  • Dashboard: quick chaos and honest latency attribution. A one-toggle Quick Chaos strip (percentage slider
    over real per-request fault probabilities, per upstream host) makes fault injection approachable, and the
    traffic timing waterfall now distinguishes latency MockServer injected (chaos latency, configured response
    delays including the global delay, breakpoint holds) from real upstream/processing time — mock-served
    responses carry a timing block for the first time when they inject latency (a plain mock's recorded
    output is unchanged).

  • Force a response-sequence variant per request. A request matching an expectation with multiple responses
    ... (truncated)

7.3.0

[7.3.0] - 2026-07-01

Added

  • Typed client methods for control-plane operations that previously needed a hand-written REST call. The
    client libraries gain first-class methods for clock control (freeze / advance / reset / status), metrics
    (the JSON counter snapshot and the Prometheus scrape), configuration read/update, Pact import / export / verify,
    the file store (store / retrieve / list / delete), HAR and Postman import, the high-level operating mode
    (SIMULATE / SPY / CAPTURE), and generating expectations from a WSDL — so these no longer require a manual
    PUT /mockserver/… request. Rolling out across the Java, Node, Python, Ruby, Go, .NET, Rust and PHP clients.

Security

  • Fixture redaction now also masks credentials in query strings and streamed bodies, and fails closed on
    unparseable secrets.     When redacting recorded traffic (HAR/Postman imports, the LLM optimisation report, the
    MCP capture tools) the redactor previously only masked sensitive headers and named JSON body fields. It now also
    (a) masks the values of credential-bearing query parameters by default (such as key, api_key, apikey,
    access_token, token, signature, sig, and the AWS SigV4 X-Amz-Signature/X-Amz-Security-Token) —
    e.g. Gemini's ?key= API key; (b) redacts configured fields inside each Server-Sent-Events data: payload of
    a streamed body, leaving non-JSON markers such as [DONE] intact (and failing closed on a data: payload it
    cannot parse that still mentions a configured field); and (c) when a body is configured for field redaction but
    cannot be parsed yet still mentions a configured field name, replaces the whole body rather than risk leaking it.
    Ordinary unstructured bodies (plain text, HTML, decoded binary) that mention no configured field are left
    unchanged.
  • A2A client builders: the custom-handler regex messagePattern is now escaped completely. Every client
    library (Java, Node, Python, Ruby, Go, Rust, PHP, .NET) inlines messagePattern into a JSONPath =~ /…/ regex
    literal but previously escaped only the / delimiter, so a pattern ending in a lone backslash (or containing
    \/) could escape the closing delimiter and break out of the regex literal into the surrounding JSONPath/JSON
    (CodeQL rb/incomplete-sanitization). The escaping now preserves valid regex escape sequences (e.g. \d) while
    neutralising the delimiter-breakout; normal patterns are unaffected.
  • Dashboard load-scenario report download now validates the URL scheme. The "download report" action passed a
    URL assembled from the user-configured connection to window.open without checking its scheme; it now opens the
    report only when the URL resolves to http/https, ruling out javascript:/data: redirection (CodeQL
    js/client-side-unvalidated-url-redirection).
  • /bind and /stop now honour control-plane authentication/authorization. These mutating lifecycle
    endpoints were serviced before the auth gate; they now require the same control-plane auth as
    /mockserver/configuration. Default deployments with no control-plane auth configured are unaffected, and
    /status / /ready remain open for health probes. Closes the lifecycle-endpoint gap noted in 7.2.0.
  • MCP tool calls now honour control-plane authorization. With controlPlaneAuthorizationEnabled, each MCP
    tool is classified read vs mutate (fail-closed) and checked against the same role model as the HTTP control
    plane, so a read-only principal can no longer invoke mutating MCP tools (create/clear/reset/…). Default
    (authorization disabled) behaviour is unchanged; enforced across HTTP and HTTP/3, single and batch. Closes
    the per-tool MCP gap noted in 7.2.0.
  • Control-plane JWT validation cross-request race fixed. A single shared JWTValidator reconfigured the
    Nimbus processor (key selector + claims verifier) on every call, so concurrent control-plane requests could be
    verified against another request's policy. The processor is now configured once and validate() is stateless.
  • Remote JWKS / OIDC discovery fetches are now bounded. JWKS-key-set and OIDC discovery-document fetches on
    the authentication path used the JOSE library defaults (infinite connect/read timeout, no size limit); they now
    use finite timeouts and a size cap, so a slow or hostile identity-provider endpoint can no longer hang the auth
    path or be used as an amplification vector.
    ... (truncated)

7.2.0

[7.2.0] - 2026-06-22

Security

  • Control-plane role-based authorization (off by default). With controlPlaneAuthorizationEnabled
    and a controlPlaneScopeMapping (e.g. platform-admins=admin,qa-team=mutate,viewers=read), an
    authenticated principal's scopes/groups are mapped to one of three hierarchical roles
    (admin ⊇ mutate ⊇ read): reads require read, every mutating operation requires mutate, and a
    principal lacking the role gets 403 Forbidden (recorded in the audit log). Fail-closed — use together
    with control-plane OIDC authentication. Covers all HttpState.handle operations plus the Netty-serviced
    /mockserver/configuration, /openapi.yaml and /llm/optimisationReport reads/writes. Not yet covered:
    the lifecycle endpoints (/bind, /stop, /status) and per-tool MCP authorization. See
    docs/code/tls-and-security.md.
  • JWT control-plane validation rejects HMAC algorithms. JWTValidator verifies against a public-key
    JWK set, so it now accepts only asymmetric algorithms (RS*/ES*/PS*/EdDSA) and rejects HMAC
    (HS256/384/512), closing an algorithm-confusion forgery vector. Switch to an asymmetric key if you
    relied on HMAC.
  • SCIM bearer-token enforcement now fails closed. When enforcement is enabled but no expected token is
    configured, requests are rejected instead of accepting any token, and the comparison is constant-time.
  • Opt-in secret redaction in the event log and dashboard (redactSecretsInLog, default off). Masks
    sensitive header values (Authorization, Cookie, x-api-key, …) and configured JSON body fields in
    retrieved/exported logs and the dashboard event view. Matching and verification still see the original
    values, so behaviour is unchanged.
  • Dashboard dompurify pinned to 3.4.11 via an npm overrides entry, clearing all 16 open
    Dependabot DOMPurify advisories (mXSS / DOM-clobbering / prototype-pollution).

Added

AI, LLM & agent protocols (LLM / MCP / A2A)

  • LLM and MCP mock builders in every client. Idiomatic LLM-mocking (completions, tool calls, streaming
    physics, usage, embeddings, multi-turn conversations, provider failover) and MCP-server-mocking (tools,
    resources, prompts over JSON-RPC 2.0) builders are now available in all eight clients (Java, Node, Python,
    Ruby, Go, Rust, .NET, PHP), all producing the same wire JSON.
  • LLM optimisation export. Proxy your agent's LLM calls through MockServer, then export a one-click
    optimisation brief (Markdown) or structured JSON bundle (LlmOptimisationReport) from captured traffic.
    Nine deterministic signals detect repeated system prompts, low cache-hit rates, unused tool schema,
    model overspend, large resent context, deterministic tool calls, oversized tool results, output-token
    bloat and duplicate calls — each with token counts, estimated USD saving, and structured fix guidance
    (copy-paste config snippet or example expectation where applicable). An in-product verdict (A–F grade
    and "$X recoverable" headline computed via per-call MAX attribution so the total is always ≤ actual spend)
    and two new session KPIs (cache-hit rate and one-shot rate) appear in the dashboard and the
    Markdown brief. New LLM Optimise dashboard screen (with verdict banner, "Copy verdict" button, and
    updated hero cards), GET /mockserver/llm/optimisationReport endpoint, and export_optimisation_report
    MCP tool. Export-only and deterministic; secrets are redacted. The Anthropic codec now maps the top-level
    system field so cache and repeated-prompt signals fire on Anthropic traffic.
  • More embedding providers and rerank mocking. httpLlmResponse embeddings now cover Gemini, Ollama and
    Bedrock (Titan / Cohere-on-Bedrock) in addition to OpenAI/Azure, all deterministic and L2-normalised. A new
    rerank action mocks Cohere and Voyage rerank endpoints in the provider-correct envelope.
  • MockServer's MCP control plane gains prompts/list, prompts/get and sampling/createMessage over
    ... (truncated)

Commits viewable in compare view.

Updated System.Text.Json from 8.0.5 to 8.0.6.

Release notes

Sourced from System.Text.Json's releases.

8.0.6

Release

Commits viewable in compare view.

Updated Testcontainers from 4.12.0 to 4.16.0.

Release notes

Sourced from Testcontainers's releases.

4.16.0

What's Changed

Huge thanks to everyone for your contributions and feedback 🧡.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​54051351.

🚀 Features

  • feat: Add common WithSsl builder API and support it in Azurite (#​1788) @​aleksandarMilev, @​HofmeisterAn
  • feat: Add BuildKit support for image builds via sidecar container (#​1761) @​george-petrakis, @​HofmeisterAn
  • feat(Elasticsearch): Add OTLP and certificate support (#​1774) @​HofmeisterAn

🐛 Bug Fixes

  • fix(PostgreSql): Support SSL with Alpine images and non-root users (#​1790) @​HofmeisterAn
  • fix: Do not pull base image with unresolved platform variable (#​1787) @​HofmeisterAn
  • fix(Kafka): Default to KRaft for Confluent Platform 8.x images (#​1775) @​arnelirobles, @​HofmeisterAn
  • fix(Kafka): Drop the trailing comma from advertised listeners (#​1772) @​arnelirobles, @​HofmeisterAn
  • fix: Prevent Docker ignore patterns from matching path prefixes (#​1768) @​Benziza, @​HofmeisterAn

📖 Documentation

  • docs: Complete builder API tables and align heading casing (#​1778) @​HofmeisterAn
  • docs: Explain how builder configurations combine (#​1770) @​arnelirobles, @​HofmeisterAn

🧹 Housekeeping

  • fix: Regenerate expired test certificates (#​1786) @​zcsizmadia
  • chore: Resolve Sonar findings (#​1776) @​HofmeisterAn
  • chore: Remove Minio module (#​1769) @​HofmeisterAn
  • chore: Publish NuGet packages with Trusted Publishing (OIDC) (#​1763) @​HofmeisterAn
  • feat: Prepare next release cycle (4.16.0) (#​1762) @​HofmeisterAn

📦 Dependency Updates

4.15.0

What's Changed

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​45594466.

🚀 Features

  • feat: Add options to the Docker Compose up and down command (#​1759) @​HofmeisterAn
  • feat: Add QuestDB module (#​1618) @​FortuneN, @​HofmeisterAn
  • feat: Add Compose support (#​1750) @​HofmeisterAn
  • fix(Couchbase): Treat an already provisioned cluster as configured (#​1736) @​arnelirobles, @​HofmeisterAn
  • feat: Retry transient Docker image pull failures (#​1734) @​thomhurst, @​HofmeisterAn
  • chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn
  • feat(MongoDb): Resolve the MongoDb shell file path once (#​1745) @​HofmeisterAn

🐛 Bug Fixes

  • fix: Detach from the container output before stopping or removing it (#​1755) @​HofmeisterAn
  • fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn

📖 Documentation

  • docs: Update CONTRIBUTING.md (#​1744) @​HofmeisterAn

🧹 Housekeeping

  • chore: Improve null check, test typing, and IDE settings (#​1757) @​HofmeisterAn
  • fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn
  • chore: Resolve Sonar findings (#​1751) @​HofmeisterAn
  • chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
  • feat: Prepare next release cycle (4.15.0) (#​1742) @​HofmeisterAn

📦 Dependency Updates

  • chore(deps): Bump mkdocs-material from 9.7.2 to 9.7.7 (#​1758) @​dependabot[bot]
  • chore(deps): Bump the actions group with 5 updates (#​1754) @​dependabot[bot]
  • chore(deps): Bump the actions group across 1 directory with 7 updates (#​1747) @​dependabot[bot]
  • chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
  • chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn

4.14.0

What's Changed

I published this version because several developers asked for a release addressing the SSH.NET vulnerability. As an interim fix, you can also bump the transitive dependency, which should work fine.

Unfortunately, I had to run the release CI pipeline twice (1, 2). The change #​1725 introduced a regression that caused the pipeline to attempt to publish the Cake build project, which correctly failed (partially published).

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​40693051.

🚀 Features

  • feat: Add possibility to select MSSQL database (instead of master) (#​1737) @​0xced, @​HofmeisterAn
  • feat: Add Mailpit module (#​1727) @​0xced, @​feslima, @​HofmeisterAn

🐛 Bug Fixes

  • fix(MongoDb): Probe the server instead of counting log messages before initiating (#​1735) @​arnelirobles, @​HofmeisterAn
  • fix(MongoDb): Treat an already initiated replica set as success (#​1731) @​arnelirobles, @​HofmeisterAn

🧹 Housekeeping

  • chore: Cleanup and align tests (#​1740) @​HofmeisterAn
  • chore: Set Cake build solution file path to Testcontainers.slnx (#​1728) @​0xced
  • chore: Keep Testcontainers.slnx solution file only (#​1725) @​0xced
  • feat: Prepare next release cycle (4.14.0) (#​1726) @​HofmeisterAn

📦 Dependency Updates

  • chore(deps): Bump SSH.NET to 2026.0.0 and BouncyCastle.Cryptography to 2.7.0 (#​1739) @​markmario
  • chore(deps): Bump the actions group with 10 updates (#​1730) @​dependabot[bot]

4.13.0

What's Changed

Thank you to everyone who contributed and shared their feedback 🤜🤛.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​33686956.

🚀 Features

  • feat: Add Aspire dashboard module (#​1194) @​NikiforovAll
  • feat: Add image name substitution hook (#​1710) @​HofmeisterAn
  • feat(CosmosDb): Add get method AccountEndpoint (#​1707) @​srollinet
  • feat: Improve image build failure messages (#​1700) @​HofmeisterAn

🐛 Bug Fixes

  • fix: Restore tar archive write performance regressed by padding trim (#​1719) @​HofmeisterAn
  • chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
  • chore(AspireDashboard): Cover connection string provider (#​1713) @​HofmeisterAn

📖 Documentation

  • docs: Add missing TC languages and reorder docs navigation (#​1711) @​mdelapenya
  • docs: Add note about unsupported BuildKit Dockerfile features (#​1696) @​HofmeisterAn
  • docs: Explain immutable builder behavior (#​1693) @​HofmeisterAn

🧹 Housekeeping

  • chore: Enable Dependabot cooldown (#​1716) @​HofmeisterAn
  • chore: Add nuget.config (#​1715) @​Rob-Hague
  • chore(AspireDashboard): Cover connection string provider (#​1713) @​HofmeisterAn
  • chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
  • chore: Bump sshd-docker image from 1.3.0 to 1.4.0 (#​1709) @​HofmeisterAn
  • chore: Rename runtime label and add buildkit and stale labels (#​1703) @​HofmeisterAn
  • fix: Guard expensive argument evaluation when logging (#​1702) @​HofmeisterAn
  • chore: Defer container ID truncation in logging (#​1701) @​HofmeisterAn
  • chore: Migrate to LoggerMessageAttribute (#​1697) @​HofmeisterAn

📦 Dependency Updates

  • chore(deps): Bump the actions group with 2 updates (#​1721) @dependabot[bot]
  • chore(deps): Bump the actions group with 7 updates (#​1717) @dependabot[bot]
  • chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
  • chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
  • chore(deps): Bump the actions group with 4 updates (#​1698) @dependabot[bot]

Commits viewable in compare view.

Updated xunit from 2.9.2 to 2.9.3.

Release notes

Sourced from xunit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Xunit.SkippableFact from 1.4.13 to 1.5.85.

Release notes

Sourced from Xunit.SkippableFact's releases.

1.5.85

What's Changed

New Contributors

Full Changelog: AArnott/Xunit.SkippableFact@v1.5.61...v1.5.85

1.5.61

What's Changed

New Contributors

Full Changelog: AArnott/Xunit.SkippableFact@v1.5.23...v1.5.61

1.5.23

What's Changed

New Contributors

Full Changelog: AArnott/Xunit.SkippableFact@v1.4.13...v1.5.22

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget-minor-and-patch group with 7 updates
2d25260 
Bumps FluentAssertions from 7.0.0 to 7.2.2
Bumps Microsoft.NET.Test.Sdk to 17.14.1
Bumps MockServerClient from 7.1.0 to 7.6.0
Bumps System.Text.Json from 8.0.5 to 8.0.6
Bumps Testcontainers from 4.12.0 to 4.16.0
Bumps xunit from 2.9.2 to 2.9.3
Bumps Xunit.SkippableFact from 1.4.13 to 1.5.85

---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: System.Text.Json
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Xunit.SkippableFact
  dependency-version: 1.5.85
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: MockServerClient
  dependency-version: 7.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: Testcontainers
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: Xunit.SkippableFact
  dependency-version: 1.5.85
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 11, 2026
@github-actions
github-actions Bot merged commit c993711 into master Nov 12, 2026
19 checks passed
@github-actions
github-actions Bot deleted the dependabot/nuget/mockserver-client-dotnet/src/MockServer.Client/nuget-minor-and-patch-87e3714f4f branch November 12, 2026 06:34
@jamesdbloom jamesdbloom mentioned this pull request Nov 12, 2026
Closed
jamesdbloom added a commit that referenced this pull request Nov 12, 2026
@jamesdbloom
build(deps): keep the .NET Testcontainers client floor and ignore Flu…
788cade 
…entAssertions 8

The nuget-minor-and-patch group (#2967) rewrote MockServer.Testcontainers'
MockServerClient dependency from the open-ended floor [7.1.0,) to 7.6.0, and
#2975 proposed 9.2.0. Either raises every consumer's minimum client version,
unlike the open floors of the other Testcontainers modules. Restore
[7.1.0,) and ignore MockServerClient in the NuGet Dependabot entry.

FluentAssertions 8.x is proprietary (Xceed; commercial use needs a paid
licence), so ignore >=8.0.0 for both .NET directories and stay on the
Apache-2.0 line (#2968, #2973, #2979, #2982 closed).

Give the NuGet entry the build(deps) commit prefix and the .NET label the
other ecosystems' PRs carry.

#2967 also moved Testcontainers to 4.16.0, which depends on SSH.NET
2026.0.0 and fixes Dependabot alerts 643/644 (GHSA-q939-rpr3-3284,
GHSA-mggc-4xg6-vcxf); recorded in the changelog.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants