Skip to content

deps: Bump the nuget-minor-patch group with 6 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/demo/nuget-minor-patch-9fc6889431
Open

deps: Bump the nuget-minor-patch group with 6 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/demo/nuget-minor-patch-9fc6889431

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown

Updated coverlet.collector from 6.0.0 to 6.0.4.

Release notes

Sourced from coverlet.collector's releases.

6.0.4

Fixed

  • Fix empty coverage report when using include and exclude filters #​1726

Diff between 6.0.3 and 6.0.4

6.0.3

Fixed

Improvements

  • Cache the regex used in InstrumentationHelper #​1693
  • Enable dotnetTool integration tests for linux #​660

Diff between 6.0.2 and 6.0.3

6.0.2

Fixed

  • Threshold-stat triggers error #​1634
  • Fixed coverlet collector 6.0.1 requires dotnet sdk 8 #​1625
  • Type initializer errors after updating from 6.0.0 to 6.0.1 #​1629
  • Exception when multiple exclude-by-attribute filters specified #​1624

Improvements

  • More concise options to specify multiple parameters in coverlet.console #​1624

Diff between 6.0.1 and 6.0.2

6.0.1

Fixed

  • Uncovered lines in .NET 8 for inheriting records #​1555
  • Fix record constructors not covered when SkipAutoProps is true #​1561
  • Fix .NET 7 Method Group branch coverage issue #​1447
  • Fix ExcludeFromCodeCoverage does not exclude method in a partial class #​1548
  • Fix ExcludeFromCodeCoverage does not exclude F# task #​1547
  • Fix issues where ExcludeFromCodeCoverage ignored #​1431
  • Fix issues with ExcludeFromCodeCoverage attribute #​1484
  • Fix broken links in documentation #​1514
  • Fix problem with coverage for .net5 WPF application #​1221 by https://github.com/lg2de
  • Fix unable to instrument module for Microsoft.AspNetCore.Mvc.Razor #​1459 by https://github.com/lg2de

Improvements

Diff between 6.0.0 and 6.0.1

Commits viewable in compare view.

Updated coverlet.msbuild from 6.0.0 to 6.0.4.

Release notes

Sourced from coverlet.msbuild's releases.

6.0.4

Fixed

  • Fix empty coverage report when using include and exclude filters #​1726

Diff between 6.0.3 and 6.0.4

6.0.3

Fixed

Improvements

  • Cache the regex used in InstrumentationHelper #​1693
  • Enable dotnetTool integration tests for linux #​660

Diff between 6.0.2 and 6.0.3

6.0.2

Fixed

  • Threshold-stat triggers error #​1634
  • Fixed coverlet collector 6.0.1 requires dotnet sdk 8 #​1625
  • Type initializer errors after updating from 6.0.0 to 6.0.1 #​1629
  • Exception when multiple exclude-by-attribute filters specified #​1624

Improvements

  • More concise options to specify multiple parameters in coverlet.console #​1624

Diff between 6.0.1 and 6.0.2

6.0.1

Fixed

  • Uncovered lines in .NET 8 for inheriting records #​1555
  • Fix record constructors not covered when SkipAutoProps is true #​1561
  • Fix .NET 7 Method Group branch coverage issue #​1447
  • Fix ExcludeFromCodeCoverage does not exclude method in a partial class #​1548
  • Fix ExcludeFromCodeCoverage does not exclude F# task #​1547
  • Fix issues where ExcludeFromCodeCoverage ignored #​1431
  • Fix issues with ExcludeFromCodeCoverage attribute #​1484
  • Fix broken links in documentation #​1514
  • Fix problem with coverage for .net5 WPF application #​1221 by https://github.com/lg2de
  • Fix unable to instrument module for Microsoft.AspNetCore.Mvc.Razor #​1459 by https://github.com/lg2de

Improvements

Diff between 6.0.0 and 6.0.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.9.0 to 17.14.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

Will probably revert before release:

New Contributors

Full Changelog: microsoft/vstest@v17.13.0...v17.14.0-preview-25107-01

17.13.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.12.0...v17.13.0

17.12.0

What's Changed

Internal and infrastructure fixes:

Full Changelog: microsoft/vstest@v17.11.1...v17.12.0

17.11.1

What's Changed

Full Changelog: microsoft/vstest@v17.11.0...v17.11.1

17.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.10.0...v17.11.0-release-24352-06

17.11.0-release-24373-02

What's Changed

Full Changelog: microsoft/vstest@v17.11.0-release-24352-06...v17.11.0-release-24373-02

17.11.0-release-24352-06

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.10.0...v17.11.0-release-24352-06

17.10.0

What's Changed

And many infrastructure related changes and updates.

New Contributors

Full Changelog: microsoft/vstest@v17.9.0...v17.10.0

17.10.0-release-24177-07

What's Changed

New Contributors

And many infrastructure related changes to migrate our pipelines to common build system.

Full Changelog: microsoft/vstest@v17.10.0-preview-24080-01...v17.10.0-release-24177-07

17.10.0-preview-24080-01

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v17.9.0-preview-23577-04...v17.10.0-preview-24080-01

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 1.0.0 to 1.4.1.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

1.4.1

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

  • Release SSE response stream reference when GET request ends #​1628 by @​halter73 (co-authored by @​joelmforsyth @​Copilot)

Acknowledgements

  • @​slomangino123 submitted issue #​766 (resolved by #​1628)

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

1.4.0

v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a new InheritEnvironmentVariables option on StdioClientTransportOptions for controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, and DELETE on a Streamable HTTP session now requires the same authenticated user that initiated the session.

What's Changed

  • Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
  • Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73 (co-authored by @​Copilot)
  • Validate user on Streamable HTTP session DELETE #​1604 by @​halter73 (co-authored by @​Copilot)
    • HandleDeleteRequestAsync now mirrors the HasSameUserId check already enforced on GET and POST. A DELETE with a valid Mcp-Session-Id but a different authenticated user now returns 403 Forbidden instead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.
  • Add Enterprise Managed Authorization (SEP-990) support #​1305 by @​aniket-okta (backported in #​1625)
    • Adds IdentityAssertionGrantProvider and supporting option/response types in ModelContextProtocol.Authentication implementing the Identity Assertion Authorization Grant flow: RFC 8693 token exchange at the enterprise IdP (ID Token → JWT Authorization Grant) followed by RFC 7523 JWT bearer grant at the MCP authorization server (JAG → access token). See the new Cross-Application Access section in the transport docs for full usage details.

Documentation Updates

  • Fix broken links to MCP Tasks specification #​1594 by @​tarekgh

Repository Infrastructure Updates

  • Update release processes to support release servicing branches #​1620 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

  • @​aniket-okta made their first contribution in #​1305
  • @​felixweinberger submitted issue #​949 (resolved by #​1305)
  • @​eiriktsarpalis @​ericstj @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.3.0...v1.4.0

1.3.0

v1.3.0 focuses on improved transport diagnostics and security-focused documentation. The new public ClientTransportClosedException gives stdio and HTTP clients structured access to transport closure details (exit codes, process IDs, stderr tails, HTTP status codes) without parsing exception messages. Two reliability fixes harden the stdio process pipeline (preventing host crashes from user StandardErrorLines callbacks) and correct the stateless HTTP transport's capability advertisement. New conceptual documentation covers role/identity propagation in tool execution, allowed-hosts and CORS guidance for HTTP servers, and aligns the docs information architecture with the MCP specification structure.

What's Changed

  • Make ClientTransportClosedException public and unify transport exception handling #​1467 by @​stephentoub (co-authored by @​halter73 @​Copilot)
    • As part of this unification, SSE/HTTP client connection failures from McpClient.CreateAsync(...) now surface as IOException (the new ClientTransportClosedException derives from IOException) rather than InvalidOperationException. Caller-triggered OperationCanceledException is also no longer wrapped, matching standard async cancellation semantics.
  • Fix process crash when testing Stderr #​1449 by @​ericstj (co-authored by @​Copilot)
  • Fix stateless HTTP transport advertising listChanged capability #​1509 by @​jayaraman-venkatesan

Documentation Updates

  • docs: align docs IA with MCP specification structure #​1481 by @​jeffhandley (co-authored by @​mikekistler @​Copilot)
  • Document recommended pattern for role/identity propagation in MCP tool execution #​1497 by @​jeffhandley (co-authored by @​halter73 @​mikekistler @​Copilot)
  • Document and demonstrate allowed hosts and CORS policy guidance #​1554 by @​jeffhandley (co-authored by @​halter73 @​mikekistler @​Copilot)

Test Improvements

  • Fix flaky OutgoingFilter_MultipleFilters_ExecuteInOrder test #​1488 by @​ericstj (co-authored by @​Copilot)

Repository Infrastructure Updates

  • Bump the opentelemetry-testing group with 5 updates #​1478
  • Bump actions/deploy-pages from 4.0.5 to 5.0.0 #​1477
  • Bump actions/download-artifact from 8.0.0 to 8.0.1 #​1437
  • Bump actions/setup-dotnet from 5.1.0 to 5.2.0 #​1418
  • Bump actions/setup-node from 6.2.0 to 6.3.0 #​1419
  • Bump the testing-frameworks group with 1 update #​1459
  • Bump the npm_and_yarn group across 1 directory with 2 updates #​1410
  • Switch to custom CodeQL workflow #​1489 by @​jeffhandley
  • Block Release Publishing workflow from automatically running on forks #​1450 by @​jeffhandley (co-authored by @​Copilot)
  • Bump actions/checkout from 4 to 6 #​1504
  • Add testing guidelines, update copilot instructions for tests #​1507 by @​ericstj
  • Bump OpenTelemetry and 3 others #​1514
  • Bump the opentelemetry-testing group with 6 updates #​1533
  • Bump actions/setup-node from 6.3.0 to 6.4.0 #​1522
  • Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #​1511
  • Bump the npm_and_yarn group across 1 directory with 5 updates #​1500
  • Bump Anthropic from 12.9.0 to 12.11.0 #​1506
  • Bump actions/upload-artifact from 7.0.0 to 7.0.1 #​1512
  • Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.4 to 5.5.5 #​1521
  • Bump the testing-frameworks group with 2 updates #​1523
  • Bump the other-testing group with 2 updates #​1534
  • Bump Microsoft.Extensions.AI from 10.4.1 to 10.5.0 #​1525
  • Remove extraneous labels from dependabot.yml #​1535 by @​mikekistler
  • Bump Anthropic from 12.11.0 to 12.17.0 #​1544
  • Fix dev container configuration to work in codespaces #​1555 by @​mikekistler
  • Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #​1543
  • Bump the npm_and_yarn group across 1 directory with 3 updates #​1565
  • Bump Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.5.2 #​1561

... (truncated)

1.2.0

This release improves stateless HTTP transport defaults and documentation with a breaking behavioral change that we are considering as a server reliability fix and therefore not bumping the major version with this release. Legacy SSE endpoints are now disabled by default with a new HttpServerTransportOptions.EnableLegacySse property available to opt back into responding to the SSE endpoints; the property is marked as an [Obsolete] warning as we expect to remove this property in a future major version.

A warning-level [Obsolete] attribute is also applied to the RequestContext(McpServer, JsonRpcRequest) constructor, and the RequestContext(McpServer, JsonRpcRequest, TParams) overload should be used instead. This change contributes to fixes including DI scope lifetime in task-augmented tools, meta/progress combination failures, and outgoing message filter routing. We plan to remove the obsolete overload in a future major version.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

1. Disable legacy SSE by default #​1468

MapMcp() no longer maps /sse and /message endpoints by default. Servers whose clients connect via SSE will find those endpoints removed.

Migrating from legacy SSE

If your clients connect to a /sse endpoint (e.g., https://my-server.example.com/sse), they were using the legacy SSE transport--if not running in Stateless mode. The /sse and /message endpoints are now disabled by default (EnableLegacySse is false and marked [Obsolete] with diagnostic MCP9004). Upgrading the server SDK without updating clients will break SSE connections.

Client-side migration. Change the client Endpoint from the /sse path to the root MCP endpoint — the same URL your server passes to MapMcp(). For example:

// Before (legacy SSE):
Endpoint = new Uri("https://my-server.example.com/sse")

// After (Streamable HTTP):
Endpoint = new Uri("https://my-server.example.com/")

With the default HttpTransportMode.AutoDetect transport mode, the client automatically tries Streamable HTTP first. You can also set TransportMode = HttpTransportMode.StreamableHttp explicitly if you know the server supports it.

Server-side migration. If you previously relied on /sse being mapped automatically, you now need EnableLegacySse = true (suppressing the MCP9004 warning) to keep serving those endpoints. The recommended path is to migrate all clients to Streamable HTTP and then remove EnableLegacySse.

Transition period. If some clients still need SSE while others have already migrated to Streamable HTTP, set EnableLegacySse = true with Stateless = false. Both transports are served simultaneously by MapMcp() — Streamable HTTP on the root endpoint and SSE on /sse and /message. Once all clients have migrated, remove EnableLegacySse and optionally switch to Stateless = true.

SSE (legacy — opt-in only)

Legacy SSE endpoints are now disabled by default and must be explicitly enabled via HttpServerTransportOptions.EnableLegacySse. This is the primary reason they are disabled — the SSE transport has no built-in HTTP-level backpressure.

The legacy SSE transport separates the request and response channels: clients POST JSON-RPC messages to /message and receive responses through a long-lived GET SSE stream on /sse. The POST endpoint returns 202 Accepted immediately after queuing the message — it does not wait for the handler to complete. This means there is no HTTP-level backpressure on handler concurrency, because each POST frees its connection immediately regardless of how long the handler runs.

Internally, handlers are dispatched with a fire-and-forget pattern. A client can send unlimited POST requests to /message while keeping the GET stream open, and each one spawns a concurrent handler with no built-in limit.

The GET stream does provide session lifetime bounds: handler cancellation tokens are linked to the GET request's HttpContext.RequestAborted, so when the client disconnects the SSE stream, all in-flight handlers are cancelled. This is similar to SignalR's connection-bound lifetime model — but unlike SignalR, there is no per-client concurrency limit like MaximumParallelInvocationsPerClient. The GET stream provides cleanup on disconnect, not rate-limiting during the connection.

2. Obsolete 2-arg RequestContext constructor #​1462

The RequestContext(McpServer, JsonRpcRequest) constructor is now [Obsolete] with diagnostic MCP9003, producing build warnings. The Params property is also changed from TParams? to TParams.

Migration: Use the new 3-arg constructor: new RequestContext(server, request, parameters).

What's Changed

  • Support specifying OutputSchema independently of return type for tools returning CallToolResult #​1425 by @​stephentoub (co-authored by @​Copilot)
  • Add 3-arg RequestContext constructor and obsolete 2-arg to eliminate null-forgiving operator usage #​1462 by @​halter73 (co-authored by @​Copilot)
    ... (truncated)

1.1.0

Highlights of v1.1.0 include client completion details for understanding when and why a client connection ended, auto-populated completion handlers from AllowedValuesAttribute, and bug fixes for server-initiated ping handling, server capabilities initialization, and in-flight message handler cleanup.

What's Changed

  • Register ping handler in McpSessionHandler to support server-initiated pings #​1391 by @​stephentoub (co-authored by @​Copilot)
  • Fix Extensions not being copied to ServerCapabilities during initialization #​1399 by @​stephentoub (co-authored by @​Copilot)
  • Auto-populate completion handlers from AllowedValuesAttribute on prompt/resource parameters #​1380 by @​stephentoub (co-authored by @​Copilot)
  • Add client completion notification and details #​1368 by @​stephentoub (co-authored by @​Copilot)
  • Wait for in-flight message handlers before ProcessMessagesCoreAsync returns #​1403 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

  • Add SSE server code example to transports documentation #​1385 by @​jeffhandley (co-authored by @​Copilot)
  • Simplify and update README for stable release #​1387 by @​stephentoub (co-authored by @​jeffhandley)
  • Simplify and update package README.md files for stable release #​1388 by @​stephentoub (co-authored by @​Copilot @​jeffhandley)
  • Remove outdated README reference from transports.md #​1394 by @​halter73
  • Clean up markdown-link-check warnings #​1395 by @​jeffhandley (co-authored by @​Copilot)

Repository Infrastructure Updates

  • Enable EnablePackageValidation for all src packages with 1.0.0 baseline #​1330 by @​jeffhandley (co-authored by @​Copilot @​stephentoub)
  • Bump hono from 4.12.0 to 4.12.2 in the npm_and_yarn group across 1 directory #​1392
  • Bump docfx from 2.78.4 to 2.78.5 #​1408
  • Bump actions/download-artifact from 7.0.0 to 8.0.0 #​1406
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #​1405
  • Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.1 to 5.5.2 #​1404
  • Bump the testing-frameworks group with 1 update #​1407
  • Add issue-triage Copilot skill #​1412 by @​jeffhandley (co-authored by @​Copilot)
  • Release v1.1.0 #​1411 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

  • @​r-Larch submitted issue #​1269 (resolved by #​1403)
  • @​darena-mhaque submitted issue #​1398 (resolved by #​1399)
  • @​hulumane submitted issue #​1332 (resolved by #​1368)
  • @​AArnott submitted issue #​438 (resolved by #​1368)
  • @​JarroVGIT submitted issue #​1390 (resolved by #​1391)
  • @​stephentoub @​halter73 @​eiriktsarpalis @​jeffhandley reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.0.0...v1.1.0

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 7.5.1 to 7.7.3.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

7.7.3

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@7.7.2...7.7.3

7.7.2

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.
  • Improve validation of jku claim. See PR #​3480.

Dependency Updates

  • Update System.Text.Json to 8.0.5 on all target frameworks except .NET 461. See PR #​3499.

7.7.1

7.7.1

Bug Fix

  • Re-add JsonSerializerPrimitives.TryAllStringClaimsAsDateTime which was removed as it is in an internal class, but due to InternalsVisibleTo can lead to a MissingMethodException if IdentityModel versions are not aligned. See PR #​2734 for details.

7.7.0

7.7.0

CVE package updates

CVE-2024-30105

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2715 for details.

Performance improvement

7.6.2

7.6.2

Bug Fix:

  • Revert reduced allocations in AadIssuerValidator by not using string.Replace where appropriate due to an index out-of-range error.

7.6.1

7.6.1

New Features:

  • Add missing metadata parameters to OpenIdConnectConfiguration. See issue #​2498 for details.

Bug Fixes:

  • Fix over-reporting of IDX14100. See issue #​2058 and PR #​2618 for details.
  • JwtRegisteredClaimNames now contains previously missing Standard OpenIdConnect claims. See issue #​1598 for details.

Performance Improvements:

  • Reduced allocations in AadIssuerValidator by not using string.Replace where appropriate. See issue #​2595 and PR #​2597 for more details.
  • No longer for every string claim, calling DateTime.TryParse on each value, whether it is expected to be a DateTime or not. See issue #​2615 for details.

7.6.0

7.6.0

New Features:

  • Update JsonWebToken - extract and expose the method that reads the header/payload property values from the reader so it can be overridden in children classes to add any extra own logic. See issues #​2581, #​2583, and #​2495 for details.

Bug Fixes:

  • JWE header algorithm is now compliant to IANA document. See issue #​2089 for details.

Performance Improvements:

  • Reduce the number of internal array allocations that need to happen for each claim set, see PR #​2596.

Fundamentals:

  • Add an AOT compatibility check on each PR to ensure only AOT compatible code is checked-in. See PR #​2598.
  • Update perl scrip for OneBranch build. See PR #​2602.
  • Add langversion 12 to benchmark tests. See PR #​2601.
  • Removed unused build.cmd file. See PR #​2605.
  • Create CodeQL exclusions file. See PR #​2609.
  • Fix variable usage in AOT script. See PR #​2610.
  • Move Microsoft.IdentityModel.Tokens delegates to a new file. See PR #​2606

7.5.2

7.5.2

Bug Fixes:

  • Validate authentication tag length so a JWE with appended characters will not be considered a valid token. See issues #​2201, #​1641, PR #​2569, and IDX10625 Wiki for details. By @​kellyyangsong

Fundamentals:

  • App Context Switches in Identity Model 7x are now documented here. By @​kellyyangsong

Performance Improvements:

  • In .NET 6 or greater, use a temporary buffer to reduce intermediate allocation in VerifyRsa/VerifyECDsa. See PR #​2589 for more details. By @​eerhardt
  • Reduce allocations in ValidateSignature by using a collection expression instead of new List<SecurityKey> { key }, to optimize for the single element case. See PR #​2586 for more details. By @​eerhardt
  • Remove Task allocation in AadIssuerValidator. See PR #​2584 for more details. By @​eerhardt

Commits viewable in compare view.

Updated xunit from 2.9.0 to 2.9.3.

Release notes

Sourced from xunit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the nuget-minor-patch group with 6 updates
eb45953 
Bumps coverlet.collector from 6.0.0 to 6.0.4
Bumps coverlet.msbuild from 6.0.0 to 6.0.4
Bumps Microsoft.NET.Test.Sdk from 17.9.0 to 17.14.1
Bumps ModelContextProtocol.AspNetCore from 1.0.0 to 1.4.1
Bumps System.IdentityModel.Tokens.Jwt from 7.5.1 to 7.7.3
Bumps xunit from 2.9.0 to 2.9.3

---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: coverlet.collector
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: coverlet.msbuild
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: coverlet.msbuild
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: ModelContextProtocol.AspNetCore
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 7.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency dotnet Related to the .NET packages or toolchain labels Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency dotnet Related to the .NET packages or toolchain

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants