[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Microsoft.AspNetCore.OpenApi (source)	10.0.12 → 10.0.14
Microsoft.Extensions.ApiDescription.Server (source)	10.0.12 → 10.0.14
StackExchange.Redis (source)	3.3.1 → 3.4.29
coverlet.collector	10.0.1 → 10.1.0
mkdocs-material (changelog)	9.7.7 → 9.8.0

---

Release Notes

dotnet/dotnet (Microsoft.AspNetCore.OpenApi)

v10.0.14

v10.0.13

StackExchange/StackExchange.Redis (StackExchange.Redis)

v3.4.29

Compare Source

What's Changed

• (stabilty) Reset a CycleBuffer segment's start trim when it is recycled (#​3302) by @​mgravell in #​3303
• Restore: make the dedicated subscription connection lazy by @​mgravell in #​3310
• Update RedisType.Bitmap and the keyspace-event tokens to reflect current server values by @​mgravell in #​3312
• Fix ConnectionGroupMember string-ctor dropping the name by @​mgravell in #​3314
• Parse unbracketed IPv6 ip:port from the server (#​1422) by @​mgravell in #​3307
• Profile commands sent in a batch (#​2175) by @​mohsinaliwork686-rgb in #​3313

Tooling

• gitignore: .claude is per-user state except .claude/skills by @​mgravell in #​3306
• Command coverage ledger and audit skill by @​mgravell in #​3311
• Update public API docs by @​mgravell in #​3429

New Contributors

• @​mohsinaliwork686-rgb made their first contribution in #​3313

Full Changelog: StackExchange/StackExchange.Redis@3.4.20...3.4.29

v3.4.20

Compare Source

Stability improvements

• Do not abandon a connection attempt before ConnectTimeout has elapsed by @​mgravell in #​3277
• Read HELLO "server" before trusting "version" as the Redis API version by @​mgravell in #​3279
• Sentinel soft-fail follow-ups: discovery failure as RedisConnectionException, late sentinel init, clear LastException by @​mgravell in #​3280
• Sentinel: re-resolve the primary when it is demoted on a healthy connection by @​rebaseandpanic in #​3281
• Route as a cluster only with a slot map; take HELLO mode/role from the interactive connection only by @​mgravell in #​3285
• Fail connection-dropped commands with RedisConnectionException, never a raw transport exception or a cancellation by @​mgravell in #​3287
• Connection groups: a member answering LOADING triggers an immediate re-probe and re-select by @​mgravell in #​3289
• IBatch: complete commands refused by a poisoned connection; divert a batch's tail on reconnect by @​mgravell in #​3286
• Give multi-message sub-commands and injected prefix commands a write time by @​mgravell in #​3293
• Send primary-only commands to the primary when the caller prefers a replica by @​AsadIqbal-Dev in #​3291

Maintenance

• Tests: stabilise two recurring Windows CI flakes (hash-field expiry clock skew, backlog counter quiescence) by @​mgravell in #​3288
• Tests: don't race the connect's own reconfigures in AllClusterCommandsRefusedIsQuiet by @​mgravell in #​3290
• Refresh package pins: 10.0.13 servicing family and tooling by @​mgravell in #​3294
• xunit.v3 4.0 on Microsoft.Testing.Platform by @​mgravell in #​3295
• StyleCop.Analyzers 1.3.151-beta, and the tidy-up it asks for by @​mgravell in #​3296

New Contributors

• @​AsadIqbal-Dev made their first contribution in #​3291

Full Changelog: StackExchange/StackExchange.Redis@3.4.5...3.4.20

v3.4.5

Compare Source

What's Changed

• Tolerate refused CLUSTER SLOTS/NODES during topology updates by @​mgravell in #​3275
• ConnectionAttemptCompleted: take the sequence number and timestamp together by @​mgravell in #​3270
• Lag-aware failback checks for geo-redundant failover by @​mgravell in #​3242
• Fix StringSet(Expiration, ValueCondition) doc link: set, not delex by @​mgravell in #​3272
• Report a transport connection's failure the way a stream connection's is reported by @​MDA2AV in #​3273

New Contributors

• @​MDA2AV made their first contribution in #​3273

Full Changelog: StackExchange/StackExchange.Redis@3.4.0...3.4.5

v3.4.0

Compare Source

Major Changes

• In RESP3, by default the library now uses separate connections for pub/sub; see #​3264
• Smart-client-handoffs is now enabled by default on Redis Enterprise and AMR; see #​3248
• Some logging events incorrectly used duplicated ids - resolved; see #​3266

All Changes

• Recover promptly from a cluster failover; fix the configuration channel under RESP3 and with a channel prefix (#​3254) by @​mgravell in #​3255
• Preserve binary members as VectorSetRange bounds by @​Laurianti in #​3256
• Smart client handoffs: reinstate auto-enlistment for the hosted providers and remove [Experimental] by @​mgravell in #​3248
• docs: fix retry-category test in the custom RetryPolicy sample by @​mgravell in #​3265
• Fix duplicate LoggerMessage event ids; add a guard test by @​mgravell in #​3266
• Scan: observe the faults of abandoned page tasks after a sync timeout or dispose (#​3260) by @​mgravell in #​3267
• Report the outcome of every physical connection attempt, identifying the client certificate used by @​mgravell in #​3257
• Use a dedicated pub/sub connection under RESP3 by default by @​mgravell in #​3264

Tooling

• docs(agents): add create-implementation-plan-for-redis-api-change skill by @​uglide in #​3268

New Contributors

• @​Laurianti made their first contribution in #​3256

Full Changelog: StackExchange/StackExchange.Redis@3.3.1...3.4.0

coverlet-coverage/coverlet (coverlet.collector)

v10.1.0

Improvements

• Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #​2019
• Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #​1946
• Replace legacy .sln files with modern .slnx format #​1966
• coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #​2005
• Relax auto-property skip logic and improve coverage for records #​1941

Fixed

• Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #​1980 #​1967
• Fix Regression in branch coverage for lambda expressions #​1938
• Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #​1979
• Fix silent zero coverage on .NET Framework since 8.0.0 #​1985 by @​tobiwae
• Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #​1987 #​1988 by @​bkoelman
• Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #​2010
• Fix use --config-file CLI arg in coverlet.MTP #​2030 by alexthornton1
• Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #​2032 by @​Eljees

Diff between 10.0.1 and 10.1.0

squidfunk/mkdocs-material (mkdocs-material)

v9.8.0: mkdocs-material-9.8.0

Compare Source

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	<=3.1.5	3.1.6	CVE-2025-27516
Markdown	<3.8.1	3.8.1	CVE-2025-69534
Pygments	<2.20.0	2.20.0	CVE-2026-4539
PyMdown Extensions	<=11.0.0	11.0.1	CVE-2026-67422
Requests	<2.33.0	2.33.0	CVE-2026-25645
Pillow	<13.0.0	13.0.0	CVE-2026-96636
CairoSVG	<=2.9.0	2.9.1	CVE-2026-107378
GitPython	<=3.2.0	3.2.1	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.