chore(deps): update nuget packages#1159
Conversation
renovate
Bot
force-pushed
the
renovate/nuget
branch
from
a1714d9 to
1a5f108
Compare
renovate
Bot
changed the title
🔍 Vulnerabilities of
|
| digest | sha256:457076377a096137d7ff14e98bff9dd6bb07fcdcfbca01d1c4132eb98ae7e172 |
| vulnerabilities |     |
| platform | linux/amd64 |
| size | 337 MB |
| packages | 1126 |
📦 Base Image ubuntu:24.04
| also known as |
|
| digest | sha256:cdb5fd928fced577cfecf12c8966e830fcdf42ee481fb0b91904eeddc2fe5eff |
| vulnerabilities |   |
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
Description
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
| ||||||||||||||||||||||||
# Dockerfile (3:10)
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base-linux
USER $APP_UID
ENTRYPOINT [ "dotnet" ]
FROM mcr.microsoft.com/dotnet/sdk:10.0-nanoserver-ltsc2022 AS base-windows
ENTRYPOINT ["C:\\Program Files\\dotnet\\dotnet.exe"]
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build-linux
Description
|
renovate
Bot
force-pushed
the
renovate/nuget
branch
9 times, most recently
from
8e8cd80 to
cee7be5
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
3 times, most recently
from
fdf5317 to
07fe229
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
10 times, most recently
from
24e770f to
ead2e06
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
5 times, most recently
from
3e693dd to
1b44aee
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
4 times, most recently
from
4aa2ee7 to
4e137c0
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
3 times, most recently
from
d31bcfb to
270504f
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
4 times, most recently
from
c97abd1 to
77da2ab
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
8 times, most recently
from
ca6570c to
1b506eb
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
5 times, most recently
from
645cb7f to
c401812
Compare
|
renovate
Bot
force-pushed
the
renovate/nuget
branch
2 times, most recently
from
4a03b7e to
0de7511
Compare
renovate
Bot
force-pushed
the
renovate/nuget
branch
from
0de7511 to
3478a05
Compare
|
This PR contains the following updates:
2.5.1→2.5.23.7.500.80→3.7.5013.7.510.6→3.7.511.73.7.502.39→3.7.502.563.7.504.32→3.7.504.495.2.0→5.3.03.32.0→3.34.02.76.0→2.80.02.76.0→2.80.02.76.0→2.80.02.76.0→2.80.02.76.0→2.80.08.0.24→8.0.2710.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.810.0.3→10.0.88.0.24→8.0.2710.0.3→10.0.818.0.1→18.5.12.7.2→2.8.02.7.2→2.8.04.4.0→4.6.04.11.2→4.13.06.1.0→6.2.02.11.0→2.13.18.0.0→8.0.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
Azure/amqpnetlite (AMQPNetLite.Core)
v2.5.2: Release 2.5.2Fixes and improvements:
aws/aws-sdk-net (AWSSDK.S3)
v3.7.511destructurama/attributed (Destructurama.Attributed)
v5.3.0Compare Source
New features
Changes for CI and tests
Full Changelog: destructurama/attributed@5.2.0...5.3.0
googleapis/google-cloud-dotnet (Google.Cloud.PubSub.V1)
v3.34.0: Google.Cloud.PubSub.V1 version 3.34.0Compare Source
Bug fixes
Documentation improvements
v3.33.0: Google.Cloud.PubSub.V1 version 3.33.0Compare Source
New features
grpc/grpc-dotnet (Grpc.AspNetCore.Web)
v2.80.0What's Changed
New Contributors
Full Changelog: grpc/grpc-dotnet@v2.76.0...v2.80.0
dotnet/dotnet (Microsoft.Bcl.AsyncInterfaces)
v10.0.8v10.0.7v10.0.6v10.0.5v10.0.4microsoft/vstest (Microsoft.NET.Test.Sdk)
v18.5.1What's Changed
Full Changelog: microsoft/vstest@v18.5.0...v18.5.1
v18.5.0What's Changed
Full Changelog: microsoft/vstest@v18.4.0...v18.5.0
v18.4.0What's Changed
Add LoongArch64 support by @stdmnpkg in #15359
Refactor Condition evaluation by @Youssef1313 in #15357
Adding info on extensions points part 1 by @nohwnd in #15360
Add option to ask for uploading code QL before the standard window ends by @nohwnd in #15373
Update runtime versions by @nohwnd in #15372
Fix .NET 10 regression for traits by @Youssef1313 in #15370
Update target frameworks to net10.0 and net11.0 by @dotnet-maestro[bot] in #15349
Fix names in pipeline matrix so we don't have to align them by @nohwnd in #15365
Update SECURITY.md by @Youssef1313 in #15342
New Contributors
Full Changelog: microsoft/vstest@v18.3.0...v18.4.0
v18.3.0What's Changed
Internal fixes and updates
New Contributors
nats-io/nats.net (NATS.Client.JetStream)
v2.8.0: NATS .NET v2.8.0Happy to announce the NATS .NET 2.8.0 stable release of the 2.8 line. It picks up the NATS Server v2.14 client surface (consumer reset,
$JS.FC.*flow-control replies,Consumerfield on stream source/mirror,AllowBatchPublishon stream config), ships two breaking changes that landed in the preview cycle, and fixes in-flight message loss on consumer/connection dispose behind an opt-in drain.A big thank you to all NATS contributors and community members who helped make this release possible. <3
NATS Server v2.14 Features
ResetConsumerAsynconINatsJSContextandINatsJSConsumer(ADR-60), to reset a pinned consumer's state (#1126).$JS.FC.*flow-control replies are parsed by the JS metadata layer, for streams that publish with thejs_ack_fc_v2flag (#1127).Consumerfield onStreamSourceand stream mirror config, for pre-created mirror/source consumers (#1128).AllowBatchPublishonStreamConfig(JSONallow_batched), required by streams that opt into fast-ingest batch publishing per ADR-50 (#1120). The fast-ingest publisher itself lives in orbit.net alongside the existing atomic batch publisher.Breaking Changes
Subject Validation On By Default (#1093)
Subjects containing whitespace (space, tab, CR, LF) now throw
NatsException. This closes a class of CRLF injection issues from malformed subjects.Opt out if you rely on legacy subjects that contain whitespace:
NKeyPair Removed From NATS.Client.Core (#1101)
NATS.Client.Core.NKeysandNKeyPairare removed. Signing now goes through theNATS.NKeyspackage, which lets the nkey/Ed25519 code be versioned independently of the client.For typical users this is transparent: keep using
NatsAuthOpts.NKeyFile,CredsFile,Jwt+Seed, orAuthCredCallbackand the client wires up the new signer automatically.Only direct callers of
NATS.Client.Core.NKeyPairneed to switch:Other Notable Changes
NatsConnectionsurfaces server-side errors to client code.auth_requiredadvertisement (#1109), so NKey/credential clients respond to the challenge even when the server doesn't advertiseauth_required.Rangeattribute fix onMaxBytes(#1096).ArrayPoolbuffers are cleared before return to pool (#1097).What's Changed
Since
2.8.0-preview.3:2.8.0-preview.3:$JS.FCsupport to JS metadata parser (#1127) [server 2.14]2.8.0-preview.2:2.8.0-preview.1:Full Changelog: nats-io/nats.net@v2.7.3...v2.8.0
Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.8.0
v2.7.3: NATS .NET v2.7.3Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#1089) even though the vulnerable API is not used by our library.
A big thank you to all NATS contributors and community members who helped make this release possible ❤️
Breaking Changes
NakAsync Signature Change (#1081)
The
TimeSpan delayparameter has been removed fromINatsJSMsg<T>.NakAsync(). The delay must now be passed viaAckOpts.NakDelay.Before (v2.7.2):
After (v2.7.3):
Note: because we also have an extension method, recompiling your project is enough.
AckTerminateAsync TermWithReason (#1048, #1081)
AckTerminateAsyncnow supports an optional termination reason. A new overload and a newTerminateReasonproperty onAckOptshave been added toINatsJSMsg<T>. Implementors of this interface must add the new method.Requires NATS Server 2.10.4+.
PinnedClient Validation (#1063)
Calling
NextAsync(),FetchAsync(), orFetchNoWaitAsync()on a consumer withPriorityPolicy.PinnedClientnow throwsNatsJSException. UseConsumeAsync()instead.Consumer Cancellation Handling (#1068)
Consumer methods (
ConsumeAsync,FetchAsync,NextAsync) now callcancellationToken.ThrowIfCancellationRequested()immediately at method entry. Previously cancelled tokens were checked later in the async pipeline.StreamSnapshotRequest ChunkSize Type Change (#1088)
StreamSnapshotRequest.ChunkSizechanged fromlongtoint?with a narrower validation range (1KB–1MB).WindowSize(int?) was added as a new optional property.WindowSizerequires NATS Server 2.12.5+.OpenTelemetry Tag Change (#1078)
The telemetry tag
network.protocol.version(value: protocol version number) has been replaced withnetwork.transport(value:"tcp") to align with OpenTelemetry semantic conventions. Update any dashboards or alerting rules that filter on the old tag name.Default Parameter Values Changed from
defaulttonull(#1081)All optional parameters on
INatsJSMsg<T>methods (AckAsync,NakAsync,AckProgressAsync,AckTerminateAsync,ReplyAsync) changed from= defaultto= null. This is source-compatible but binary-breaking — existing compiled assemblies must be recompiled against v2.7.3.What's Changed
PingCommandcancellation by @mtmk in #1086Full Changelog: nats-io/nats.net@v2.7.2...v2.7.3
CVE Update
Microsoft.Bcl.Memoryis a transitive dependency fornetstandard2.0targets any app pulling inNATS.Client.Coregets it. Even though this library doesn't call the vulnerableBase64Url.DecodeAPI, the consuming application (or another dependency in its graph) might. A CVSSv3 7.5 DoS from a malformed network input is not something you want sitting in your dependency tree. (Microsoft CVE )If you are not upgrading to this new version of NATS .NET AND targeting NETStandard2.0, applications should add an explicit package reference to force the patched version:
You don't need to upgrade NATS.NET itself to get the fix if you need time. NuGet will happily resolve the newer patch version of
Microsoft.Bcl.Memorysince it's within the samemajor.minorrange.Here is a report generated by AI:
Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.7.3
nunit/nunit (NUnit)
v4.6.0: NUnit 4.6.0Compare Source
See release notes for details.
v4.5.1: V 4.5.1Compare Source
See release notes for details.
v4.5.0: V 4.5.0Compare Source
See release notes for details.
nunit/nunit.analyzers (NUnit.Analyzers)
v4.13.0: NUnit Analyzers 4.13 - May 2, 2026Compare Source
NUnit Analyzers 4.13 - May 2, 2026
This release of the NUnit Analyzers updates analyzer handling for the NUnit 4.6 API change that replaces
ActualValueDelegate<>withFunc<>- see nunit/nunit#4824 for more information.Analyzers now also consider the return type of
Func<>in assertions. The release also includes one bug fix andsome dependency updates.
The release contains contributions from the following users (in alphabetical order):
Issues Resolved
Features and Enhancements
Func<T>return valuesBugs
Tooling, Process, and Documentation
v4.12.0: NUnit Analyzers 4.12 - March 3, 2026Compare Source
NUnit Analyzers 4.12 - March 3, 2026
This release of the NUnit Analyzers improves
NUnit1029to account forTestCaseSourcesupport for params and optional arguments. It also introduces a new analyzer for incorrect
usage of
Is.Not.Null.Or.Empty, fixes regressions inNUnit2005andNUnit2055, and updatesNUnit package dependencies.
The release contains contributions from the following users (in alphabetical order):
Issues Resolved
Features and Enhancements
Is.Not.Null.Or.EmptyusedBugs
NUnit2055can generate invalid code for classic assertsNUnit2005tries to useIs.Emptyconstraint on incompatible types.Tooling, Process, and Documentation
nunit/nunit3-vs-adapter (NUnit3TestAdapter)
v6.2.0: V 6.2.0See release notes
StackExchange/StackExchange.Redis (StackExchange.Redis)
v2.13.1Compare Source
IMPORTANT: This release changes the default protocol from RESP2 to RESP3 for Azure Managed Redis endpoints (only); this
has scalability and feature advantages, but if you are using modules or ad-hoc commands, please see the RESP3 notes, which includes:
What's Changed
Full Changelog: StackExchange/StackExchange.Redis@2.12.27...2.13.1
v2.12.14Compare Source
What's Changed
Impact: "high" if using cluster and high-integrity-mode together (resolves an issue that can mis-report
-MOVEDresponses as integrity failures)NuGet link
New Contributors
Full Changelog: StackExchange/StackExchange.Redis@2.12.8...2.12.14
v2.12.8Compare Source
What's Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.