chore(deps-nuget): Bump the nuget-dependencies group with 16 updates by dependabot[bot] · Pull Request #290 · spelech/model-context-gateway

dependabot · 2026-11-13T12:21:45Z

Updated coverlet.collector from 10.0.1 to 10.1.0.

Release notes

Sourced from coverlet.collector's releases.

10.1.0

Improvements

Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #2019
Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #1946
Replace legacy .sln files with modern .slnx format #1966
coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #2005
Relax auto-property skip logic and improve coverage for records #1941

Fixed

Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #1980 #1967
Fix Regression in branch coverage for lambda expressions #1938
Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #1979
Fix silent zero coverage on .NET Framework since 8.0.0 #1985 by @tobiwae
Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #1987 #1988 by @bkoelman
Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #2010
Fix use --config-file CLI arg in coverlet.MTP #2030 by alexthornton1
Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #2032 by @Eljees

Diff between 10.0.1 and 10.1.0

Commits viewable in compare view.

Updated Dapper from 2.1.79 to 2.1.89.

Release notes

Sourced from Dapper's releases.

2.1.89 What's Changed

Fully sign the StrongName assemblies on every platform by @mgravell in Fully sign the StrongName assemblies on every platform DapperLib/Dapper#2237
Suppress trim and AOT diagnostics in Dapper fallback paths by @JamesNK in Suppress trim and AOT diagnostics in Dapper fallback paths DapperLib/Dapper#2233
Run the main build on every push to main, not just root-file pushes by @mgravell in Run the main build on every push to main, not just root-file pushes DapperLib/Dapper#2238

New Contributors

@JamesNK made their first contribution in Suppress trim and AOT diagnostics in Dapper fallback paths DapperLib/Dapper#2233

Full Changelog: DapperLib/Dapper@2.1.86...2.1.89

2.1.86 What's Changed

Point docs links at dapperlib.dev by @mgravell in Point docs links at dapperlib.dev DapperLib/Dapper#2222
Point PackageReleaseNotes at GitHub Releases by @mgravell in Point PackageReleaseNotes at GitHub Releases DapperLib/Dapper#2223
Pin the docs site config, and give it a favicon by @mgravell in Pin the docs site config, and give it a favicon DapperLib/Dapper#2224
DynamicParameters.AddParameters(IDbCommand): identity-free self-apply by @mgravell in DynamicParameters.AddParameters(IDbCommand): identity-free self-apply DapperLib/Dapper#2225
Re-enable DateOnly/TimeOnly support, fixing the defects that got it disabled by @mgravell in Re-enable DateOnly/TimeOnly support, fixing the defects that got it disabled DapperLib/Dapper#2228
Publish to nuget.org via Trusted Publishing (OIDC), and retire MyGet/AppVeyor by @mgravell in Publish to nuget.org via Trusted Publishing (OIDC), and retire MyGet/AppVeyor DapperLib/Dapper#2230

Full Changelog: DapperLib/Dapper@2.1.79...2.1.86

Commits viewable in compare view.

Updated FluentAssertions from 8.10.0 to 8.11.0.

Release notes

Sourced from FluentAssertions's releases.

8.11.0 What's Changed

New Contributors

@jpgomezv made their first contribution in Fix typo in exceptions page fluentassertions/fluentassertions#3317

Full Changelog: fluentassertions/fluentassertions@8.10.0...8.11.0

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 7.0.2 to 7.1.1.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.1.1

This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.

Package version alignment: The SqlClient family packages share the 7.1.1 version:

Microsoft.Data.SqlClient

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Microsoft.Data.SqlClient.Extensions.Azure

Microsoft.Data.SqlClient.Extensions.Abstractions

Microsoft.Data.SqlClient.Internal.Logging

Microsoft.SqlServer.Server is versioned independently and is not part of this release. Applications should use matching 7.1.1 versions of the driver and its companion packages. The aligned assemblies retain AssemblyVersion 7.0.0.0; upgrading from 7.1.0 does not require new .NET Framework strong-name binding redirects.

Companion package release notes

Changes Since 7.1.0

Fixed

Fixed an ArgumentException when sending zero-valued decimal or SqlDecimal parameters whose precision equals their scale. Nonzero precision validation and support for large decimal values are unchanged. (#4715, #4721, #4732)
Fixed connection pool V2 handing out pooled connections with expired or nearly expired access tokens. The pool now checks token expiry before reuse, matching the default pool's behavior while preserving transaction-affine reuse. This affects only applications that opt in to connection pool V2. (#4734, #4739)
Fixed connection opens failing when ClearPool or ClearAllPools races with an in-flight open. Requests already admitted to the cleared pool can finish, and connections returned to the retired pool are discarded rather than reused. (#4714, #4718, #4740)

Target Platform Support

.NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
.NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

Microsoft.Bcl.Cryptography 9.0.18
Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
Microsoft.Data.SqlClient.Internal.Logging 7.1.1
Microsoft.Data.SqlClient.SNI.runtime 7.1.0
Microsoft.Extensions.Caching.Memory 9.0.18
Microsoft.IdentityModel.JsonWebTokens 8.16.0
Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
Microsoft.SqlServer.Server 1.0.0
System.Configuration.ConfigurationManager 9.0.18
System.Security.Cryptography.Pkcs 9.0.18
System.Threading.RateLimiting 9.0.18

... (truncated)

7.1.0

This is the general availability release of Microsoft.Data.SqlClient 7.1. It closes out the 7.1 preview cycle with application identity reporting for telemetry, the deprecation of TransparentNetworkIPResolution, and a set of connection, transaction, and Named Pipes fixes.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The 7.1.0 GA release continues this alignment; the following packages ship together as 7.1.0:

Microsoft.Data.SqlClient

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Microsoft.Data.SqlClient.Extensions.Azure

Microsoft.Data.SqlClient.Extensions.Abstractions

Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0 when upgrading Microsoft.Data.SqlClient to 7.1.0.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2, 7.0.3, or any 7.1 preview to 7.1.0 does not require any new .NET Framework strong-name binding redirects. Applications upgrading from 7.0.0 or 7.0.1 should note that Extensions.Azure, Extensions.Abstractions, and Internal.Logging raised their AssemblyVersion from 1.0.0.0 to 7.0.0.0 in 7.0.2; see those release notes for the one-time .NET Framework impact.

Companion package release notes

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

What Changed:

Added a RegisteredApplication enum and a matching SqlConnection.RegisteredApplication property that let a library or tool identify itself to SQL Server through version 2 of the TDS USERAGENT feature extension. The payload also carries a new driver-owned 64-bit Driver Properties flag field; bit 0 reports whether connection pool V2 is enabled for the process. Both fields are emitted as unpadded uppercase hexadecimal. (#3201, #4632)

Who Benefits:

Middleware and tooling built on top of the driver — Entity Framework Core, Semantic Kernel, SQL Server Management Studio, SqlPackage, Data API Builder, and similar — can be distinguished in server-side telemetry without the driver accepting arbitrary user-supplied user-agent text. This originated as a request from the Entity Framework Core team.
Service operators gain a more accurate picture of which client stacks are connecting, which helps when diagnosing workload-specific behavior.

Impact:

Purely additive from the application's perspective: a newly created physical connection whose RegisteredApplication is unset reports Unknown (0). On the wire the field itself is new — USERAGENT payload v1 carried no application identifier, while v2 always emits one.
Set the property before calling Open or OpenAsync. Assigning it while the connection is connecting or open throws InvalidOperationException.

using var connection = new SqlConnection(connectionString);
connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore;
await connection.OpenAsync();

The enum is ushort-backed and marked [CLSCompliant(false)]. Values are partitioned by range: 0x0001–0x7FFF for Microsoft-defined large-scale applications, 0x8000–0xBFFF for small-scale use, and 0xC000–0xFFFF for public/developer use. Applications that are not yet registered can cast an unassigned value from the appropriate range.
... (truncated)

7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

`Microsoft.Data.SqlClient` 7.1.0-preview3

Added

Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#3672, #3673)
Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
- Transaction support (#4487)
- Broken-connection replacement during command execution (#4429)
- Background warmup to Min Pool Size and automatic replenishment (#4452)
- Idle pruning driven by Connection Idle Timeout (#4463)
- Optional ConcurrencyLimiter rate limiting for new physical connections (#4395, #4396)
- Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#4529)
- Metrics and tracing parity with the default pool (#4504)

Changed

Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#4207, #4239, #4465, #4474)
Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#4536)
SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #3677 (#4535)
No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#4528)
net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#4507)
Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#4564)

Fixed

Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#4532)
SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#1881, #4479)
Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#4504)
OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#1655, #4443)
TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#3953, #4294)
DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#3934, #4439)
ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#4445)
SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#4520)
Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#4437)
Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS endpoint. Ships in Microsoft.Data.SqlClient.Extensions.Azure (#4496, #4521)

Full details: release-notes/7.1/7.1.0-preview3.md

`Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` 7.1.0-preview3

Added

SqlColumnEncryptionAzureKeyVaultProvider overrides the four asynchronous key store provider methods introduced in #3673, calling the Azure SDK's own async APIs and flowing the supplied CancellationToken (#4540)
Concurrent cache misses for the same key collapse into a single Key Vault request. The gate is only awaited, so no thread blocks, and misses for different keys still proceed in parallel (#4540)
... (truncated)

7.1.0-preview2

This update brings the following changes since the 7.1.0-preview1 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview2. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview2 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview2 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

`Microsoft.Data.SqlClient` 7.1.0-preview2

Added

SqlConnection.GetSchemaAsync overloads with CancellationToken support (#3005)
SQL Graph pseudo-column aliases ($node_id, $edge_id, $from_id, $to_id) accepted in SqlBulkCopy mappings (#3677)
SqlBatchCommand.CommandBehavior and SqlBatch.ExecuteReader(CommandBehavior) are now honored (#4125)
Configurable idle connection timeout via Connection Idle Timeout / SqlConnectionStringBuilder.IdleTimeout (opt-in via Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior=false) (#4295)

Changed

Connect Timeout now propagates through the pool when Switch.Microsoft.Data.SqlClient.UseOverallConnectTimeoutForPoolWait=true is set (default off; introduces a Microsoft.Bcl.TimeProvider dependency) (#4270)
SQL Server 2025 json type added to the DataTypes collection returned by SqlConnection.GetSchema (#3858)
Internal state-machine hardening via Interlocked.CompareExchange guards (#4267)
Internal cleanup of connection-options inheritance and related pool interfaces (#4237, #4261, #4235, #4415, #4334)
LCID hardcoded mappings to avoid repeated culture lookups (#4212)
Allocation reductions on SqlErrorCollection and null-return paths (#4157, #4099, #4102)
Improved EnclaveDiffieHellmanInfo.Size accuracy (#4346)
SqlVector<float> serialization is now explicitly little-endian for cross-architecture consistency (#3861)
Bundled .NET 10 SDK updated to 10.0.300 (#4287)

Fixed

NullReferenceException in SqlCommand.Cancel() when the connection has already been torn down (#4372)
Always Encrypted CMK signature verification incorrectly reusing cached results after a prior failure (#4339)
Missing TDS token / feature-ack length bounds checks (spoofing server could trigger unbounded allocations) (#4340)
SqlBulkCopy failing in least-privilege environments (#4306)
Always Encrypted CekMdVersion / EkValueCount reads aligned with the TDS specification (#4240)
LoginWithFailover parser-state validation (#4140)
SPN during login now uses the resolved port instead of instance name for Protocol=None / Protocol=Admin (#4180)
Race in SqlConnection.TryOpenInner that could surface as InvalidCastException now returns a deterministic InvalidOperationException (#4179)
Multiple CancellationTokenSource leaks in SqlDataReader, SqlConnection, SqlCommand reconnect paths, and sequential-stream helpers (#4009)
Docs fix for server certificate configuration (#4408)

Removed (breaking)

SQL Server 7.0 / 2000 code paths removed; Type System Version=SQL Server 2000 now throws ArgumentException at open. Applications should switch to Latest (or another supported value). No change to server-version support — 7.0 / 2000 were already rejected during login version negotiation. (#4015)

Full details: release-notes/7.1/7.1.0-preview2.md

`Microsoft.Data.SqlClient.Extensions.Azure` 7.1.0-preview2

Added — WAM (Windows Account Manager) broker support for Entra ID authentication (Windows only) (#4288, #4388)

Covers ActiveDirectoryIntegrated, ActiveDirectoryInteractive, ActiveDirectoryDeviceCodeFlow, and the deprecated ActiveDirectoryPassword modes.
... (truncated)

7.1.0-preview1

This update brings the following changes since the 7.0.0 release:

Added

`SqlBatch` Support on .NET Framework

What Changed:

Added SqlBatch and related batch-command support for the .NET Framework target so the batching API is now available across the full supported platform matrix, including net462. (#3926)

Who Benefits:

Applications that target .NET Framework but also want to use the newer batching APIs no longer need a separate implementation strategy from .NET 8/9 applications.
Libraries that multi-target .NET Framework and modern .NET can use a more consistent data-access surface area.

Impact:

SqlBatch, SqlBatchCommand, and the related execution methods are now usable on .NET Framework builds in addition to .NET.

Cross-Driver Connection-String Synonym Alignment

What Changed:

Added additional accepted connection-string synonyms for better compatibility with other SQL Server drivers and existing connection-string conventions. Newly accepted synonyms include ColumnEncryption, ConnectTimeout, FailoverPartner, PacketSize, and WorkstationId. (#4192)

Who Benefits:

Applications migrating connection strings from other SQL Server drivers or shared infrastructure can reuse more existing keywords without rewriting them first.

Impact:

Existing canonical keywords continue to work unchanged; this preview simply accepts more equivalent aliases during parsing.

Changed

Type Forwards for Authentication Abstractions

What Changed:

Added type forwards from the core Microsoft.Data.SqlClient assembly to public authentication-related types that were moved into Microsoft.Data.SqlClient.Extensions.Abstractions, including SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. (#4067, #4117)

Who Benefits:

Applications and libraries compiled against earlier package layouts retain binary compatibility when those authentication types are resolved from the core assembly name.

Impact:

No application code changes are required; the type forwards preserve existing compiled references.

User Agent Feature Extension Enabled by Default

... (truncated)

7.0.4

This servicing release includes security updates, certificate and enclave-session validation fixes, and improvements to result reading and managed networking.

Use matching 7.0.4 versions of the driver and companion packages. Assemblies retain AssemblyVersion 7.0.0.0; no new .NET Framework binding redirects are required when upgrading from 7.0.3. Microsoft.SqlServer.Server is unchanged and versioned independently.

Changes Since 7.0.3

Changed

Updated dependencies to address CVE-2026-84008: System.Security.Cryptography.Pkcs 8.0.2 for net462/net8.0/netstandard2.0 and affected .NET 9 dependencies to 9.0.21.
Updated native SNI dependencies to 6.0.4.
Updated user-agent telemetry to v2 and added compatibility-switch reporting. Async behavior and switch defaults are unchanged.

Fixed

Enforced an explicit HostNameInCertificate during managed SNI certificate validation, even when the certificate matches the server name (net8.0/net9.0). (#4908)
Isolated Always Encrypted enclave-session cache entries by attestation protocol. (#4867)
Fixed unobserved receive exceptions and packet cleanup when closing managed SNI connections with MARS reads pending (net8.0/net9.0). (#4950)
Fixed SqlDataReader.HasRows returning false when informational messages precede the first row. (#4899)
Fixed statistics timer races throwing "Nullable object must have a value." Connection and MARS use remain non-thread-safe. (#4897)
Fixed sequential GetTextReader reads corrupting nvarchar text on big-endian platforms. (#4962)
Rejected malformed PRELOGIN responses with a corrupted-stream error instead of IndexOutOfRangeException. (#4978)
Rejected row, alternate-result, and authentication responses missing required metadata or state, and prevented affected connections from returning to the pool. (#4982)

Companion Packages

All packages below ship as 7.0.4.

Package	Highlights
Extensions.Azure	Added actionable guidance for Windows WAM `window_handle_required` errors, preserving the original error code and inner exception.
AlwaysEncrypted.AzureKeyVaultProvider	Version alignment only; no functional or API changes.
Extensions.Abstractions	Version alignment only; no functional or API changes.
Internal.Logging	Version alignment only; internal use, not for direct application references.

For Windows WAM errors, provide a parent window through SetParentActivityOrWindowFunc, or use Authentication=Active Directory Default with a configured non-interactive credential in windowless hosts. Interactive authentication without WAM requires a custom ApplicationClientId and UseWamBroker=false. WAM remains enforced for SqlClient's first-party application ID; no automatic fallback was added.

Platform Support

.NET Framework 4.6.2+ on Windows and .NET 8.0+ on Windows, Linux, and macOS. Companion package targets and dependency lists are included in the linked package notes.

Thanks to LaurensVergote for contributing.

Full release notes and dependency versions

7.0.3

This update brings the following changes since the 7.0.2 release:

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
(#4599)

Fixed

Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
(#4370, #4306, #4402)
Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
(#4528, #4533)
Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
(#4445, #4583)
Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
(#4532, #4553)
Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
(#4520, #4561)
Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
(#4520, #4561, #4644)
Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
(#2214, #4547, #4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

edwardneal

Target Platform Support

.NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
.NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite.Core from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.Data.Sqlite.Core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Client from 4.88.0 to 4.91.0.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.91.0

New Features

Made the dynamic certificate provider and confidential-client callbacks (OnMsalServiceFailure, OnCompletion, and OnBackgroundTokenRefreshCompleted) generally available, removing the experimental feature opt-in requirement. #6216

Bug Fixes

Fixed built-in mTLS HttpClient caching to use certificate object identity, ensuring a new certificate instance with a reacquired private-key handle receives a new handler even when its thumbprint is unchanged. #6217
Fixed managed identity WithForceRefresh(true) to re-mint the MSI v2 binding certificate before acquiring a new token, while reusing a valid cached attestation token for the current key. #6215
Fixed system-browser authentication callbacks in Linux containers by adding opt-in IPv4 port-forwarding support through MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING, disabled by default. #6186

4.90.1

New Features

Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #6165

Bug Fixes

Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #6165
Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #6155
Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #6200

Changes

Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #6202

4.90.0

Changes

Updated the KeyGuardAttestation package version to 1.1.7. #6189

4.89.0 What's Changed

Add repository guidance for AI agents by @bgavrilMS in Add repository guidance for AI agents AzureAD/microsoft-authentication-library-for-dotnet#6158
Add Linux Attested Managed Identity Flow documentation by @gladjohn in Add Linux Attested Managed Identity Flow documentation AzureAD/microsoft-authentication-library-for-dotnet#6149
Remove internal authority example from API docs by @bgavrilMS in Remove internal authority example from API docs AzureAD/microsoft-authentication-library-for-dotnet#6170
Update SNI MTLS PoP Token Design documentation by @bgavrilMS in Update SNI MTLS PoP Token Design documentation AzureAD/microsoft-authentication-library-for-dotnet#6171
Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate by @gladjohn in Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate AzureAD/microsoft-authentication-library-for-dotnet#6167
Revise mTLS PoP acceptance-test matrix structure by @gladjohn in Revise mTLS PoP acceptance-test matrix structure AzureAD/microsoft-authentication-library-for-dotnet#6161
Add ICloudConfiguration for cross-cloud metadata resolution by @Avery-Dunn in Add ICloudConfiguration for cross-cloud metadata resolution AzureAD/microsoft-authentication-library-for-dotnet#6104
Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by @Robbie-Microsoft in Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry AzureAD/microsoft-authentication-library-for-dotnet#6173
Always record RawStsErrorCode on MsalFailure metric by @ssmelov in Always record RawStsErrorCode on MsalFailure metric AzureAD/microsoft-authentication-library-for-dotnet#6175
Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by @Robbie-Microsoft in Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity AzureAD/microsoft-authentication-library-for-dotnet#6178
Add timeout for managed identity capability discovery by @Robbie-Microsoft in Add timeout for managed identity capability discovery AzureAD/microsoft-authentication-library-for-dotnet#6181
Pin GitHub Actions to full-length commit SHAs by @danfiedler-msft in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

New Contributors

@danfiedler-msft made their first contribution in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.89.0

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.29.0 to 1.31.0.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.31.0

ONNX Runtime 1.31.0 stabilizes model-package and EPContext data APIs, improves CPU model loading and quantized MoE inference, expands device-based execution-provider selection, and strengthens model-loading and runtime reliability. These notes cover changes since ONNX Runtime 1.30.0. CUDA and WebGPU kernel updates are summarized here; detailed provider notes are covered by their separate plugin EP releases.

Highlights

Promoted the model-package API and EPContext data callbacks to stable C and C++ APIs, with EPContext callback support added across language bindings (#33166, #32265).
Reduced CPU session-initialization overhead by parallelizing eligible weight prepacking, and accelerated block-wise INT4/INT8 QMoE experts with MLAS QNBit kernels and grouped expert dispatch (#31691, #32644, #32668).
Added x86 FP16 LayerNorm/RMSNorm acceleration, Arm KleidiAI SVE2.1 FP16 GEMM support, and additional RISC-V vector kernels (#32715, #32670, #32710).
Enabled CoreML participation in device-based EP selection, including Apple Neural Engine selection through PREFER_NPU (#31975).
Added workspace-memory accounting and verification for constrained-memory graph partitioning, alongside broader model, graph, and tensor validation (#31962, #32189).

Announcements & Compatibility

CUDA Plugin EP v0.3.0 and WebGPU Plugin EP v0.5.0 are matched with ONNX Runtime 1.31.0. For contrib-op compatibility, core and the plugin must use the same contributed-operator schemas; building both from the same ONNX Runtime revision is recommended. Schema mismatches can cause incorrect execution or crashes and may not be detected during plugin registration.
GatherBlockQuantized behavior change: out-of-range indices now produce zero output slices across CPU, CUDA, and WebGPU for both integer and floating-point quantized formats. This deliberately differs from ONNX Gather error semantics (#32480).
Experimental API migration: model-package consumers should use OrtApi::GetModelPackageApi and the stable OrtModelPackageApi table. EPContext callback registration now uses stable APIs; the corresponding experimental lookup entries were removed. The stable native callback contract carries callback/state pointers, with payload limits enforced by application callbacks, bindings, or EPs rather than a native read-options policy (#33166, #32265).
ACL EP is deprecated and will be removed in a future release. Source builds using --use_acl now receive a deprecation warning (#32564).
The ONNX dependency remains at 1.22.0. The initial ONNX 1.23 integration was reverted pending upstream fixes; this release does not ship that integration's new opset or FLOAT6 support (#33073).
Supported native builds now default to 1DS telemetry. Windows TraceLogging remains selectable with --use_windows_telemetry or onnxruntime_USE_WINDOWS_TELEMETRY=ON; telemetry can be disabled with --no_telemetry (#32384).

New Features

Core APIs & Runtime

Stabilized the model-package C and C++ APIs for loading packages, selecting compatible model variants, and creating sessions (#33166).
Stabilized named EPContext data read/write callbacks for application-managed storage. Added EP support negotiation so registered callbacks do not silently fall back to filesystem I/O (#32265).
Extended the Compile API to write external initializers and EP context data to buffers, enabling in-memory compilation workflows for models larger than 2 GB (#31347).
Added workspace-memory accounting, source reporting, and post-partition reservation verification. Set session.strict_workspace_verification=1 to fail initialization on workspace declaration overruns or nonzero orphaned reservations; strict verification is not supported for ORT-format model loads (#31962, #32189).
Added the opt-in source-build option onnxruntime_DISABLE_DEVICE_DISCOVERY=ON to skip platform accelerator probing and report only the CPU device (#32592).

Shared Contrib Operators

These updates affect core operator schemas and cross-provider behavior, not only the separately released GPU plugins.

Extended EngramGate and NGramHashMapping for Qwen4-Exp, and added VarlenNGramHashMapping for packed DeepSeek Engram batching with request-local history. Packed hashing also supports Qwen4-Exp head offsets, EOS resets, and segment boundaries (#32285, #32358, #32467).
Added the activation attribute to GatedRMSNorm for SiLU, its Swish alias, and Sigmoid gating across CPU, CUDA, and WebGPU. SiLU remains the default (#32512).
Added weightless hyper-connection operators BranchwiseRMSNorm, ScaledSiLU, HyperConnectionPreMix, and HyperConnectionPostMix, with CPU, CUDA, and WebGPU implementations (#32687).
Extended GatherBlockQuantized to FP8/FP4 data, full-axis blocks, and scale broadcasting, and improved CPU UINT8 dequantization. See the out-of-range-index behavior change above (#32480, #32621).

Plugin Execution Provider Infrastructure

Added support for statically linked plugin EPs, with a static WebGPU plugin build configuration (#32395).
Preserved caller streams in single-tensor plugin data transfers and handled null plugin allocator returns (#32666, #32683).
Deduplicated AutoEP custom-op domains and corrected EP assignment reporting after NHWC layout transformation (#32711, #33184).
Added reference guidance for compiled-model compatibility validation, including multi-device scenarios (#29168).

Execution Provider Updates

CUDA EP

CUDA updates include sparse attention and packed continuous batching, expanded paged speculative decoding, INT2 and mixed-width QMoE execution, opt-in MatMul auto-tuning, improved MXFP4 support on Blackwell consumer GPUs, and reliability fixes.
... (truncated)

1.30.1

This is a patch release on top of v1.30.0, containing targeted model-validation and memory-safety fixes, improved Plugin EP data transfers, and build and packaging fixes.

Highlights

Bug Fixes

Hardened contrib-op shape inference with additional rank, attribute, initializer, and overflow validation for CausalConvWithState, GatedDeltaNet, GroupQueryAttention, and SparseAttention (#32607).
Prevented out-of-bounds reads in EmbedLayerNormalization shape inference with scalar beta, ConvTransposeWithDynamicPads, and shape-inference input-data lookup (#32610, #32679, #32681).
Rejected malformed graphs containing inputs to zero-input operator schemas or subgraphs on non-control-flow nodes (#32633, #32641).
Prevented an out-of-bounds read during session initialization when a Loop or Scan body input is also an initializer, rejecting the invalid graph instead of crashing (#32609).
Fixed a heap buffer overflow caused by reusing packed sub-byte tensor storage for a larger full-byte tensor (#32611).
Preserved the caller's execution stream in Plugin EP single-tensor data transfers, allowing asynchronous copies to receive the supplied stream while retaining synchronous-copy behavior (#32666).

Build and Packaging

Fixed Windows build-tools setup to use system-trusted certificates and improved proxy handling (#33142).
Selected Python 3.12 explicitly before package validation in the combined packaging stage (#33561).
Restricted FP8 XQA test cases to supported GPU compute capabilities (#32559).

Contributors

Thanks to our 8 contributors for this release!

@adrastogi, @bbernhar, @eserscor, @miaobin, @shiyi9801, @tianleiwu, @wangw-1991, @xiaofeihan1

Full Changelog: v1.30.0...v1.30.1

These release notes were drafted with AI assistance.

1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, [#32349](https://github.com/microsoft/onnxruntime/pull/...

Description has been truncated

Bumps coverlet.collector from 10.0.1 to 10.1.0 Bumps Dapper from 2.1.79 to 2.1.89 Bumps FluentAssertions from 8.10.0 to 8.11.0 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.11 to 10.0.13 Bumps Microsoft.Data.SqlClient from 7.0.2 to 7.1.1 Bumps Microsoft.Data.Sqlite.Core from 10.0.11 to 10.0.13 Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.13 Bumps Microsoft.Identity.Client from 4.88.0 to 4.91.0 Bumps Microsoft.ML.OnnxRuntime from 1.29.0 to 1.31.0 Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.11.0 Bumps Moq from 4.20.72 to 4.21.0 Bumps OpenIddict.AspNetCore from 7.6.1 to 7.7.2 Bumps OpenIddict.Quartz from 7.6.1 to 7.7.2 Bumps System.DirectoryServices.Protocols from 10.0.11 to 10.0.13 Bumps System.Numerics.Tensors from 10.0.11 to 10.0.13 Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1 --- updated-dependencies: - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Dapper dependency-version: 2.1.89 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: Microsoft.Data.SqlClient dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Microsoft.Data.Sqlite.Core dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: Microsoft.Identity.Client dependency-version: 4.91.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Microsoft.ML.OnnxRuntime dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: Moq dependency-version: 4.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: OpenIddict.AspNetCore dependency-version: 7.7.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: OpenIddict.Quartz dependency-version: 7.7.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-dependencies - dependency-name: System.DirectoryServices.Protocols dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: System.Numerics.Tensors dependency-version: 10.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 13, 2026

Navigation Menu

Repository navigation

chore(deps-nuget): Bump the nuget-dependencies group with 16 updates - #290

chore(deps-nuget): Bump the nuget-dependencies group with 16 updates#290
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-dependencies-dd05a2741b

dependabot Bot commented on behalf of github Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 13, 2026

10.1.0

Improvements

Fixed

2.1.89

What's Changed

New Contributors

2.1.86

What's Changed

8.11.0

What's Changed

New features

Improvements

Fixes

Documentation

Others

New Contributors

7.1.1

Companion package release notes

Changes Since 7.1.0

Fixed

Target Platform Support

Dependencies

.NET 9.0

7.1.0

Companion package release notes

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

7.1.0-preview3

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview3

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3

7.1.0-preview2

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview2

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview2

7.1.0-preview1

Added

SqlBatch Support on .NET Framework

Cross-Driver Connection-String Synonym Alignment

Changed

Type Forwards for Authentication Abstractions

User Agent Feature Extension Enabled by Default

7.0.4

Changes Since 7.0.3

Changed

Fixed

Companion Packages

Platform Support

7.0.3

Companion package release notes

Changed

Fixed

Contributors

Target Platform Support

4.91.0

New Features

Bug Fixes

4.90.1

New Features

Bug Fixes

Changes

4.90.0

Changes

4.89.0

What's Changed

New Contributors

1.31.0

Highlights

Announcements & Compatibility

New Features

Core APIs & Runtime

Shared Contrib Operators

Plugin Execution Provider Infrastructure

Execution Provider Updates

CUDA EP

1.30.1

Highlights

`Microsoft.Data.SqlClient` 7.1.0-preview3

`Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` 7.1.0-preview3

`Microsoft.Data.SqlClient` 7.1.0-preview2

`Microsoft.Data.SqlClient.Extensions.Azure` 7.1.0-preview2

`SqlBatch` Support on .NET Framework