Bump the nuget-minor-and-patch group with 14 updates by dependabot[bot] · Pull Request #21 · P4Software/Rotula

dependabot · 2026-11-10T13:51:11Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Updated CommunityToolkit.Mvvm from 8.4.0 to 8.4.2.

Release notes

Sourced from CommunityToolkit.Mvvm's releases.

8.4.2 What's Changed

Fix incorrect version check order in MVVMToolkitRemoveDuplicateAnalyzers target by @Sergio0694 in Fix incorrect version check order in MVVMToolkitRemoveDuplicateAnalyzers target CommunityToolkit/dotnet#1174

Full Changelog: CommunityToolkit/dotnet@v8.4.1...v8.4.2

8.4.1

This release of the .NET Community Toolkit updates the MVVM Toolkit analyzers and source generator to Roslyn 5.0, so they can work with C# 14 out of the box. This means that [ObservableProperty] on partial properties no longer needs preview language version 🎉

What's Changed 🆕

Migrate workflow to GitHub Actions by @Sergio0694 in Migrate workflow to GitHub Actions CommunityToolkit/dotnet#1105
Remove extra dash in --no-build argument in dotnet test invokation by @echoix in Remove extra dash in --no-build argument in dotnet test invokation CommunityToolkit/dotnet#1132
Bump unit tests from .NET 7 to .NET 9 by @Sergio0694 in Bump unit tests from .NET 7 to .NET 9 CommunityToolkit/dotnet#1085
Migrate solution to '.slnx' format by @Sergio0694 in Migrate solution to '.slnx' format CommunityToolkit/dotnet#1133
Remove .NET 7 TFM by @Sergio0694 in Remove .NET 7 TFM CommunityToolkit/dotnet#1134
fix object.Equals for EquatableArray by @JamesYFC in fix object.Equals for EquatableArray CommunityToolkit/dotnet#1120
Handle 'CanExecute' with method overrides by @Sergio0694 in Handle 'CanExecute' with method overrides CommunityToolkit/dotnet#1081
Migrate to new MSTest APIs to prepare for 4.0.x by @Sergio0694 in Migrate to new MSTest APIs to prepare for 4.0.x CommunityToolkit/dotnet#1136
Update MSTest to latest by @Sergio0694 in Update MSTest to latest CommunityToolkit/dotnet#1137
Update NuGet packages and Windows SDK props by @Sergio0694 in Update NuGet packages and Windows SDK props CommunityToolkit/dotnet#1047
Update to .NET 10 SDK, add .NET 10 TFM to test projects by @Sergio0694 in Update to .NET 10 SDK, add .NET 10 TFM to test projects CommunityToolkit/dotnet#1144
Fix C# language version checks for [ObservableProperty] by @Sergio0694 in Fix C# language version checks for [ObservableProperty] CommunityToolkit/dotnet#1140
Eliminate this = default shortcut when height * width = 0 by @marcin-krystianc in Eliminate this = default shortcut when height * width = 0 CommunityToolkit/dotnet#1130
Support nested blocks in semi-auto property analyzer, add tests by @Youssef1313 in Support nested blocks in semi-auto property analyzer, add tests CommunityToolkit/dotnet#1025
Update .NET SDK and NuGet dependencies by @Sergio0694 in Update .NET SDK and NuGet dependencies CommunityToolkit/dotnet#1155
Update Roslyn 5.0 analyzer and code fixer paths by @Sergio0694 in Update Roslyn 5.0 analyzer and code fixer paths CommunityToolkit/dotnet#1156
Update analyzers for C# 14.0 language version checks by @Sergio0694 in Update analyzers for C# 14.0 language version checks CommunityToolkit/dotnet#1159
Fix deterministic builds, improve GitHub links by @Sergio0694 in Fix deterministic builds, improve GitHub links CommunityToolkit/dotnet#1170
Add MVVM Toolkit code fixer for Roslyn 5.0 by @Sergio0694 in Add MVVM Toolkit code fixer for Roslyn 5.0 CommunityToolkit/dotnet#1171

New Contributors

@echoix made their first contribution in Remove extra dash in --no-build argument in dotnet test invokation CommunityToolkit/dotnet#1132
@JamesYFC made their first contribution in fix object.Equals for EquatableArray CommunityToolkit/dotnet#1120
@marcin-krystianc made their first contribution in Eliminate this = default shortcut when height * width = 0 CommunityToolkit/dotnet#1130

Full Changelog: CommunityToolkit/dotnet@v8.4.0...v8.4.1

Commits viewable in compare view.

Updated DuckDB.NET.Data.Full from 1.5.6 to 1.5.6.1.

Release notes

Sourced from DuckDB.NET.Data.Full's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.15.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.10 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting.WindowsServices from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting.WindowsServices's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated ModelContextProtocol from 2.2.0 to 2.4.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.4.0

Version 2.4.0 adds experimental MCP Skills support through the new ModelContextProtocol.Extensions.Skills package, alongside OAuth hardening and reliability improvements for transport, session, and discovery flows. MCP Apps also now match protocol property names case-sensitively.

What's Changed

Add the experimental MCP Skills extension #1856 by @girishkvs (co-authored by @PederHP)
Align Skills with server primitives and typed request handlers #1993 by @halter73 (co-authored by @Copilot)
Require explicit opt-in for the legacy OAuth metadata fallback #1952 by @halter73 (co-authored by @Copilot)
Preserve refresh tokens when OAuth refresh responses omit replacements #1968 by @halter73 (co-authored by @Copilot)
Preserve canonical OAuth resource identifiers during refresh #1967 by @halter73 (co-authored by @Copilot)
Fix cancellation being reported as missing OAuth metadata #1891 by @Empiree
Cancel open subscriptions/listen requests when the transport stops delivering messages #1933 by @pournasserian (co-authored by @Copilot)
Fix dropped notifications and cancellation when a request is canceled #1917 by @zerotohero3
Prevent server/discover probes from committing the negotiated protocol version #1956 by @PrathmeshPawar2110 (co-authored by @claude)
Fall back to SSE when AutoDetect receives a 405 with a JSON-RPC error body #1849 by @ump45nose
Fix legacy output schemas for delegating server tools #1928 by @Oxygen56
Match protocol property names case-sensitively #1934 by @FenjuFu

Documentation Updates

Clarify Skills discovery and documentation #2000 by @halter73 (co-authored by @Copilot)
Fix Markdown link-check warnings and update the Skills specification link #1975 by @jeffhandley (co-authored by @Copilot)

Test Improvements

Prevent discovery probe timeouts in controlled test connections #1946 by @tarekgh
Apply test discovery timeouts to Sampling_Stdio #1950 by @girishkvs
Use a task that runs until cancelled in the task store cancellation test #1955 by @girishkvs
Fix parallel integration test server startup #1982 by @jeffhandley (co-authored by @Copilot)

Repository Infrastructure Updates

Bump fast-uri from 3.1.5 to 3.1.7 #1850
Bump actions/deploy-pages from 5.0.0 to 5.0.1 #1858
Support release-line docs publishing and release coordination #1972 by @jeffhandley (co-authored by @Copilot)
Bump docfx from 2.78.5 to 2.81.0 #1961
Bump actions/setup-node from 7.0.0 to 7.1.0 #1927
Bump becheran/mlc from 1.2.0 to 1.3.0 #1907
Bump the other-testing group with 2 updates #1960
Bump actions/download-artifact from 8.0.1 to 8.0.2 #1926
Bump Anthropic from 12.40.0 to 13.3.0 #1962
Bump the opentelemetry-testing group with 6 updates #1959
Bump actions/upload-artifact from 7.0.1 to 7.0.2 #1925
Fix CI selection of patched .NET SDKs #1995 by @tarekgh

Acknowledgements

@Empiree made their first contribution in #1891
@zerotohero3 made their first contribution in #1917
@girishkvs made their first contribution in #1856
@FenjuFu made their first contribution in #1934
... (truncated)

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

Harden authenticated stateful MCP sessions (commit bfbd893) by @halter73 (co-authored by @Copilot @jeffhandley @tarekgh)

Repository Infrastructure Updates

Align docs publishing with shared orchestration #1981 by @jeffhandley (co-authored by @Copilot)
Fix Markdown link-check warnings and outdated Skills specification link #1979 by @jeffhandley (co-authored by @Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

McpClient.ServerInfo is nullable — #1903
- Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
- On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
- Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
- This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

Correct protocol-version telemetry for stateless server spans #1810 by @luisangelrod
Preserve HTTP errors and correct discovery fallback handling #1791 by @PranavSenthilnathan (co-authored by @Copilot)
Make modern Streamable HTTP status mapping deterministic #1837 by @jstar0
- Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #1852 by @halter73 (co-authored by @Copilot)
Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #1855 by @scottt732
Close server stdin before waiting for graceful stdio process exit #1838 by @luisangelrod
Preserve insertion order when listing server tools, prompts, and resources #1924 by @PederHP (co-authored by Claude Opus 5.5)
Allow missing optional server identity in discovery and make ServerInfo nullable #1903 by @Coding-Professional
Include JSON parse details in Streamable HTTP 400 responses #1844 by @ump45nose
Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)
- OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
- Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
Preserve numeric progress tokens in RequestOptions serialization #1832 by @dfedoryshchev
Dispose legacy SSE POST responses to release connections deterministically #1841 by @yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

Document standing support for new MCP specification revisions #1826 by @halter73 (co-authored by @Copilot)

Test Improvements

Stabilize discovery-capable test connections while retaining initialization deadlines #1943 by @tarekgh

Repository Infrastructure Updates

Add a source selector for manual documentation publishes #1828 by @jeffhandley (co-authored by @Copilot)
Update SourceLink's private build dependency to resolve a vulnerable Git dependency #1873 by @halter73 (co-authored by @Copilot)
Correct obsolete McpServerFactory references in Copilot instructions #1892 by @Zir0-93
Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #1940

Acknowledgements

@scottt732 made their first contribution in #1855
@Zir0-93 made their first contribution in #1892
@Coding-Professional made their first contribution in #1903
... (truncated)

Commits viewable in compare view.

Updated Oracle.ManagedDataAccess.Core from 23.26.301 to 23.26.400.

Updated SkiaSharp from 4.153.1 to 4.155.0.

Updated SQLitePCLRaw.lib.e_sqlite3 from 2.1.12 to 2.1.14.

Release notes

Sourced from SQLitePCLRaw.lib.e_sqlite3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Security.Cryptography.ProtectedData from 10.0.12 to 10.0.14.

Release notes

Sourced from System.Security.Cryptography.ProtectedData's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.4 to 3.1.5.

Release notes

Sourced from xunit.runner.visualstudio's releases.

3.1.5

Release notes: https://xunit.net/releases/visualstudio/3.1.5

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps CommunityToolkit.Mvvm from 8.4.0 to 8.4.2 Bumps DuckDB.NET.Data.Full from 1.5.6 to 1.5.6.1 Bumps Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.15 Bumps Microsoft.AspNetCore.TestHost from 10.0.13 to 10.0.14 Bumps Microsoft.Data.Sqlite from 10.0.12 to 10.0.14 Bumps Microsoft.Extensions.Hosting from 10.0.10 to 10.0.14 Bumps Microsoft.Extensions.Hosting.WindowsServices from 10.0.13 to 10.0.14 Bumps ModelContextProtocol from 2.2.0 to 2.4.0 Bumps Oracle.ManagedDataAccess.Core from 23.26.301 to 23.26.400 Bumps SkiaSharp from 4.153.1 to 4.155.0 Bumps SQLitePCLRaw.lib.e_sqlite3 from 2.1.12 to 2.1.14 Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14 Bumps System.Security.Cryptography.ProtectedData from 10.0.12 to 10.0.14 Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5 --- updated-dependencies: - dependency-name: CommunityToolkit.Mvvm dependency-version: 8.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: DuckDB.NET.Data.Full dependency-version: 1.5.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.AspNetCore.TestHost dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.Data.Sqlite dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.Extensions.Hosting dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: Microsoft.Extensions.Hosting.WindowsServices dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: Oracle.ManagedDataAccess.Core dependency-version: 23.26.400 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: SkiaSharp dependency-version: 4.155.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: SkiaSharp dependency-version: 4.155.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-and-patch - dependency-name: SQLitePCLRaw.lib.e_sqlite3 dependency-version: 2.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: System.Security.Cryptography.Pkcs dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: System.Security.Cryptography.ProtectedData dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 10, 2026

Navigation Menu

Repository navigation

Bump the nuget-minor-and-patch group with 14 updates - #21

Bump the nuget-minor-and-patch group with 14 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/Rotula.App/nuget-minor-and-patch-8c20def865

dependabot Bot commented on behalf of github Nov 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.4.2

What's Changed

8.4.1

What's Changed 🆕

New Contributors

2.4.0

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

2.3.1

What's Changed

Repository Infrastructure Updates

2.3.0

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

3.1.5

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 10, 2026 •

edited

Loading