Bump the nuget-minor-patch group with 35 updates by dependabot[bot] · Pull Request #806 · Sev7eNup/NodePilot

dependabot · 2026-11-05T21:47:11Z

Updated JsonSchema.Net from 9.4.1 to 9.6.0.

Release notes

Sourced from JsonSchema.Net's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Agents.AI from 1.25.0 to 1.27.0.

Release notes

Sourced from Microsoft.Agents.AI's releases.

1.27.0 [1.27.0] - 2026-10-30

Added

skills: Add a .NET consumer skill for building with Agent Framework (#9651 by @westey-m).
.NET, CI: Add a script to bump the .NET release version (#9894 by @baywet).

Changed

.NET, AgentServer: [BREAKING] Update AgentServer dependencies (#9721 by @rogerbarreto).

Migration: In Foundry hosted applications, replace builder.Services.AddFoundryResponses(...) with builder.AddFoundryResponses(...) so response and task storage use the same configuration-bound identity and endpoint. The IServiceCollection overload remains supported for local or non-hosted use.

If you pin SDK dependencies directly, align Azure.AI.Projects and Azure.AI.Extensions.OpenAI to 3.0.0-beta.5, and Azure.AI.AgentServer.Core, Azure.AI.AgentServer.Invocations, and Azure.AI.AgentServer.Responses to 1.0.0-beta.30, 1.0.0-beta.7, and 1.0.0-beta.9, respectively. Align Azure.Core to 1.63.0, System.ClientModel to 1.16.0, and Microsoft.Identity.Client.Extensions.Msal to 4.90.0.

For code using the affected SDK APIs directly, replace string storage ETags with Azure.ETag (ETag ifMatch = default in state-store overrides), stream.InternalMetadata with stream.PersistedMetadata, stream.Checkpoint() with stream.CreateCheckpointEvent(), and SessionFileWriteResponse with SessionFileWriteResult. Where AgentReference becomes ambiguous, qualify or alias Azure.AI.Extensions.OpenAI.AgentReference, not the newly added Azure.AI.Projects.Agents.AgentReference.

Storage compatibility: Responses beta.9 moves local durable response state to responses/partitions-v1; existing pre-upgrade local response files are not read after upgrading. The PR does not provide a migration procedure for those files.
.NET: [BREAKING] Reject redirect client changes (#9711 by @baywet).

Migration: Update DefaultHttpRequestHandler client-provider callbacks to return null for allowed redirect destinations, retaining the internally owned client, or throw to reject a destination. Returning a client for a redirect now causes HttpRequestException before the redirected request is sent. Supplying a client for the initial request remains supported, and no public API signatures change.
.NET, LocalCodeAct: Harden provenance and process capability checks (#9804 by @eavanvalkenburg).
.NET, dependencies: Update the Aspire dependency group and align the Content Understanding dependency floor (#9822 by @dependabot[bot], #9695).
.NET: Bump the release version to 1.27.0 (#9893 by @baywet).
docs, samples: Clarify optional usage counter handling, pin the RAG Step02 documentation pages to a commit, and point Foundry-migrated sample READMEs at FOUNDRY_* settings (#9783, #9648 by @Laurianti, #9600 by @1aifanatic).
development: Update developer setup and CODEOWNERS maintainer assignments (#9733, #9734 by @dargilco).

Fixed

.NET, workflows: Handle parse-value and workflow value conversion failures consistently, validate question skip inputs consistently, persist workflow scope aliases, preserve pending Magentic plan review, and release the workflow when a run ends after an executor fails to initialize (#9845 by @baywet, #9826 by @baywet, #9830 by @baywet, #9749 by @baywet, #9797 by @baywet, #9585 by @RachelWanggg).
.NET, Foundry: Correct citation text offsets across completed text parts (#9812 by @rogerbarreto).
.NET, Harness: Allow the local chat history marker when stored output is disabled (#8708 by @rogerbarreto).
.NET, Mem0: Validate scopes on restored session state (#9827 by @kartikmadan11).
.NET, Toolbox: Apply the configured tool approval policy (#9662 by @rogerbarreto).
docs: Fix dead ADK MCP tools and ADR-0002 Agent Tools links, and correct the documented Ollama embedding truncate default (#9823 by @leom1919, #9766 by @leom1919, #9672).

1.26.0 Changes:

9c8a3514a15a702f81bfda456d80c7ccaa4d2712 Update package versions for release (#9650)
c3b9f22d64fd86e8133395555a1fa4aa22f745e0 Add ACGS to the Python community projects (#9618)
71cf48cb4019bc503c7ceb61420cc3d836250790 Python: Honor allow_multiple_tool_calls in AnthropicClient when tool_choice is unset (#8980)
ea32b6db9e9b4b434a86496bacd9cc6dd0422a69 Python: compose Copilot session hooks correctly (#9649)
678c6616aa4c73ecfc28cc6fc119a3928ba04024 .NET: Fix AG-UI sample prerequisites and troubleshooting paths (#9620)
8730cb1974857e2264f874a258623db1303cc2ac .NET: Log a warning when an unsupported declarative action is skipped (#8056) [ #8040 ]
9581926deec6a0473a68797153e98d44da74d09a .NET: Correct endpoint override instructions in Responses samples (#9639)
9c53b5f44658cc7839d0f1aefe580152edaba970 Python: Refresh coding standards and Copilot review guidance (#9637)
3b725b3b0ffe09ff00d57b31cc179d20d12a1e49 Python: fix(core): define EdgeGroup's builtins.type alias at module scope (#9614)
a8e284ca8ce7c2a6b4a4641ef35e131d75a5cda3 Python: Add #9472 to 1.23.0 changelog (#9610)

See More

d33c44583992c4f638f50714bbbbfc4d1070356b Python: Bump package versions for 1.23.0 release (#9602)
07a83a7c369b7d51247630a60e48bebf85429943 Python: Recommend include_detailed_errors only when it is disabled (#9472)
ce214c0b3f69b6d735e90afbdadad8d0a6268067 fix(dotnet): preserve toolbox OAuth consent (#9565) [ #8379 ]
c3ce250695f71e56c9c3f9bff85fef78934520aa Python: Set the assistant role on streamed Gemini updates (#9491)
fb57ceb6bb0d75520297d93f6cebfbe6eede370e Add Tracekit to the Python community projects (#9497)
33439bf8bcf3e3a76d7094e8f4cbb584abfc8f42 Python: Pass stream errors to nested streams when closing them (#9476)
d0c3e6acfe4e3fb08887d13b4a1f9ddea0d6509c Python: Add installable Agent Framework builder skill (#9374)
1263843977f687f24f153d1f9597317e21d55966 Python: Sanitize unexpected streaming response failures (#9460)
074bc0b17e605e28b5235ed15ad52b977b65db88 test(dotnet): remove legacy persistent tests (#9588) [ #9587 ]
bba95967e36f8b45f1cb0fcfa67333134f29e7dd Python: Clarify MCP client ownership and add workflow sample (#9532)
8ff2ec937fe438c4330f9e0b0b5e01b32df079e3 Python: close the RedisContextProvider index connection when the provider owns it (#9510)
89457c5bcdd7c7b3423f4063f32c604d2fec0a74 docs: fix ChatResponse async aggregation example (#9518)
74f3447d030c83d747efab617d92573f86c01f52 Python: Make Content base64 documentation examples runnable (#9467)
b7f8ad686b07a5f6b13dd1f471ee1328b24c8a3a Python: Remove span-only tool attributes from invocation metrics (#9592)
5da17697d62d8c80c899c977e004ea6b8c09e56f docs: update A2A hosting example for SDK v1 (#9521)
8be57da33007b478ea8dd924bf8ccfa36a8444a6 Python: fix(bedrock): report the requested model on non-streaming responses (#9399)
06050253e90e235203d65e323cdb096145d37c26 docs: fix ChatKit streaming helper usage (#9523)
b7ce0d616fd027f850178e7a11255dc67070fe7a fix(workflows): support keyword-only RunContext in functional workflows (#9397)
1ba7425571fdc2c92ac18b6b537ad1c8a6d02b04 Python: Fix stateless shell tools inheriting host stdin (#9469)
a9eff53bdcca76b5b2d60b5ea3c7e9f973667e55 Python: Handle missing reasoning text in DevUI (#9543)
a479349b2a7a246981117efa0659345d5fb0aa14 Python: Correct Purview middleware setup in package guide (#9553)
597342c2c688c54620a4b00b76866d8e1ef943ea Python: Fix Copilot Studio constructor in package guide (#9551)
70ba23a3970cc8ab829eed2cc887a25137f3a1e5 fix: bind background completion waits to execution identity (#9442)
10f7f989fba24087864d1d9e00def83fafb0abd0 .NET: Add AgentSessionStore.DeleteSessionAsync to the Abstraction (#8801) [ #7991, #8586 ]
c7394476bffb5cf8b4ba84a2903f234d8f18a5ac Python: drop unsupported instructions from AF Copilot Studio migration samples (#9577)
621e8e39daffe9204ae0c29f0f9f285fd2cf7298 Python: pass judge model in evaluate_traces sample (#9576)
6ae0f4086d81b370c9347c4deae1c85fd71781d2 Python: Refresh dependencies and block compromised releases (#9590)
dbca9d8f1fcf0858b439bee3c6aee51b8991e98b Dotnet: DevUI improve local request checks (#9575)
20f07283ae47413cfc3d760209f62d5e08c2091a Python: fix Foundry Toolbox quickstart commands and setup steps (#9550)
4c191ff5099d9a9e2f7ad0812d901ee3a222e0bb Python: fix(devui): fallback to empty string when reasoning chunk has no text (#9546) [ #9533 ]
1fe5467d13eccac225aca7ae9aec21aed16469ee Python: Make MCP connection-loss recovery ownership-aware (#9583)
02005995380d5a09167e5c43b5d0f88328979145 Python: Improve settled approval matching (#9535)
6b48d20288fa43887d794479577fd8b57eee535e Tool name whitespace bugfix (#9557)
08851e69d722b0e0961c08eecf8575db995f0172 .NET: Add gRPC protocol selection to the A2A sample (#9563)
... (truncated)

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.Negotiate from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.Negotiate's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.OpenIdConnect from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.OpenIdConnect's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.SignalR.Client from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.SignalR.Client's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Sqlite from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Binder from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.Binder's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.CommandLine from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.EnvironmentVariables's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Json from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting.WindowsServices from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting.WindowsServices's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.12.2 to 2.13.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.13.0 2.13.0 (2026-10-19)

Features

document: add GetOperationById to search operations across path… (#3025) (#3074) (75d6cea)

Bug Fixes

components-key validation timeouts under load (#3108) (#3112) (5369417)
openapi: omit null response descriptions (1344a43)

Commits viewable in compare view.

Updated Microsoft.PowerShell.SDK from 7.6.7 to 7.6.9.

Release notes

Sourced from Microsoft.PowerShell.SDK's releases.

7.6.9

## 7.6.9

Build and Packaging Improvements

Update to .NET SDK 10.0.403

Merged PR 42305: [release/v7.6.9] Update branch for release

SHA256 Hashes of the release artifacts

hashes.sha256
- 638E954664D07A29190570FAF862B8A50B35F7E1C10DBD0F0E8A7E0F70138B45
powershell-7.6.9-1.azl4.aarch64.rpm
- FA959724AE0FB6D68731981DDDF5D35C3CD1F7308E9EAE8EC1F3D5159B4350A6
powershell-7.6.9-1.azl4.x86_64.rpm
- 04607223FDA408A26CDF641BFE38F651965C2769EB30CEB17AEC4D4F570EE4FE
powershell-7.6.9-1.cm.aarch64.rpm
- 80C6ED0A0BEA7D3EF827383C7DDB2F369DEA8F8A7FBBA7E32A510D114C980E1B
powershell-7.6.9-1.cm.x86_64.rpm
- A5F9545679C194F8EB9C55B24D06843A148CF27AFFF40CE0DF55751C6A1607CD
powershell-7.6.9-1.rh.x86_64.rpm
- 91C7F3D518389B1042B1465D70D365BCD040B67A3C0F79849658C695B777A6BE
powershell-7.6.9-linux-arm32.tar.gz
- 16C471C8ADCD5AFD9B533C77943AFC347716345B9859654D0EE7A1C4307A478F
powershell-7.6.9-linux-arm64.tar.gz
- 02EB9991AF447C7E7FE881ACDE195961AFD397C40B8EB1C2B3856B84EC2D85F2
powershell-7.6.9-linux-musl-x64.tar.gz
- F83DF6705EDAAE07DB970DCC6C34AD6583D33A2F6199F1B55CDC5354FBB9001C
powershell-7.6.9-linux-x64-fxdependent.tar.gz
- E62256F057E1D17B0626BEB781A3A0913F15B231E4BCC767AA1B00FCD0CC6AB0
powershell-7.6.9-linux-x64-musl-noopt-fxdependent.tar.gz
- 639A79DBDAAA0F17F05A6E89F67795CD00BB008376E98A3581F1B5D1F23B5B68
powershell-7.6.9-linux-x64.tar.gz
- 1DA6D6D6035D651F20E70DDEE7C4C15AC6AB8B9FB40EE92240D91263F28A884B
powershell-7.6.9-osx-arm64.pkg
- 9002562086AD18DCDC4A1156F6CD6467CFB5A91B28206E56491212193B68E5E6
powershell-7.6.9-osx-arm64.tar.gz
... (truncated)

7.6.8

## 7.6.8

General Cmdlet Updates and Fixes

Remove the Update Notification feature from PowerShell (#28242)

Build and Packaging Improvements

Update to .NET SDK 10.0.402

Merged PR 42142: [release/v7.6.8] Update branch for release

SHA256 Hashes of the release artifacts

hashes.sha256
- 8B1E273A18AB7B3AB0D3FB1DC9FDC8F9631FEC092EF48CA4CCFCAF32D6012B24
powershell-7.6.8-1.azl4.aarch64.rpm
- 20658D1269AFBABE57CBD806AF8D96EFF23106C0FDA5665F8AB608512388731C
powershell-7.6.8-1.azl4.x86_64.rpm
- 7AF32201D27E64C0D52EA68E9D6CF5647C50B7E43E08F83CA849ECEA99164737
powershell-7.6.8-1.cm.aarch64.rpm
- 2633A209AFE1511C16D0C6E8914C1AEA4B7F8448A76629392A641A5623F83449
powershell-7.6.8-1.cm.x86_64.rpm
- 43CF78FB105A9F8BCE35E89EEC41B7D92D1D84F7696A90DBBCB0F53B6DB2A5E2
powershell-7.6.8-1.rh.x86_64.rpm
- 0DBE9A3181BE07A9324CD48DB640B0D89B211D08CE9EAFB50FA96F611C308065
powershell-7.6.8-linux-arm32.tar.gz
- 544A57BFF2135E0EB9EE21230017F6FF755DD4E78206510113B2EDEE34A8CEF0
powershell-7.6.8-linux-arm64.tar.gz
- 3179E07FD98F026D39C730EBCB7626D071AAC3351B171DDA13F9F38D99EFCEF0
powershell-7.6.8-linux-musl-x64.tar.gz
- 6530AAE05371E40859315B62D465686560746FEB1F69EDA84A56E3326613BDA6
powershell-7.6.8-linux-x64-fxdependent.tar.gz
- 5DE179711F7D1845A379BA7AEB2E6DA39B0736A83B20655DA00C70A197BC7E3F
powershell-7.6.8-linux-x64-musl-noopt-fxdependent.tar.gz
- 6ACD97CB531E4D732AD55BCC258A10A59FF6478B30F7BC6335BA6AD3406186D4
powershell-7.6.8-linux-x64.tar.gz
... (truncated)

Commits viewable in compare view.

Updated ModelContextProtocol from 2.2.0 to 2.3.1.

Release notes

Sourced from ModelContextProtocol's releases.

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

Harden authenticated stateful MCP sessions (commit bfbd893) by @halter73 (co-authored by @Copilot @jeffhandley @tarekgh)

Repository Infrastructure Updates

Align docs publishing with shared orchestration #1981 by @jeffhandley (co-authored by @Copilot)
Fix Markdown link-check warnings and outdated Skills specification link #1979 by @jeffhandley (co-authored by @Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

McpClient.ServerInfo is nullable — #1903
- Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
- On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
- Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
- This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

Correct protocol-version telemetry for stateless server spans #1810 by @luisangelrod
Preserve HTTP errors and correct discovery fallback handling #1791 by @PranavSenthilnathan (co-authored by @Copilot)
Make modern Streamable HTTP status mapping deterministic #1837 by @jstar0
- Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #1852 by @halter73 (co-authored by @Copilot)
Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #1855 by @scottt732
Close server stdin before waiting for graceful stdio process exit #1838 by @luisangelrod
Preserve insertion order when listing server tools, prompts, and resources #1924 by @PederHP (co-authored by Claude Opus 5.5)
Allow missing optional server identity in discovery and make ServerInfo nullable #1903 by @Coding-Professional
Include JSON parse details in Streamable HTTP 400 responses #1844 by @ump45nose
Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)
- OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
- Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
Preserve numeric progress tokens in RequestOptions serialization #1832 by @dfedoryshchev
Dispose legacy SSE POST responses to release connections deterministically #1841 by @yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

Document standing support for new MCP specification revisions #1826 by @halter73 (co-authored by @Copilot)

Test Improvements

Stabilize discovery-capable test connections while retaining initialization deadlines #1943 by @tarekgh

Repository Infrastructure Updates

Add a source selector for manual documentation publishes #1828 by @jeffhandley (co-authored by @Copilot)
Update SourceLink's private build dependency to resolve a vulnerable Git dependency #1873 by @halter73 (co-authored by @Copilot)
Correct obsolete McpServerFactory references in Copilot instructions #1892 by @Zir0-93
Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #1940

Acknowledgements

@scottt732 made their first contribution in #1855
@Zir0-93 made their first contribution in #1892
@Coding-Professional made their first contribution in #1903
... (truncated)

Commits viewable in compare view.

Updated ModelContextProtocol.Core from 2.2.0 to 2.3.1.

Release notes

Sourced from ModelContextProtocol.Core's releases.

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

Harden authenticated stateful MCP sessions (commit bfbd893) by @halter73 (co-authored by @Copilot @jeffhandley @tarekgh)

Repository Infrastructure Updates

Align docs publishing with shared orchestration #1981 by @jeffhandley (co-authored by @Copilot)
Fix Markdown link-check warnings and outdated Skills specification link #1979 by @jeffhandley (co-authored by @Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

McpClient.ServerInfo is nullable — #1903
- Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
- On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
- Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
- This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

Correct protocol-version telemetry for stateless server spans #1810 by @luisangelrod
Preserve HTTP errors and correct discovery fallback handling #1791 by @PranavSenthilnathan (co-authored by @Copilot)
Make modern Streamable HTTP status mapping deterministic #1837 by @jstar0
- Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #1852 by @halter73 (co-authored by @Copilot)
Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #1855 by @scottt732
Close server stdin before waiting for graceful stdio process exit #1838 by @luisangelrod
Preserve insertion order when listing server tools, prompts, and resources #1924 by @PederHP (co-authored by Claude Opus 5.5)
Allow missing optional server identity in discovery and make ServerInfo nullable #1903 by @Coding-Professional
Include JSON parse details in Streamable HTTP 400 responses #1844 by @ump45nose
Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)
- OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
- Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
Preserve numeric progress tokens in RequestOptions serialization #1832 by @dfedoryshchev
Dispose legacy SSE POST responses to release connections deterministically #1841 by @yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

Document standing support for new MCP specification revisions #1826 by @halter73 (co-authored by @Copilot)

Test Improvements

Stabilize discovery-capable test connections while retaining initialization deadlines #1943 by @tarekgh

Repository Infrastructure Updates

Add a source selector for manual documentation publishes #1828 by @jeffhandley (co-authored by @Copilot)
Update SourceLink's private build dependency to resolve a vulnerable Git dependency #1873 by @halter73 (co-authored by @Copilot)
Correct obsolete McpServerFactory references in Copilot instructions #1892 by @Zir0-93
Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #1940

Acknowledgements

@scottt732 made their first contribution in #1855
@Zir0-93 made their first contribution in #1892
@Coding-Professional made their first contribution in #1903
... (truncated)

Commits viewable in compare view.

Updated Quartz from 4.6.0 to 4.7.2.

Release notes

Sourced from Quartz's releases.

4.7.2

Fixes for the 4.7 line, most of them for .NET 11. There is no public API change and no schema change.

Fixed

A dashboard at a custom path loads in a Debug build made with the .NET 11 SDK.
- The symptom: a host built in Debug with the .NET 11 SDK never made a dashboard at a custom DashboardPath interactive, because the Blazor circuit never started.
- The cause: the SDK adds a hot-reload JS initializer (_framework/Microsoft.NET.Sdk.BlazorWeb.DotNetWatch.<hash>.lib.module.js) to every Debug build of a Blazor host, even without dotnet watch. The dashboard's <base href> sends that request under the dashboard path, but the dashboard mirrored only blazor.web.js and opaque-redirect there. So the request failed, and the failed import stopped Blazor.start.
- The fix: the dashboard now serves the whole _framework tree under its path, forwarding each file to what the host serves at /_framework/.
- Not affected: the default /quartz path, Release and publish builds, and builds with the .NET 10 SDK.
- Thanks to the Marten Studio maintainers, who found it in their port of the dashboard's mount code. (#4225, closes #4224)
On .NET 11, agents register with a dashboard that uses a fail-closed FallbackPolicy.
- The symptom: on ASP.NET Core 11, a dashboard host with the fail-closed FallbackPolicy the dashboard recommends turned away every agent, even one with the right token.
- The cause: ASP.NET Core 11 holds a hub method that carries any attribute to the FallbackPolicy, whatever the hub's endpoint allows (dotnet/aspnetcore#69624). The compiler puts AsyncStateMachineAttribute on every async method, so the agent hub's Register was held to the policy, and so were the live-events hub's methods.
- The fix: the dashboard's hub methods are no longer async, so they carry no attribute. The agent hub's own token check is unchanged.
- Still affected: a dashboard mapped with AllowAnonymous() under a fail-closed FallbackPolicy doesn't start its Blazor circuit on .NET 11 for an unauthenticated user. Blazor's own StartCircuit meets the same ASP.NET Core issue, which only ASP.NET Core can fix. (#4235, closes #4234)
A delegate job beside AddDeclaredJobs() is intercepted in a net11.0 build.
- The symptom: in an app targeting net11.0, a ScheduleJob or AddJob delegate in the same AddQuartz lambda as AddDeclaredJobs() got no generated interceptor. It fell back to reflection binding, which a trimmed or native AOT app can't use.
- The cause: the delegate-jobs generator can't see the registration the declared-jobs generator writes. Against the .NET 11 reference assemblies, the compiler resolved the unbound lambda to another AddQuartz overload.
- The fix: the generator now binds such a call again, against a stand-in for that registration. A delegate call chained onto AddDeclaredJobs() is now intercepted too, which it never was before on any target framework. (#4235, closes #4234)
On .NET 11, a 500 from the scheduler HTTP API keeps its problem-details title. ASP.NET Core 11 retitled 500 (dotnet/aspnetcore#65590), so the HTTP API's 500 body changed with the runtime. The HTTP API now writes every problem's type and title from its own table, which is ASP.NET Core 10's, so the body is the same on every runtime. The agent's 413 and 501 bodies gain the type and title the HTTP API already wrote. (#4235, closes #4234)
Stopping a host twice at once no longer throws from the dashboard's attached-store discovery. A host started with Run or RunAsync stops itself once its stopping token fires. A second stop from elsewhere, such as an application's own StopAsync or a test host's dispose, then ran AttachedStoreDiscovery.StopAsync at the same time. That threw InvalidOperationException: Collection was modified, even with no store attached. (#4230, closes #4229)

The 3.x line gets the dashboard _framework fix in 3.22.10. None of the others apply to 3.x, which has no attached-store discovery, no agent hub, no HTTP API problem details and no source generators.

What's Changed

A dashboard at a custom path serves the whole _framework tree under its path, so the .NET 11 SDK's hot-reload initializer loads in a Debug build by @lahma in A dashboard at a custom path serves the whole _framework tree under its path, so the .NET 11 SDK's hot-reload initializer loads in a Debug build quartznet/quartznet#4225
4.7.2: a dashboard at a custom path loads the .NET 11 SDK's hot-reload initializer in a Debug build (4.7.x) by @lahma in 4.7.2: a dashboard at a custom path loads the .NET 11 SDK's hot-reload initializer in a Debug build (4.7.x) quartznet/quartznet#4228
AttachedStoreDiscovery.StopAsync is safe to call twice at once, and a timer made after a stop has begun is disposed by @lahma in AttachedStoreDiscovery.StopAsync is safe to call twice at once, and a timer made after a stop has begun is disposed quartznet/quartznet#4230
4.7.2: AttachedStoreDiscovery.StopAsync is safe to call twice at once (4.7.x) by @lahma in 4.7.2: AttachedStoreDiscovery.StopAsync is safe to call twice at once (4.7.x) quartznet/quartznet#4231
Problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 by @lahma in Problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 quartznet/quartznet#4235
4.7.2: problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 (4.7.x) by @lahma in 4.7.2: problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 (4.7.x) quartznet/quartznet#4237

Full Changelog: quartznet/quartznet@v4.7.1...v4.7.2

4.7.1

Two fixes for the 4.7 line: decimals read back correctly on .NET 11, and NativeJob works properly on Linux. There is no public API change and no schema change.

Fixed

On .NET 11, a job-data number read as a decimal comes back as the number that was written. .NET 11 converts a double or float to the decimal nearest its exact binary value, so JobDataMap.Get<decimal> of 12.34d returned 12.339999999999999857891452848. Nothing threw, so a job reading an amount silently got a different number after the runtime upgrade. The values affected are a double or float in job data: untyped JSON numbers, scheduling data, the HTTP API, or Put("amount", 12.34). So are the DEC_PROP_1/2 trigger columns, when a driver such as SQLite's returns NUMERIC as a double. Quartz now rounds those to 15 (double) or 7 (float) significant digits, as every earlier runtime did. (#4216, closes #4210)
NativeJob passes its parameters to the shell on Linux. The command and its parameters were joined into one Arguments string, which .NET splits on whitespace, so /bin/sh -c echo hi ran echo alone and the parameters never reached the command. (#4215, closes #4212)
Cancelling a waiting NativeJob kills the process tree. An interrupt or a shutdown left the child running, and the job reported the cancellation as Error launching native command. The job now kills the process and its descendants, and ends as cancelled (OperationCanceledException) rather than failed. (#4215)
NativeJob reads output without foreground threads. Two foreground threads read stdout and stderr, so a child that held its pipes open kept the host process alive after shutdown. Asynchronous reads replace them. When the job waits, all output is logged before it completes, unless a process the command started keeps the streams open more than 5 seconds after it exits; event 7204 then says so. (#4215)
NativeJob runs the system directory's cmd.exe on Windows, never one that PATH or the working directory finds first. (#4215)

Compatibility

On Linux, a NativeJob command that wrapped itself in quotes to work around the old whitespace split now passes those quotes to the shell. Remove the quotes, or move the arguments to Parameters.
A cancelled NativeJob now ends as cancelled rather than with a JobExecutionException. Listeners and history see a cancellation.

The 3.x line gets the same fixes in 3.22.10.

What's Changed

On .NET 11, a job-data double or float read as a decimal comes back as the number that was written by @lahma in On .NET 11, a job-data double or float read as a decimal comes back as the number that was written quartznet/quartznet#4216
NativeJob passes its parameters to the shell on Linux, kills the process tree when cancelled, and reads output without foreground threads by @lahma in NativeJob passes its parameters to the shell on Linux, kills the process tree when cancelled, and reads output without foreground threads quartznet/quartznet#4215
4.7.1: job-data decimals read the same on .NET 11, and NativeJob passes its parameters on Linux and kills its process when cancelled (4.7.x) by @lahma in 4.7.1: job-data decimals read the same on .NET 11, and NativeJob passes its parameters on Linux and kills its process when cancelled (4.7.x) quartznet/quartznet#4221

Full Changelog: quartznet/quartznet@v4.7.0...v4.7.1

4.7.0

Quartz.NET 4.7 is about running a schedule the way it was meant. Four additions cover that:

A simple trigger can measure its interval from the previous run's completion.
A scheduler-wide default time zone applies to every trigger that names none.
A declared trigger can be switched off from configuration with -.
The HTTP API and every dashboard trigger page show a trigger's upcoming fire times.

A stored typed job can be run now with its input. SQL Server joins lock-free firing rounds when READ_COMMITTED_SNAPSHOT is on. An application on 4.6 compiles on 4.7 unchanged. One behaviour change needs checking: CronExpressionBuilder now writes 0 for an unset seconds field. The upgrade has one required database migration, a nullable column that can run while 4.6 nodes are up. See Upgrading from 4.6 to 4.7.

dotnet add package Quartz --version 4.7.0

Highlights

Fixed-delay schedules. SimpleScheduleBuilder.MeasureIntervalFromCompletion() starts the next run an interval after the previous one completes, so a long run never queues the next one behind it. Triggers
A default time zone. UseDefaultTimeZone (Scheduler:DefaultTimeZone) gives its zone to every cron, calendar-interval, daily time-interval and recurrence trigger that names none. Triggers
Upcoming fire times. IScheduler.GetUpcomingFireTimes computes a stored trigger's next fire times. The HTTP API serves them at …/fire-times, and every trigger page on the dashboard shows them. Dashboard and HTTP API
- switches a declared trigger off. A ConfigurationKey value, or a Quartz:Schedule expression, interval or rule, of - leaves that trigger unscheduled and removes a stored copy. Configuration
A typed manual run. TriggerJob<TInput>(jobKey, input) fires an IJob<TInput> now with its input, and returns the trigger's key. Triggers
Lock-free rounds on SQL Server. With READ_COMMITTED_SNAPSHOT on and at least two live 4.7 nodes, a round of concurrent-allowed work takes no lock, and claims and fires in two transactions. Clustering
One registration for your own types under trimming. AddJsonTypeInfoResolver hands the scheduler your JsonSerializerContext once, for job data and for job inputs. Trimming and native AOT

Triggers

A simple trigger can measure its interval from completion (#4154, closes #4140).
- It is MeasureIntervalFromCompletion on the builder, on [SimpleTrigger], in the JSON and XML schedules, through the HTTP API's update-details and in the dashboard's Edit details.
- It is stored in the nullable QRTZ_TRIGGERS.FIXED_DELAY, from the required migration 4.7/add_trigger_fixed_delay. A 4.6 node runs such a trigger at a fixed rate, so turn it on only once every node is 4.7.
A scheduler-wide default time zone (#4146, closes #4135). It is QuartzSchedulerOptions.DefaultTimeZone, or UseDefaultTimeZone(TimeZoneInfo). The keys are Scheduler:DefaultTimeZone and quartz.scheduler.defaultTimeZone, and take an IANA or Windows id. A trigger that names a zone keeps it. InTimeZone(null) now means "no zone stated".
TriggerJob<TInput> runs a stored typed job now with its input, and returns the manual trigger's TriggerKey, for history and fire-instance lookups. TriggerJob(jobKey, token) now compiles and fires the job with no data (#4150, closes #4138).
CronExpressionBuilder leaves an unset seconds field at 0, not * (#4144, closes #4143). WithMinuteIncrements(0, 5) used to build * 0/5 * ? * *, every second of every fifth minute. It now builds 0 0/5 * ? * *. To fire every second, add WithSecondRange(0, 59).
A start that re-applies a declared trigger keeps its run state (#4147, closes #4128). While the schedule is unchanged, it keeps TimesTriggered, a pending retry and an individual pause, so a finite repeat count does not start over. Also in 4.6.1 and 3.22.8.

Clustering

Lock-free firing rounds on SQL Server (#4157, closes #4117). These need READ_COMMITTED_SNAPSHOT on and at least one other live 4.7 node. A single node keeps 4.5's rounds (reason no_live_peer), because there they measured slower. Without the setting, rounds stay locked (reason read_committed_snapshot_off, which replaces sql_server). See SQL Server.
Interrupt follow-ups (#4153, closes #4141). A dashboard cluster row asks the preferred member, and the next only if that fails. A store-attached dashboard window can interrupt a firing on a live 4.6+ node. FireInstance.InterruptRequestedUtc shows a pending request.
A node with a generated instance id warns about triggers pinned to a fixed node, which can never match it (event 4031; #4145, closes #4139).
A recovered firing of an ungrouped trigger counts against its trigger group's execution limit under UseTriggerGroupWhenUnset, not against RECOVERING_JOBS (#4148, closes #4142). Also in 4.6.1.
A serial job's completion reads only the triggers that misfired, not its whole backlog (#4169, from #4167). Thanks @kostekk88 for the report and the harness. Also in 4.6.1.
A manual firing reads only the group column of its job's triggers to find their shared execution group (#4179, closes #4174). Also in 4.6.3.

Dashboard and HTTP API

Upcoming fires on every trigger page (#4152, closes #4136). They are read through IQuartzApiClient.GetUpcomingFireTimes, a default interface member, from the route GET …/triggers/{group}/{name}/fire-times. The agent operation is GetTriggerFireTimes. A fixed-delay trigger shows its next run as provisional. The cron editor's preview shows only while the edited expression differs from the saved one (#4159).
An agent's goodbye is heard before it disconnects (#4201, closes #4176). Unregister at scheduler shutdown was sent without waiting for delivery, and stopping the connection could drop it, so the dashboard listed the agent as disconnected instead of shut down.

Configuration

A configured schedule of - switches a declared trigger off (#4151, closes #4137). It applies to a ConfigurationKey value, and to the JSON schedule's Cron.Expression, Simple.Interval and Recurrence.Rule. The trigger is not scheduled, a stored copy is unscheduled, and event 4032 is logged.
... (truncated)

4.6.3

Two fixes for the 4.6 line, for applications that are not yet ready for 4.7's database migration. There is no public API change and no schema change.

Fixed

Quartz.Weasel.MySQL floors MySqlConnector at 2.6.1. 4.6.2 took the driver from Weasel.MySql 9.39.0, which declares 2.4.0, so its nuspec carried a floor that GHSA-473q-m89c-ghf8 covers: the driver sends the password before it has verified the server's TLS certificate. The package now names MySqlConnector itself, at the first fixed version. An application that already references 2.6.1 or later is unaffected. (#4204, from #4197)
A manual firing reads only the group column of its job's triggers. To find the execution group a job's triggers share, TriggerJob listed every trigger's header. On the ADO.NET store that meant every column of every trigger, a fired-trigger probe per row and a sort. On RAMJobStore it meant a walk of the whole store. Each firing not yet run made the next listing longer. A shipped delegate now reads EXECUTION_GROUP alone, and stops at the first row that settles the answer. On SQLite with 4,000 triggers, TriggerJob drops from 38.6 ms to 12.4 ms. (#4204, from #4179 and #4174)

Dependency change

Quartz.Weasel.MySQL gains a direct dependency on MySqlConnector (>= 2.6.1).

4.7.0 carries both fixes. No 3.x package references MySqlConnector, and 3.x has had the manual-firing fix since 3.22.8.

What's Changed

A manual firing reads only the group column of its job's triggers to find the execution group they share by @lahma in A manual firing reads only the group column of its job's triggers to find the execution group they share quartznet/quartznet#4179
4.6.3: Quartz.Weasel.MySQL floors MySqlConnector at 2.6.1, and a manual firing reads only its job's group column (4.6.x) by @lahma in 4.6.3: Quartz.Weasel.MySQL floors MySqlConnector at 2.6.1, and a manual firing reads only its job's group column (4.6.x) quartznet/quartznet#4204

Full Changelog: quartznet/quartznet@v4.6.2...v4.6.3

4.6.2

One fix for the 4.6 line. There is no public API change, no schema change and no dependency change.

Fixed

Legacy time zone names resolve on a system without tzdata-legacy, such as Ubuntu 26.04. Without the TimeZoneConverter plugin, seven Windows ids (FLE, India, Argentina, Greenland, Myanmar, Nepal and US Eastern Standard Time) and tzdata's legacy IANA names, such as Asia/Calcutta and Europe/Kiev, threw TimeZoneNotFoundException there. For those seven Windows ids, .NET maps through CLDR to the legacy names, which only tzdata-legacy installs. Quartz now maps a legacy name to its canonical zone through tzdata 2026e's backward links, and resolves it under the id asked for. The id a store writes to TIME_ZONE_ID therefore does not depend on whether the host has tzdata-legacy. (#4180, from #4172)

Behaviour change

With UseTimeZoneConverter on such a host, 4.6.1 stored the canonical name (TimeZoneConverter 7.1.0 answers Europe/Kyiv for FLE Standard Time). 4.6.2 resolves the id before the plugin is asked, so it stores the id asked for. Rows already stored read back either way.

The same fix ships for 3.x in 3.22.9.

What's Changed

TimeZones.FindById resolves the tzdata legacy names, and the Windows ids CLDR maps to them, on a system without tzdata-legacy by @lahma in TimeZones.FindById resolves the tzdata legacy names, and the Windows ids CLDR maps to them, on a system without tzdata-legacy quartznet/quartznet#4180
4.6.2: legacy time zone names resolve without tzdata-legacy by @lahma in 4.6.2: legacy time zone names resolve without tzdata-legacy quartznet/quartznet#4184

Full Changelog: quartznet/quartznet@v4.6.1...v4.6.2

4.6.1

Fixes from 4.7's development for the 4.6 line. There is no public API change and no schema change. Quartz.Plugins.TimeZoneConverter now requires TimeZoneConverter 7.1.0; no other package's dependencies change.

Fixed

A start no longer resets a declared trigger's run state. Creating a scheduler re-applies every AddTrigger and ScheduleJob registration and every scheduling file through RescheduleJob. That reset TimesTriggered, so a finite WithRepeatCount or a recurrence rule's COUNT ran again from the beginning. It also dropped a retry pending at shutdown, and resumed a trigger an operator had paused on its own. While the declared schedule is unchanged, the count and the retry are now kept, and so is the pause, with its record. A changed schedule starts fresh, and an application's own RescheduleJob still ends an individual pause. (#4147, from #4128)
A [DisallowConcurrentExecution] job's completion reads only the triggers that misfired. Each completion read every waiting trigger of the job in full under TRIGGER_ACCESS to find the late ones, so draining a backlog read N rows on each of N completions, and scheduling calls waited behind the lock. A shipped delegate now reads only the job's misfired triggers, with the misfire handler's own predicate. In the #4167 workload on SQL Server (400 queued triggers on one serial job, 50 ms body), the drain went from 138 s with 137 misfire events to 101 s with 37. (#4169, from #4167)
A declared job-data type with a number, a boolean or a nested object reads back. A value of a type declared through AddTypeInfoResolver was stored, and then its job failed to load with Failed to parse JobDataMap from json. It now reads back as a Dictionary<string, string> of its members: a number or a boolean as its JSON text ("3", "true"), a nested object as its JSON, a null as null. A map that 4.6.0 stored loads. (#4161, from #4156)
A recovered firing of an ungrouped trigger is limited under its trigger group. Under UseTriggerGroupWhenUnset, a firing replayed after cluster recovery, a shutdown hand-back or startup recovery was limited under RECOVERING_JOBS, so it ran beside its group's live firings whatever the group's limit. (#4148, from #4142)
Startup recovery of a replay keeps the firing it replays. A replay of a replay named the recovery trigger rather than the original firing, and lost the original group's execution limit. Cluster recovery already kept it. (#4160)
A cron trigger's clone has a job data map of its own. CronTriggerImpl.Clone shared the original's map, so a write through either was seen by both. The other trigger types already copied it. (#4160)
Quartz.Plugins.TimeZoneConverter resolves seven more Windows ids on a system without tzdata-legacy, such as Ubuntu 26.04: FLE, India, Argentina, Greenland, Myanmar, Nepal and US Eastern Standard Time. Their CLDR names are legacy links that only tzdata-legacy installs, and TimeZoneConverter 7.1.0 maps them to the canonical names. Without the plugin those ids still fail on such a system; #4172 tracks that. (#4171)

Behaviour changes

A declared collection, or a declared object with a collection member, is refused when the map is written. The JsonSerializationException names the entry, the type and the member. Such a value used to be stored and then fail to load. (#4161)
The ADO store's completion no longer reports a late IgnoreMisfirePolicy trigger as misfired. This applies to the completion of a [DisallowConcurrentExecution], BufferOne or CancelPrevious firing, which also no longer writes such a trigger back. Acquisition fires it late, as the misfire handler and RAMJobStore already did. (#4169)

The run-state and serial-completion fixes ship for 3.x in 3.22.8.

What's Changed

A start that re-applies declared triggers keeps their run state and an individual pause by @lahma in A start that re-applies declared triggers keeps their run state and an individual pause quartznet/quartznet#4147
A recovered firing of an ungrouped trigger counts against its trigger group's execution limit, not RECOVERING_JOBS by @lahma in A recovered firing of an ungrouped trigger counts against its trigger group's execution limit, not RECOVERING_JOBS quartznet/quartznet#4148
Small 4.7 fixes: a cron trigger clone's data map, a daily trigger's end-after-count zone, recovery markers, and the options table by @lahma in Small 4.7 fixes: a cron trigger clone's data map, a daily trigger's end-after-count zone, recovery markers, and the options table quartznet/quartznet#4160
A job-data value of a declared type reads back as it was written by @lahma in A job-data value of a declared type reads back as it was written quartznet/quartznet#4161
A serial job's completion reads only the triggers that misfired, not its whole backlog by @lahma in A serial job's completion reads only the triggers that misfired, not its whole backlog quartznet/quartznet#4169
The unit tests and the trimming canary run on Ubuntu 26.04: IANA test zones and TimeZoneConverter 7.1.0 by @lahma in The unit tests and the trimming canary run on Ubuntu 26.04: IANA test zones and TimeZoneConverter 7.1.0 quartznet/quartznet#4171
4.6.1: fixes from main for the 4.6 line by @lahma in 4.6.1: fixes from main for the 4.6 line quartznet/quartznet#4177

Full Changelog: quartznet/quartznet@v4.6.0...v4.6.1

Commits viewable in compare view.

Updated Quartz.Extensions.Hosting from 4.6.0 to 4.7.2.

Release notes

Sourced from Quartz.Extensions.Hosting's releases.

4.7.2

Fixes for the 4.7 line, most of them for .NET 11. There is no public API change and no schema change.

Fixed

A dashboard at a custom path loads in a Debug build made with the .NET 11 SDK.
- The symptom: a host built in Debug with the .NET 11 SDK never made a dashboard at a custom DashboardPath interactive, because the Blazor circuit never started.
- The cause: the SDK adds a hot-reload JS initializer (_framework/Microsoft.NET.Sdk.BlazorWeb.DotNetWatch.<hash>.lib.module.js) to every Debug build of a Blazor host, even without dotnet watch. The dashboard's <base href> sends that request under the dashboard path, but the dashboard mirrored only blazor.web.js and opaque-redirect there. So the request failed, and the failed import stopped Blazor.start.
- The fix: the dashboard now serves the whole _framework tree under its path, forwarding each file to what the host serves at /_framework/.
- Not affected: the default /quartz path, Release and publish builds, and builds with the .NET 10 SDK.
- Thanks to the Marten Studio maintainers, who found it in their port of the dashboard's mount code. (#4225, closes #4224)
On .NET 11, agents register with a dashboard that uses a fail-closed FallbackPolicy.
- The symptom: on ASP.NET Core 11, a dashboard host with the fail-closed FallbackPolicy the dashboard recommends turned away every agent, even one with the right token.
- The cause: ASP.NET Core 11 holds a hub method that carries any attribute to the FallbackPolicy, whatever the hub's endpoint allows (dotnet/aspnetcore#69624). The compiler puts AsyncStateMachineAttribute on every async method, so the agent hub's Register was held to the policy, and so were the live-events hub's methods.
- The fix: the dashboard's hub methods are no longer async, so they carry no attribute. The agent hub's own token check is unchanged.
- Still affected: a dashboard mapped with AllowAnonymous() under a fail-closed FallbackPolicy doesn't start its Blazor circuit on .NET 11 for an unauthenticated user. Blazor's own StartCircuit meets the same ASP.NET Core issue, which only ASP.NET Core can fix. (#4235, closes #4234)
A delegate job beside AddDeclaredJobs() is intercepted in a net11.0 build.
- The symptom: in an app targeting net11.0, a ScheduleJob or AddJob delegate in the same AddQuartz lambda as AddDeclaredJobs() got no generated interceptor. It fell back to reflection binding, which a trimmed or native AOT app can't use.
- The cause: the delegate-jobs generator can't see the registration the declared-jobs generator writes. Against the .NET 11 reference assemblies, the compiler resolved the unbound lambda to another AddQuartz overload.
- The fix: the generator now binds such a call again, against a stand-in for that registration. A delegate call chained onto AddDeclaredJobs() is now intercepted too, which it never was before on any target framework. (#4235, closes #4234)
On .NET 11, a 500 from the scheduler HTTP API keeps its problem-details title. ASP.NET Core 11 retitled 500 (dotnet/aspnetcore#65590), so the HTTP API's 500 body changed with the runtime. The HTTP API now writes every problem's type and title from its own table, which is ASP.NET Core 10's, so the body is the same on every runtime. The agent's 413 and 501 bodies gain the type and title the HTTP API already wrote. (#4235, closes #4234)
Stopping a host twice at once no longer throws from the dashboard's attached-store discovery. A host started with Run or RunAsync stops itself once its stopping token fires. A second stop from elsewhere, such as an application's own StopAsync or a test host's dispose, then ran AttachedStoreDiscovery.StopAsync at the same time. That threw InvalidOperationException: Collection was modified, even with no store attached. (#4230, closes #4229)

The 3.x line gets the dashboard _framework fix in 3.22.10. None of the others apply to 3.x, which has no attached-store discovery, no agent hub, no HTTP API problem details and no source generators.

What's Changed

A dashboard at a custom path serves the whole _framework tree under its path, so the .NET 11 SDK's hot-reload initializer loads in a Debug build by @lahma in A dashboard at a custom path serves the whole _framework tree under its path, so the .NET 11 SDK's hot-reload initializer loads in a Debug build quartznet/quartznet#4225
4.7.2: a dashboard at a custom path loads the .NET 11 SDK's hot-reload initializer in a Debug build (4.7.x) by @lahma in 4.7.2: a dashboard at a custom path loads the .NET 11 SDK's hot-reload initializer in a Debug build (4.7.x) quartznet/quartznet#4228
AttachedStoreDiscovery.StopAsync is safe to call twice at once, and a timer made after a stop has begun is disposed by @lahma in AttachedStoreDiscovery.StopAsync is safe to call twice at once, and a timer made after a stop has begun is disposed quartznet/quartznet#4230
4.7.2: AttachedStoreDiscovery.StopAsync is safe to call twice at once (4.7.x) by @lahma in 4.7.2: AttachedStoreDiscovery.StopAsync is safe to call twice at once (4.7.x) quartznet/quartznet#4231
Problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 by @lahma in Problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 quartznet/quartznet#4235
4.7.2: problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 (4.7.x) by @lahma in 4.7.2: problem details, the dashboard hubs and the delegate-job generator behave the same on .NET 11 as on 10 (4.7.x) quartznet/quartznet#4237

...

Description has been truncated

Bumps JsonSchema.Net from 9.4.1 to 9.6.0 Bumps Microsoft.Agents.AI from 1.25.0 to 1.27.0 Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Authentication.Negotiate from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Authentication.OpenIdConnect from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.SignalR.Client from 10.0.13 to 10.0.14 Bumps Microsoft.Data.Sqlite from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration.Abstractions from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration.Binder from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration.CommandLine from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Configuration.Json from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.DependencyInjection from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Hosting from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Hosting.WindowsServices from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Http from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.13 to 10.0.14 Bumps Microsoft.OpenApi from 2.12.2 to 2.13.0 Bumps Microsoft.PowerShell.SDK from 7.6.7 to 7.6.9 Bumps ModelContextProtocol from 2.2.0 to 2.3.1 Bumps ModelContextProtocol.Core from 2.2.0 to 2.3.1 Bumps Quartz from 4.6.0 to 4.7.2 Bumps Quartz.Extensions.Hosting from 4.6.0 to 4.7.2 Bumps System.DirectoryServices.Protocols from 10.0.13 to 10.0.14 Bumps System.Management.Automation from 7.6.7 to 7.6.9 Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14 Bumps System.Security.Cryptography.ProtectedData from 10.0.13 to 10.0.14 Bumps System.Security.Cryptography.Xml from 10.0.13 to 10.0.14 --- updated-dependencies: - dependency-name: JsonSchema.Net dependency-version: 9.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.Agents.AI dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Authentication.Negotiate dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: System.DirectoryServices.Protocols dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Authentication.OpenIdConnect dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.SignalR.Client dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Data.Sqlite dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.SqlServer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.Abstractions dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.CommandLine dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Hosting dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Hosting.WindowsServices dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.OpenApi dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.PowerShell.SDK dependency-version: 7.6.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: System.Security.Cryptography.Xml dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: ModelContextProtocol dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: ModelContextProtocol.Core dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Quartz dependency-version: 4.7.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 4.7.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: System.Management.Automation dependency-version: 7.6.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: System.Security.Cryptography.Pkcs dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: System.Security.Cryptography.ProtectedData dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Microsoft.Data.SqlClient 7.1.1 pulls System.Configuration.ConfigurationManager 10.0.14, which needs System.Diagnostics.EventLog >= 10.0.14. The central pin at 10.0.10 made restore fail with NU1605. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dependabot Bot requested a review from Sev7eNup as a code owner November 5, 2026 21:47

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 5, 2026

Sev7eNup merged commit 416a912 into main Nov 5, 2026
27 of 29 checks passed

Sev7eNup deleted the dependabot/nuget/nuget-minor-patch-9d3bfa43f2 branch November 5, 2026 23:02

Navigation Menu

Repository navigation

Bump the nuget-minor-patch group with 35 updates - #806

Bump the nuget-minor-patch group with 35 updates#806
Sev7eNup merged 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-9d3bfa43f2

dependabot Bot commented on behalf of github Nov 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.27.0

[1.27.0] - 2026-10-30

Added

Changed

Fixed

1.26.0

Changes:

2.13.0

2.13.0 (2026-10-19)

Features

Bug Fixes

7.6.9

Build and Packaging Improvements

SHA256 Hashes of the release artifacts

7.6.8

General Cmdlet Updates and Fixes

Build and Packaging Improvements

SHA256 Hashes of the release artifacts

2.3.1

What's Changed

Repository Infrastructure Updates

2.3.0

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

2.3.1

What's Changed

Repository Infrastructure Updates

2.3.0

Breaking Changes

What's Changed

Documentation Updates

Test Improvements

Repository Infrastructure Updates

Acknowledgements

4.7.2

Fixed

What's Changed

4.7.1

Fixed

Compatibility

What's Changed

4.7.0

Highlights

Triggers

Clustering

Dashboard and HTTP API

Configuration

4.6.3

Fixed

Dependency change

What's Changed

4.6.2

Fixed

Behaviour change

What's Changed

4.6.1

Fixed

Behaviour changes

What's Changed

4.7.2

Fixed

What's Changed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Nov 5, 2026 •

edited

Loading