Bump Jint and 18 others

[dependabot]

Pinned Jint at 4.15.3.

Release notes

Sourced from Jint's releases.

4.15.3

Jint 4.15.3 rounds out the 4.15 embedder line: every item here answers friction a real integration reported while adopting the host-integration surface 4.15.0 introduced. Everything is additive — no option defaults changed and no behavior changes for existing code.

• Engine.Advanced.AddLazyGlobal (#​2862) — install a lazy global on a live engine, so a host whose globals are computed from per-request data can defer building them until script reads the name; the same PR adds Engine.Advanced.WithRestoredGlobals(snapshot, action), the try/finally every snapshot-reusing host was writing by hand.
• PropertyDescriptor.CreateLazy (#​2865) — a public lazy property descriptor that materializes once and then rejoins the read and write inline caches, which a hand-rolled CustomJsValue descriptor never could; it is the sanctioned way to build for any host object property what AddLazyGlobal does for a global.
• Options.AddImmutableCrossing(params Type[]) (#​2863) — a host promise that instances of the declared CLR types do not change while they are exposed to the engine, in exchange for which a wrapped object memoizes its resolved reads. On the nested-document walk it was built for that measures −43% to −84% time and −99% allocation against the undeclared path, with dictionary and JsonNode sources converging to identical steady-state cost. It is a promise: a declared object mutated anyway will serve stale reads.
• Host-contract verification from the shipped package (#​2864) — set the Jint.EnableHostContractVerification AppContext switch before the first use of any Jint type and the checks that catch a host answering one extension point in a way that contradicts another run in Release, throwing with a descriptive message. Embedders can now run their suites against the exact package they deploy instead of building a Debug Jint from source, and CI now runs this repository's own host suites that way too (#​2866).
• Engine.Advanced.HasSharedShape (#​2861) — a stable, pinnable predicate for whether JsObject.Create, CreateFromEntries or JsObjectShape.Instantiate actually produced a shared-layout object, which the explicitly non-contractual ObjectRepresentation diagnostic could never be.
• JsString.Create(string) is now public (#​2860) — the counterpart of JsNumber.Create, answering the empty string and single-character ASCII from interned instances instead of allocating.
• Documentation (#​2859) — an unresolvable reference's Base holds an internal sentinel rather than undefined, and resolver authors returning it were leaking that sentinel string into scripts; the docs and the in-repo sample now show the right idiom.

What's Changed

• Make JsString.Create(string) public by @​lahma in Make JsString.Create(string) public sebastienros/jint#2860
• Document that an unresolvable reference's base is a sentinel, not undefined by @​lahma in Document that an unresolvable reference's base is a sentinel, not undefined sebastienros/jint#2859
• Add engine-reuse ergonomics: post-construction lazy globals and a snapshot scope by @​lahma in Add engine-reuse ergonomics: post-construction lazy globals and a snapshot scope sebastienros/jint#2862
• Give hosts a stable predicate for "did the shaping actually happen" by @​lahma in Give hosts a stable predicate for "did the shaping actually happen" sebastienros/jint#2861
• Make the host-contract verifiers reachable, and complete by @​lahma in Make the host-contract verifiers reachable, and complete sebastienros/jint#2864
• Give hosts a lazy descriptor that rejoins the caches once it holds a value by @​lahma in Give hosts a lazy descriptor that rejoins the caches once it holds a value sebastienros/jint#2865
• Let a host promise a wrapped object is immutable and have its reads memoized by @​lahma in Let a host promise a wrapped object is immutable and have its reads memoized sebastienros/jint#2863

Full Changelog: sebastienros/jint@v4.15.2...v4.15.3

4.15.2

Jint 4.15.2 is a fix release.

• Async and generator suspension — loop iteration state is preserved across suspensions in async generators and for await...of (#​2852), an await suspending a right-hand side no longer stores the suspension sentinel into the target (#​2855), and suspension-node resolution unwraps correctly (#​2856).
• Correctness — calling and instanceof work on bound functions whose target is itself bound (#​2853), and inherited accessors reached through ObjectInstance.TryGetValue receive the original receiver (#​2854).
• Performance — the builtin-shape probe lane answers an authoritative miss without falling back to the slow path, which named-index misses on shaped objects were paying on every probe (#​2858); and the JsObject.Create values span is now nullable-annotated so a lazy slot's required null needs no suppression (#​2851).

What's Changed

• Annotate the layout values span so a lazy entry's null needs no suppression by @​lahma in Annotate the layout values span so a lazy entry's null needs no suppression sebastienros/jint#2851
• Unwrap a JintStatement suspension node so for-await resumes into the right branch by @​HermanusMuellerEU in Unwrap a JintStatement suspension node so for-await resumes into the right branch sebastienros/jint#2856
• Fix calling and instanceof on bound functions whose target is itself bound by @​HermanusMuellerEU in Fix calling and instanceof on bound functions whose target is itself bound sebastienros/jint#2853
• Preserve loop iteration state across suspensions in async generators and for-await-of by @​HermanusMuellerEU in Preserve loop iteration state across suspensions in async generators and for-await-of sebastienros/jint#2852
• Pass the original receiver to inherited accessors in ObjectInstance.TryGetValue by @​HermanusMuellerEU in Pass the original receiver to inherited accessors in ObjectInstance.TryGetValue sebastienros/jint#2854
• Do not store the suspension sentinel when an await suspends a right-hand side by @​HermanusMuellerEU in Do not store the suspension sentinel when an await suspends a right-hand side sebastienros/jint#2855
• Answer an authoritative miss from the builtin-shape probe lane by @​lahma in Answer an authoritative miss from the builtin-shape probe lane sebastienros/jint#2858

New Contributors

• @​HermanusMuellerEU made their first contribution in Unwrap a JintStatement suspension node so for-await resumes into the right branch sebastienros/jint#2856

Full Changelog: sebastienros/jint@v4.15.1...v4.15.2

4.15.1

Jint 4.15.1 is a small refinement release shaped by the first real-world adoptions of 4.15.0's host-integration surface — every change answers a need a shipping embedder hit within days of the release. No behavior changes for existing code, with one deliberate spec-path improvement: Object.freeze no longer forces lazily-declared properties into existence just to validate attribute-only redefinitions (so freezing globalThis no longer materializes every lazy global).

• JsObjectLayout lazy slots (#​2850) — a fresh shaped object per item can now defer expensive members: declare AddLazy(name, factory) on the layout, pass per-instance state to JsObject.Create, and the member materializes on first read while every item keeps sharing one hidden class. In the motivating host shape (a 15-member event envelope with 4 expensive members), builds measure ~3.6× faster with 4× fewer allocations than the eager layout, and ~1.6× faster than the dictionary-mode workaround it replaces.
• Observability for host tests — Engine.Advanced.GetPropertyAccessSemantics (#​2847) lets a test pin the access semantics the engine derived for a host type, and GetInteropConversionDiagnostics (#​2848) counts CLR array crossings so a host can audit its ArrayConversion exposure — including through dependencies it doesn't own. Both carry the same non-contractual, diagnostics-only framing as GetObjectRepresentation.
• PropertyFlag.NonWritable / OnlyConfigurable (#​2849) complete the named combination lattice for the descriptor shapes hosts actually build.
• Documentation (#​2846) — the contracts a real adoption tripped over, stated where an embedder will find them: JsonSerializer reuse and its Undefined sentinel, the BigInt.prototype.toJSON escape hatch, what does not route through GetOwnProperties(), and the snapshot reuse recipe.

What's Changed

• Document the contracts a real adoption tripped over by @​lahma in Document the contracts a real adoption tripped over sebastienros/jint#2846
• Let a test observe the access semantics the engine derived for a host type by @​lahma in Let a test observe the access semantics the engine derived for a host type sebastienros/jint#2847
• Name the two PropertyFlag combinations hosts actually build by @​lahma in Name the two PropertyFlag combinations hosts actually build sebastienros/jint#2849
• Count CLR array conversions so a host can audit its crossing semantics by @​lahma in Count CLR array conversions so a host can audit its crossing semantics sebastienros/jint#2848
• Let a layout declare lazy slots so a shaped object can defer expensive members by @​lahma in Let a layout declare lazy slots so a shaped object can defer expensive members sebastienros/jint#2850

Full Changelog: sebastienros/jint@v4.15.0...v4.15.1

4.15.0

Jint 4.15.0 is an embedder-focused release: the host-integration surface was widened after auditing six real-world integrations, engine reuse got first-class support, and an adversarial pre-release review verified every change since 4.14.0 test-first. No option defaults changed. One behavior change to note: re-importing a module whose evaluation failed now rethrows the recorded error instead of returning a namespace (#​2827).

Highlights

Host objects

• Answer reads value-direct with TryGetOwnPropertyValue (#​2808) and existence/enumerability questions without materializing descriptors with ProbeOwnProperty (#​2803); access semantics are derived from the type automatically (#​2804). Warm host reads cost zero probes, and Debug builds verify every answer.
• ArrayLikeObject (#​2835, #​2841) projects a live indexed collection by implementing two members — indexed reads, for-of, spread, generics and JSON.stringify cost one virtual call per element.
• JsObjectShape (#​2830, #​2836, #​2840) declares shared prototypes once per process with lazily materialized per-realm members — and a shaped prototype can serve the prototype-method inline cache, which no host subclass can.
• First adopter: a DOM binding cut indexed-read allocations by 60% and existence probes to zero.

Engine reuse

• CaptureGlobalSnapshot / RestoreGlobalSnapshot (#​2834) restore a configured global between evaluations: top-level let/const cleared (nothing else can), stale promise continuations fenced, warm per-engine caches kept. Configuration reuse — deliberately not an isolation boundary.
• Fresh-engine hosts register globals lazily (AddLazyGlobal, #​2805) or selectively via Prepared<T>.ReferencedGlobals (#​2831). The two compose with the snapshot.

Interop

• CLR member accessors are shared process-wide (#​2798, made effective for extension-method hosts in #​2829); compiled lanes cover dictionary writes, indexers, statics and omitted optional arguments (#​2839); host delegates invoke through arity-typed thunks with no argument array (#​2799, #​2843).
• Typed converter registration (#​2794) and EnumConversionMode.Name (#​2796) keep the lanes a blanket converter used to cost.
• JSON parses from char and UTF-8 spans (#​2832) and serializes into IBufferWriter<byte> (#​2822).
• NullPropagatingReferenceResolver.Instance (#​2833) makes nullish member reads yield undefined through a recognized inline lane.

Performance, gated

• Against 4.14.0 on idle hardware: every Dromaeo row improved (object-regexp −25% with 48% fewer allocations, object-string −21%, string-base64 −15%); SunSpider improved on eleven scripts, zero regressions.
• Fast-call coverage widened across dozens of built-ins, with per-argument guards and register-based rest calls: Math.max(a,b) −22%, push(x,y) −19% (#​2828, #​2843, #​2844).
• encodeURI on clean input −85%; dense toReversed/with up to −86% (#​2843).

On the engine comparison benchmarks, Jint 4.15.0 is the fastest engine outright on 5 of 12 scripts — taking dromaeo-object-regexp-modern from native V8 at −42% — the fastest managed engine on 10 of 12, the fastest interpreter on all 12, and 8.9×–11.6× ahead of ClearScript (native V8) on every interop row.

What's Changed

• Replace xUnit Assert.* with AwesomeAssertions across the test suites by @​lahma in Replace xUnit Assert.* with AwesomeAssertions across the test suites sebastienros/jint#2742
• Cache interop invokers process-wide instead of per-Engine by @​lahma in Cache interop invokers process-wide instead of per-Engine sebastienros/jint#2743
• Compile CLR property and field access instead of reflecting per hit by @​lahma in Compile CLR property and field access instead of reflecting per hit sebastienros/jint#2744
• Convert an indexer hit by the indexer type, not the member type by @​lahma in Convert an indexer hit by the indexer type, not the member type sebastienros/jint#2746
• Measure the execution timeout against an inline deadline by @​lahma in Measure the execution timeout against an inline deadline sebastienros/jint#2747
• Consult reference resolver for a call to an unresolvable identifier by @​poissoncorp in Consult reference resolver for a call to an unresolvable identifier sebastienros/jint#2750
• Trim per-call overhead from the interop method fast lane by @​lahma in Trim per-call overhead from the interop method fast lane sebastienros/jint#2745
• Bypass the array-covariance check on exact-JsValue[] dense element stores by @​lahma in Bypass the array-covariance check on exact-JsValue[] dense element stores sebastienros/jint#2751
• Sort integer-index property keys by value instead of re-parsing each key by @​lahma in Sort integer-index property keys by value instead of re-parsing each key sebastienros/jint#2752
• Bypass the array-covariance check on JsValueListBuilder element stores by @​lahma in Bypass the array-covariance check on JsValueListBuilder element stores sebastienros/jint#2753
• Bypass the array-covariance check on JsObject overflow slot stores by @​lahma in Bypass the array-covariance check on JsObject overflow slot stores sebastienros/jint#2754
• Bypass the array-covariance check on callback argument arrays (sort, groupBy, array iteration) by @​lahma in Bypass the array-covariance check on callback argument arrays (sort, groupBy, array iteration) sebastienros/jint#2755
• Memoize the converted value of a stable reference-typed interop property by @​lahma in Memoize the converted value of a stable reference-typed interop property sebastienros/jint#2756
• Replace StrictModeScope with a Strict flag on the execution context by @​lahma in Replace StrictModeScope with a Strict flag on the execution context sebastienros/jint#2757
• CI: reliably seed the cross-OS Test262 cache and bump actions to latest by @​lahma in CI: reliably seed the cross-OS Test262 cache and bump actions to latest sebastienros/jint#2758
• Bump the testing group with 2 updates by @​dependabot[bot] in Bump the testing group with 2 updates sebastienros/jint#2760
• Bump the analyzers group with 1 update by @​dependabot[bot] in Bump the analyzers group with 1 update sebastienros/jint#2759
• Bump the js-engine-comparisons group with 1 update by @​dependabot[bot] in Bump the js-engine-comparisons group with 1 update sebastienros/jint#2761
  ... (truncated)

4.14.0

Jint 4.14.0 is an interop-focused performance release: CLR arrays now cross into script as live views instead of copies, recently wrapped host objects reuse their wrappers, single-candidate interop method calls dispatch through compiled invokers, and JSON.parse interns repeated keys and values. Host collection traversal is 10.9× faster than 4.13.0. Two interop defaults changed in this release — read the first two highlights if you pass CLR arrays to scripts or rely on per-crossing conversion behavior; everything else needs no code changes to benefit.

Highlights

CLR arrays are live views by default (behavior change). Options.Interop.ArrayConversion now defaults to ArrayConversionMode.LiveView (#​2721, #​2728, #​2735): a single-rank T[] crossing into script becomes a live, fixed-size view over the underlying array — the way wrapped List<T> already behaves — instead of being copied into a new JS array on every read. Writes go through in both directions, and arrays exposed through read-only-declared members (e.g. IReadOnlyList<T>) produce read-only views. Iteration, Array.prototype methods, JSON serialization, index-key enumeration (Object.keys / for..in yield "0".."n-1") and undefined for out-of-range reads all behave array-like, but Array.isArray returns false, and because CLR arrays are fixed-size, resizing operations (push/pop/length writes) throw a TypeError like integer-indexed exotic objects do — shift/splice may move elements before their length change throws, as for typed arrays. Set Options.Interop.ArrayConversion = ArrayConversionMode.Copy to restore the 4.13 behavior.

Recently wrapped CLR objects reuse their wrappers (behavior change). The new Options.Interop.CacheRecentObjectWrappers defaults to true (#​2734): a small bounded ring (8 entries, keyed by reference identity and exposed type) reuses wrappers for host objects that repeatedly cross into script. Wrapper identity becomes stable (host.Obj === host.Obj), script-attached state (freeze, defineProperty, expandos) survives crossings, and the per-crossing wrapper allocation disappears. Under Copy array conversion this also means repeated reads of the same CLR array reuse the first JsArray snapshot while it stays cached — CLR-side mutations are not re-copied; set the option to false for the pre-4.14 fresh-snapshot-per-crossing behavior. Engine.Dispose() releases the ring.

Interop fast lanes. Single-candidate method calls run through a compiled invoker that binds and invokes without argument arrays or boxing (#​2733), with per-parameter binding flags precomputed (#​2719). Resolved ObjectWrapper members get a per-call-site inline cache (#​2722) and the member-call fast path covers primitive string receivers (#​2717). Array-like wrapper creation is a cached factory call with lazily materialized length (#​2730), primitive elements convert without boxing on both indexed reads and Array.prototype iteration (#​2731, #​2735), the wrapper identity caches cover CLR arrays (#​2716), and implicitly implemented interface methods are deduplicated in member resolution (#​2711).

JSON. JSON.parse interns property keys and string values within a parse, parses numbers off the span with an exactly-rounded fast path and scans string content in bulk (#​2718, #​2725, #​2732) — the json-parse-modern comparison row is 6% faster with 23% less allocation than 4.13.0. Parsing is also aligned with the JSON grammar (#​2738): malformed numbers like -09 and 1. are now rejected as in V8, while raw U+2028/U+2029 in strings and escaped control characters in keys — both valid JSON — are now accepted.

Strings. Chained slice/substring and split segments stay zero-copy views (#​2720), whole-string substring/substr return the receiver, and mismatched-length comparisons no longer materialize views (#​2740).

Execution constraints at host boundaries. Timeouts and cancellation are re-checked when control returns from host CLR code, so detection latency is bounded by one host call instead of a statement-count window, without adding per-statement cost — gated on execution depth so host-side reads of wrapped objects on an idle engine never observe a stale timer (#​2713, #​2714, #​2715). Execution-context depth stays balanced when constraint exceptions unwind generator/async frames, and a host callback that re-enters the engine no longer resets the outer script's budget (#​2736).

Correctness (including a pre-release review). A review of everything since 4.13.0 fixed: spurious TDZ when a for-header reads a name the loop body shadows (#​2709) and stale closure captures from destructuring defaults in for-loop headers (#​2739); the compiled-invoker lane now defers to custom ITypeConverters and preserves reflection exception types (#​2737); and the new wrapper defaults were hardened — declared-type contracts for arrays (an IReadOnlyList<T>-typed member no longer yields a writable view), a static type-mapper poisoning crash, Engine.Dispose releasing the wrapper caches, and JS-array in/enumeration/out-of-range semantics on array views (#​2735). Closure reads memoize slot-cache chain reachability (#​2726).

On the engine comparison benchmarks, Jint 4.14.0 beats ClearScript (native V8) by 7.1×–9.1× on every script ↔ host interop row — host collection traversal went from last to second among all engines at 15,597 → 1,433 µs with 99% less allocation — while remaining the fastest managed engine on 10 of 12 pure-JS scripts and the fastest interpreter on all 12, and now leading array-stress and dromaeo-object-array, rows V8 narrowly led at 4.13.0.

What's Changed

• Refresh EngineComparison benchmarks for 4.13.0 by @​lahma in Refresh EngineComparison benchmarks for 4.13.0 sebastienros/jint#2704
• Fix spurious TDZ when a for-header reads a name the loop body shadows by @​svenrog in Fix spurious TDZ when a for-header reads a name the loop body shadows sebastienros/jint#2709
• Bump the testing group with 1 update by @​dependabot[bot] in Bump the testing group with 1 update sebastienros/jint#2710
• Add tests for using modules from script code run via Evaluate by @​lahma in Add tests for using modules from script code run via Evaluate sebastienros/jint#2712
• Deduplicate implicitly implemented interface methods in member resolution by @​lahma in Deduplicate implicitly implemented interface methods in member resolution sebastienros/jint#2711
• Re-check amortized constraints at interpreter/host-code boundaries by @​lahma in Re-check amortized constraints at interpreter/host-code boundaries sebastienros/jint#2713
• Add ClearScript V8 to engine comparison benchmarks, trim suite, add script-to-host interop suite by @​viceice in Add ClearScript V8 to engine comparison benchmarks, trim suite, add script-to-host interop suite sebastienros/jint#1775
• Gate host-boundary constraint checks on active evaluation and harden coverage by @​lahma in Gate host-boundary constraint checks on active evaluation and harden coverage sebastienros/jint#2714
• Key the host-boundary constraint gate on execution depth and close remaining lanes by @​lahma in Key the host-boundary constraint gate on execution depth and close remaining lanes sebastienros/jint#2715
• Cover CLR arrays with the interop identity caches by @​lahma in Cover CLR arrays with the interop identity caches sebastienros/jint#2716
• Extend the member-call fast path to primitive string receivers by @​lahma in Extend the member-call fast path to primitive string receivers sebastienros/jint#2717
• Intern object property keys within a single JSON parse by @​lahma in Intern object property keys within a single JSON parse sebastienros/jint#2718
• Precompute per-parameter interop binding flags by @​lahma in Precompute per-parameter interop binding flags sebastienros/jint#2719
• Keep slice-of-slice and split segments zero-copy by @​lahma in Keep slice-of-slice and split segments zero-copy sebastienros/jint#2720
• Add opt-in ClrArrayConversion.LiveView interop mode for CLR arrays by @​lahma in Add opt-in ClrArrayConversion.LiveView interop mode for CLR arrays sebastienros/jint#2721
• Cache resolved ObjectWrapper members per member-expression node by @​lahma in Cache resolved ObjectWrapper members per member-expression node sebastienros/jint#2722
• Refresh engine comparison README after the V8-gap campaign by @​lahma in Refresh engine comparison README after the V8-gap campaign sebastienros/jint#2723
• Bulk string scanning and a simple-number fast path for JSON.parse by @​lahma in Bulk string scanning and a simple-number fast path for JSON.parse sebastienros/jint#2725
• Memoize slot-cache chain reachability for closure reads by @​lahma in Memoize slot-cache chain reachability for closure reads sebastienros/jint#2726
• Refresh engine comparison tables after the second campaign round by @​lahma in Refresh engine comparison tables after the second campaign round sebastienros/jint#2727
• Default Interop.ArrayConversion to LiveView for 4.14 by @​lahma in Default Interop.ArrayConversion to LiveView for 4.14 sebastienros/jint#2728
• Cache array-like wrapper factories and materialize length lazily by @​lahma in Cache array-like wrapper factories and materialize length lazily sebastienros/jint#2730
• Convert primitive array-like wrapper elements without boxing by @​lahma in Convert primitive array-like wrapper elements without boxing sebastienros/jint#2731
• Add a compiled-invoker fast lane for single-candidate interop method calls by @​lahma in Add a compiled-invoker fast lane for single-candidate interop method calls sebastienros/jint#2733
• Intern JSON.parse string values and parse numbers off the span by @​lahma in Intern JSON.parse string values and parse numbers off the span sebastienros/jint#2732
• Default Interop.CacheRecentObjectWrappers to true for 4.14 by @​lahma in Default Interop.CacheRecentObjectWrappers to true for 4.14 sebastienros/jint#2734
• Harden LiveView array wrappers and interop wrapper caches for 4.14 by @​lahma in Harden LiveView array wrappers and interop wrapper caches for 4.14 sebastienros/jint#2735
• Keep execution-context depth balanced under raw constraint exceptions by @​lahma in Keep execution-context depth balanced under raw constraint exceptions sebastienros/jint#2736
  ... (truncated)

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.Authentication.JwtBearer at 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.DataProtection.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.OpenApi at 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.Analyzers at 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

3.10.0-3.21201.20

Release

3.10.0-2.21153.36

Release

3.10.0-1.21102.26

Release

3.7.0-3.20312.3

Release Notes
Install Instructions

Repos

• Installer
• Windowsdesktop
• Runtime
• Aspnetcore
• templating
• SDK
• winforms
• WPF
• Extensions
• EF Core
• Roslyn
• Fsharp
• WebSDK

3.7.0-3.20269.11

Release Notes
Install Instructions

Repos

• Installer
• Windowsdesktop
• Runtime
• Aspnetcore
• templating
• SDK
• winforms
• WPF
• WCF
• Extensions
• EF Core
• Roslyn
• Fsharp
• MSBuild

3.7.0-2.20277.1

Release Notes
Install Instructions

Repos

• Windowsdesktop
• Runtime
• Aspnetcore
• templating
• SDK
• winforms
• WPF
• ASPNETCORE-Tooling
• Extensions
• EF Core
• Roslyn
• Fsharp

3.6.0

Release Notes
Install Instructions

• Installer
• Windowsdesktop
• Runtime
• Aspnetcore
• templating
• SDK
• winforms
• WPF
• WCF
• standard
• blazor
• ASPNETCORE-Tooling
• EF Core
• Extensions
• roslyn
• fsharp
• WebSDK

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.Analyzers at 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.CSharp at 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.PublicApiAnalyzers from 4.14.0 to 5.6.0.

Release notes

Sourced from Microsoft.CodeAnalysis.PublicApiAnalyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

• Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) by @​nohwnd in Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) microsoft/vstest#16281

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

• Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @​nohwnd in feat: migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) microsoft/vstest#15687
  • For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/
• Create source-only filter package by @​Youssef1313 in Create source-only filter package microsoft/vstest#15638
• Add ARM64 msdia140.dll support to test platform packages by @​nohwnd in Cherry-pick: Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15692
• Fix mutex cleanup crash on macOS/Linux by @​nohwnd in Fix mutex cleanup crash on macOS/Linux microsoft/vstest#15684
• Restrict artifact temp directory permissions on Unix by @​nohwnd in Restrict artifact temp directory permissions on Unix microsoft/vstest#15729
• Add support for filtering uncategorized tests with TestCategory=None by @​Evangelink in Add support for filtering uncategorized tests with TestCategory=None microsoft/vstest#15727
• Fix SCI binding failure in DTA hosts (main) by @​nohwnd in Fix SCI binding failure in DTA hosts (main) microsoft/vstest#15724
• Fix HTML logger parallel file collision by @​nohwnd in [fix] Fix HTML logger parallel file collision microsoft/vstest#15435
• Improve error message when testhost cannot be found by @​nohwnd in [fix] Improve error message when testhost cannot be found microsoft/vstest#16053
• Fix HTML logger exception on invalid XML chars in test display names by @​nohwnd in [fix] Fix HTML logger exception on invalid XML chars in test display names microsoft/vstest#16051

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

Commits viewable in compare view.

Pinned Microsoft.OpenApi at 3.9.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
• library: support schema keywords on references (434b2f8)
• library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
• handling of nullable enums for 3.0 (#​2920) (beb68f5)
• library: keep v3 schema references ref-only (c938727)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
• use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (78475e3)
• add contains/minContains/maxContains members (1a974f8)
• library: add missing json schema properties (9b1aed6)
• library: add missing json schema properties (82f84e0)

Bug Fixes

• library: always copy unevaluated properties (4907d1c)
• library: avoid false circular refs for external schema re-exports (b635242)
• library: avoid false circular refs for external schema re-exports (7a443c2)
• library: remove unshipped schema extension fallback (cf54bb3)
• library: use version-specific schema keyword callbacks (6e22ec6)
• library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (9b4f45b)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

• reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

• library: handle circular schema references (b3cd42b)
• library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (f97f91a)
• null reference exception for boolean component schemas (fe0b50a)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

• schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
• hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

• library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
• double encoding of json pointer for invalid reference rule (b246cd0)
• encoding of special characters for JSON paths (4c757e1)
• library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
• library: do not emit unevaluatedProperties for non-object schemas (19538aa)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
• potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
• library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
• securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

• implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
• library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
• library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

• models: add shared Content interface (#​2695) (338566f)

Bug Fixes

• broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

• models: add shared Content interface (9e13b25)
• models: add shared Content interface (#​2695) (9e13b25)
• models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

• hidi validate command now logs warnings (76a3c0f)
• hidi validate command now logs warnings (62e7d56)

Bug Fixes

• discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
• discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

• Support custom tag ordering (008576c)
• Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

• correct error pointer when extension parser throws OpenApiException (43c75a9)
• wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

• schema: always serialize additionalProperties: false (6651c36)
• schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

• Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

• load JSON documents that are preceded by multiple whitespace (6461bac)
• non-seekable json streams would fail to load as a document (2436d73)
• reading streams in an asp.net context would cause async exceptions (f9e5248)

3.0.2

3.0.2 (2025-12-08)

Bug Fixes

• additional properties serialization should not emit a schema in v2 (946cba9)
• additional properties serialization should not emit booleans in v3.1+ (946cba9)

3.0.1

3.0.1 (2025-11-17)

Bug Fixes

• empty strings should be quoted in yaml (8d215f9)
• empty strings should be quoted in yaml (0ca10db)

3.0.0

3.0.0 (2025-11-11)

⚠ BREAKING CHANGES

• adds support for OpenAPI 3.2.0

Note: Please refer to the upgrade guide for a detailed description of the breaking changes.

Note: ASP.net users should remain on version 1.X for ASP.net < 10, and version 2.X for ASP.net 10, this new major version will be implemented in a future version of ASP.net, more information

Features

• adds support for OpenAPI 3.2.0 (765a8dd)

Special thanks

• Matthieu Costabello

2.11.0

2.11.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (557bd6a)
• adds support for anchor and id external resolution (4138e47)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (baf8428)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (a139f83)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (6091f5a)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (a8688dc)

Bug Fixes

• adds explicit error message for invalid json pointers (#​2955) (a304e56)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (a8787af)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (e08570f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (bc11356)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (310b6e2)

Commits viewable in compare view.

Pinned ModelContextProtocol.AspNetCore at 2.1.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

• Keep AutoDetect channel open after provisional SSE failure #​1768 by @​PranavSenthilnathan
• Preserve HTTP status codes across target frameworks #​1767 by @​PranavSenthilnathan
• Fall back to initialize when server/discover fails at the HTTP layer #​1766 by @​rbstp
• Add public subscriptions/listen server handler (SEP-2575) #​1775 by @​tarekgh

Documentation Updates

• Add README for the InMemoryTransport sample #​1769 by @​AkbarDizaji
• Add Application Insights telemetry example #​1778 by @​lntutor
• Clarify client handling of embedded binary tool resources #​1762 by @​luisangelrod

Test Improvements

• Speed up CLI argument escaping tests #​1773 by @​PranavSenthilnathan

Repository Infrastructure Updates

• Clarify AI disclosure format with a > [!NOTE] alert example #​1771 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Bump the npm_and_yarn group across 1 directory with 6 updates #​1787
• Avoid reading Configuration in Directory.Build.props #​1776 by @​lntutor
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #​1784

Acknowledgements

• @​AkbarDizaji made their first contribution in #​1769
• @​luisangelrod made their first contribution in #​1762
• @​rbstp submitted issue #​1765 (resolved by #​1766)
• @​TomasHubelbauer submitted issue #​1026 (resolved by #​1778)
• @​Youssef1313 submitted issue #​995 (resolved by #​1766)
• @​eng-marani submitted issue #​1261 (resolved by #​1762)
• @​jeffhandley @​tarekgh @​halter73 @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

2.0.0

Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking-change policies.

1. Default to stateless HTTP and discovery-first negotiation #​1610
   • HttpServerTransportOptions.Stateless now defaults to true. Stateless servers do not create transport sessions, expose the standalone SSE GET/DELETE endpoints, or support unsolicited server-to-client requests.
   • Set Stateless = false when an existing server requires legacy stateful behavior. Stateful-only options now produce MCP9006 warnings and apply only to down-level initialize-handshake connections.
   • Clients probe server/discover first and automatically fall back to the legacy initialize handshake for down-level servers.
2. Deprecate Roots, Sampling, and Logging APIs #​1651
   • The stable Roots, Sampling, and Logging API surfaces now produce MCP9005 warnings because these features are deprecated by the 2026-07-28 specification.
   • Existing down-level connections can continue using these APIs. Suppress MCP9005 temporarily if continued use is required while planning migration.
3. Move Tasks into ModelContextProtocol.Extensions.Tasks #​1693
   • The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
   • Add a reference to ModelContextProtocol.Extensions.Tasks, import its namespace, register Tasks with WithTasks(...), and replace Core RequestMethods.Tasks* constants with TasksProtocol members.
4. Strengthen OAuth callback and issuer validation #​1605
   • AuthorizationRedirectDelegate and ClientOAuthOptions.AuthorizationRedirectDelegate now produce MCP9007 warnings. Migrate to ClientOAuthOptions.AuthorizationCallbackHandler so callbacks can return the authorization code, state, and issuer.
   • OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather t...

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.