Skip to content

Bump Aspire.Hosting.AppHost and 19 others - #3

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Aspire/minor-and-patch-ec5921877f
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Aspire/minor-and-patch-ec5921877f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •

Copy link
Copy Markdown

Updated Aspire.Hosting.AppHost from 13.6.2 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Aspire.Hosting.MongoDB from 13.6.2 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.MongoDB's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Aspire.Hosting.RabbitMQ from 13.6.2 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.RabbitMQ's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.6.2 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Dapr.AspNetCore from 1.18.10 to 1.19.0.

Release notes

Sourced from Dapr.AspNetCore's releases.

1.19.0

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0

1.19.0-rc.6

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.6

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.4...v1.19.0-rc.6

1.19.0-rc.4

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.3...v1.19.0-rc.4

1.19.0-rc.3

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.2...v1.19.0-rc.3

1.19.0-rc.2

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.1...v1.19.0-rc.2

1.19.0-rc.1

What's Changed

Support for Dapr Runtime changes ahead of v1.19:

General Improvements

Bug Fixes

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.1

1.19.0-preview.2

Dapr.Actors.Next is a ground-up re-implementation of the Dapr Actors building block for .NET, shipping as a preview throughout the 1.18 release cycle, with a stable release planned alongside Dapr runtime v1.19. The actor model itself is unchanged: actors remain virtual, addressed by type and ID, and support reentrancy, timers, reminders, proxying, etc. However, the way the SDK connects to the runtime and the way you write actor code have been modernized.

Highlights

  • Streaming runtime connectivity
    Actor callbacks (invoke, reminder, timer, deactivate) now arrive over a long-lived bidirectional gRPC stream instead of inbound, per-call HTTP requests into mapped actor-handler endpoints. This is the same pattern already used for Dapr workflows and streaming pub/sub subscriptions. There are no actor handlers to map, though your app will still need to expose a port for inbound gRPC connections from the Dapr runtime.
  • No reflection, trim-clean and AOT-ready
    Source generators produce the proxy, dispatcher, activation factory, registration and actor registry from your interface and implementation. Actors are discovered rather than registered by hand, and the runtime packages can be used in applications building for Native AOT.
  • Compile-time safety
    The public surface is annotated for nullable reference types, and new analyzers and code fixes catch actor-specific mistakes as you type: non-serializable or non-task-returning methods, blocking calls inside a turn, state changes that would break deserialization, using a callback method in a reminder that doesn't exist in the specified type, reading time from the clock instead of an injected TimeProvider, and more!
  • Consistent with the rest of the modern Dapr .NET SDK packages
    This release features per-activation DI scopes, use of the options pattern (IOptions<DaprActorsOptions>), and the same pluggable IDaprSerializer (System.Text.Json by default) used by Dapr.StateManagement and Dapr.Workflow.
  • New capabilities
    State-envelope schema versioning with upcaster chains, a first-class StateMachineActor<TState, TData> model, pub/sub-driven actors via [Subscribe] applied to the method to call instead of requiring external startup subscription and invocation, dynamic invocation by type/id/method with no compile-time contract, and an in-memory deterministic test runtime with optional Coyote integration.

Performance
Replacing the reflection-based proxy and dispatch machinery with source generators shows up directly in the numbers. In our benchmarks, creating an actor proxy drops from roughly 725 ns and 3.4 KB allocated under Dapr.Actors to about 14 ns and 48 B under Dapr.Actors.Next: a ~50x improvement in time and ~70x in allocation. A warm actor call is about 20% faster (≈484 ns -> ≈375 ns) and allocates roughly 30% less (1,264 B -> 912 B). The largest end-to-end win is in startup: building the provider, resolving the actor runtime, and dispatching the first call takes ~284 µs under Dapr.Actors versus ~37 µs under Dapr.Actors.Next, an ~8x reduction that holds steady as the number of registered actor types grows because registration and dispatch are generated at compile time rather than discovered and emitted on first use. Container construction itself is marginally more expensive on the new SDK (~6.0 µs vs ~4.7 µs) as more is wired up front, but that cost is repaid many times over on the first invocation.

We expect further optimizations before the 1.19 GA.

Benchmarks run with BenchmarkDotNet; figures are means from a single machine and are indicative rather than a guarantee. Feel free to run them yourself from here.

Compatibility notes

  • This package requires the Dapr runtime v1.18 or later.
  • This package is not API compatible with the original Dapr.Actors. Because actors are addressed by the same type names, you can migrate one actor type at a time, but it's easier to do that across separate projects than to mix both SDKs in one.
  • Serialization is a clean break: there's a single serialization path and no built-in DataContract support (supply and register your own implementation of IDaprSerializer if you need it). Verify that existing persisted state still deserializes before migrating a type.
  • Dapr.Actors and its associated packages are now in maintenance mode and will receive security and bug fixes only. No deprecation date has been set.

Getting started
Add the package to your project:

dotnet add package Dapr.Actors.Next --prerelease

Then register it in DI with builder.Services.AddDaprActors().

Documentation is available along with a six-part tutorial spanning different implementation examples.

Please reach out in the .NET channel on Discord or file an issue if you encounter problems, have feature suggestions, or just want to share feedback about this new functionality!

Commits viewable in compare view.

Updated Hangfire.Mongo from 1.16.3 to 1.17.0.

Release notes

Sourced from Hangfire.Mongo's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Build.Tasks.Core from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.Build.Tasks.Core's releases.

18.11.0

What's Changed

Commits viewable in compare view.

Pinned Microsoft.Extensions.Http.Resilience at 10.11.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Pinned Microsoft.Extensions.ServiceDiscovery at 10.11.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery.Yarp from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery.Yarp's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Pinned MongoDB.Bson at 2.30.0.

Release notes

Sourced from MongoDB.Bson's releases.

2.30.0

This is the general availability release for the 2.30.0 version of the driver. Version 2.30.0 of the driver is the last scheduled 2.x release. Further driver development will continue in 3.x versions.

Version 2.30.0 does not introduce new features or bug fixes. The single purpose of 2.30 is to ease the migration to 3.x by marking the public API that was removed in 3.0 as obsolete.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.29.0

This is the general availability release for the 2.29.0 version of the driver.

Version 2.29.0 of the driver has been tested against MongoDB Server version 8.0 and adds support for the following new features in server version 8.0:

  • Support for v2 of the Queryable Encryption range protocol - CSHARP-4959
  • Range indexes for Queryable Encryption are now GA - CSHARP-5057

The following server 8.0 features are not yet supported and will be supported in a later release of the driver:

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.28.0

This is the general availability release for the 2.28.0 version of the driver.

NOTICE: MongoDB 3.6 reached end-of-life in April 2021. The .NET/C# Driver will be removing support for MongoDB 3.6 in an upcoming release.

The main new features in 2.28.0 include:

  • Provide Strong-Named Assemblies - CSHARP-1276
  • Support additional numeric conversions involving Nullable - CSHARP-5180
  • CSFLE/QE KMIP support "delegated" protocol - CSHARP-4941

Bug fixes:

  • Verify that operands to numeric operators in LINQ expressions are represented as numbers on the server - CSHARP-4985
  • IReadOnlyDictionary indexer access fails to translate in v3 - CSHARP-5171
  • Projection Expressions Fail to Deserialize Data Correctly - CSHARP-5162
  • Enum conversion within IQueryable fails with Expression not supported exception - CSHARP-5043
  • IMongoCollection.AsQueryable().Select() fails for array type (regression) - CSHARP-4957

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.27.0

This is the general availability release for the 2.27.0 version of the driver.

The main new features in 2.27.0 include:

  • Support $sample aggregation operator - CSHARP-2659
  • Implement Equals method for serializers in LINQ3 - CSHARP-3315
  • Avoid Appending Write/Read Concern in Atlas Search Index Helper Commands - CSHARP-4839
  • Disallow comma character in authMechanismProperties connection string value - CSHARP-5106
  • Fix translation issue during serialization of numbers with differing sizes - CSHARP-5163
  • Support Linux distros using libdl.so.2 CSHARP-4889
  • Multiple bug fixes and improvements.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.26.0

This is the general availability release for the 2.26.0 version of the driver.

The main new features in 2.26.0 include:

  • Support SelectMany inside Project/Select - CSHARP-5081
  • Support Dictionary.ContainsValue in LINQ queries - CSHARP-2509
  • Support string concatenation of mixed types - CSHARP-5071
  • Enable use of native crypto in libmongocrypt bindings - CSHARP-4944
  • Support serialization of Memory and ReadOnlyMemory structs - CSHARP-4807
  • OIDC: support for GCP Identity Provider - CSHARP-4610
  • Implement signing of NuGet packages - CSHARP-5050
  • Direct read/write retries to another mongos if possible - CSHARP-3757
  • Multiple bug fixes and improvements.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.25.0

This is the general availability release for the 2.25.0 version of the driver.

NOTICE: MongoDB 3.6 reached end-of-life in April 2021. The .NET/C# Driver will be removing support for MongoDB 3.6 in an upcoming release.

The main new features in 2.25.0 include:

  • Support of MONGODB-OIDC Authentication mechanism - CSHARP-4448
  • MONGODB-OIDC: Automatic token acquisition for Azure Identity Provider - CSHARP-4474
  • Improved error message when no matching constructor found - CSHARP-5007
  • Driver Container and Kubernetes Awareness - CSHARP-4718
  • Logging of executed MQL for a LINQ query - CSHARP-4684
  • Allow custom service names with srvServiceName URI option - CSHARP-3745
  • BulkWrite enumerates requests argument only once - CSHARP-1378
  • Support of Range Explicit Encryption - CSHARP-5009
  • Multiple bug fixes and improvements.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.24.0

.NET Driver Version 2.24.0 Release Notes

This is the general availability release for the 2.24.0 version of the driver.

The main new features in 2.24.0 include:

  • New DistinctMany method in IMongoCollection
  • Support for latest $dateFromString optional arguments
  • ExceededTimeLimit server error is now retryable for reads as well as writes
  • Support sort by score in $search stage
  • New custom method to test if a field exists or is missing in LINQ (Mql.Exists, Mql.IsMissing, Mql.IsNullOrMissing)
  • Enable TLS 1.3 support
  • Fix a GridFS error when attempting to upload a GridFS file with a duplicate id and the new file is smaller than the original file
  • Add support for Atlas Search $in operator
  • Add support for IComparable CompareTo method in LINQ queries
  • Add VectorSearchScore builder for $vectorSearch stage
  • Update libmongocrypt package version
  • Support for nested AsQueryable in LINQ queries (not a common use case but legal, primarily added for use by the EF Core Provider)
  • Updated authentication to occur over OP_MSG on supporting servers to improve MongoDB Atlas Serverless compatibility
  • Use polling monitoring when running within a FaaS environment such as AWS Lambda
  • Fixed segfault in Kerberos (libgssapi) on newer Linux distros

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.23.2

This is a patch release that addresses some issues reported since 2.23.1 was released.

An online version of these release notes is available here.

The list of JIRA tickets resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Upgrading

There are no known backwards breaking changes in this release.

2.23.1

This is a patch release that addresses some issues reported since 2.23.0 was released.

An online version of these release notes is available here.

The list of JIRA tickets resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Upgrading

There are no known backwards breaking changes in this release.

2.23.0

This is the general availability release for the 2.23.0 version of the driver.

The main new features in 2.23.0 include:

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.22.0

.NET Driver Version 2.22.0 Release Notes

This is the general availability release for the 2.22.0 version of the driver.

The main new features in 2.22.0 include:

  • LINQ3 bug fixes and improvements
  • Support for $set aggregation stage
  • Added synonym support for Atlas Search
  • Support for $vectorSearch aggregation stage
  • Reduced memory allocations when using encryption
  • Additional logging messages

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.21.0

.NET Driver Version 2.21.0 Release Notes

This is the general availability release for the 2.21.0 version of the driver.

The main new features in 2.21.0 include:

  • LINQ3 bug fixes and improvements
  • Atlas Search sort, tracking, score details options added
  • Atlas Search embeddedDocuments operator support
  • Atlas Search index mangement API added
  • Anonymous types added to default AllowedTypes in ObjectSerializer

Atlas Search minor breaking change

All Render methods in Atlas Search builders have a new signature:

Render(IBsonSerializer<TDocument> documentSerializer, IBsonSerializerRegistry serializerRegistry)

Changed to

Render(SearchDefinitionRenderContext<TDocument> renderContext)

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.20.0

.NET Driver Version 2.20.0 Release Notes

This is the general availability release for the 2.20.0 version of the driver.

The main new features in 2.20.0 include:

  • Support for MongoDB server version 7.0.0
  • Support for equality query types in Queryable Encryption GA
  • LINQ3 bug fixes and improvements
  • Serialization bug fixes and improvements
  • Logging improvements

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.19.2

.NET Driver Version 2.19.2 Release Notes

This is a patch release that addresses some issues reported since 2.19.1 was released.

An online version of these release notes is available here.

The list of JIRA tickets resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Upgrading

There are no known backwards breaking changes in this release.

2.19.1

.NET Driver Version 2.19.1 Release Notes

This is a patch release that addresses some issues reported since 2.19.0 was released.

An online version of these release notes is available here.

The list of JIRA tickets resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Upgrading

There are no known backwards breaking changes in this release.

Commits viewable in compare view.

Pinned MongoDB.Bson at 3.13.0.

Release notes

Sourced from MongoDB.Bson's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

  • CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
    • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
  • CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
    • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
  • CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
    • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
  • CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
    • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
  • CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
  • CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
    • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
  • CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
    • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
  • CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
    • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
  • CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
    • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
  • CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
    • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
  • CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
    • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

  • CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

  • CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
  • CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
  • CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

  • CSHARP-6225: Latest server binary downloads require private S3
  • CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.12.0

This is the general availability release for the 3.12.0 version of the driver.

The main new features in 3.12.0 include:

  • CSHARP-6214: Implement srvAllowedHostsSuffix URI option

Fixes:

  • CSHARP-6223: Fix client-side projection crash on member-init projections

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.2

[!IMPORTANT]
This is a security patch release. It addresses two CVEs reported against the driver, along with a small number of related fixes. There are no public API changes and no application code changes are required to upgrade. Note that the shape of some queries generated by the LINQ provider and by GridFS has changed — see the individual tickets below.

This is a patch release that contains fixes and stability improvements:

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.1

[!IMPORTANT]
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.

This is a patch release that contains fixes and stability improvements:

  • CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
  • [CSHARP-6171](h...

Description has been truncated

Bumps Aspire.Hosting.AppHost from 13.6.2 to 13.6.3
Bumps Aspire.Hosting.MongoDB from 13.6.2 to 13.6.3
Bumps Aspire.Hosting.RabbitMQ from 13.6.2 to 13.6.3
Bumps Aspire.Hosting.Redis from 13.6.2 to 13.6.3
Bumps Dapr.AspNetCore from 1.18.10 to 1.19.0
Bumps Hangfire.Mongo from 1.16.3 to 1.17.0
Bumps Microsoft.Build.Tasks.Core from 18.10.1 to 18.11.0
Bumps Microsoft.Extensions.Http.Resilience from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.ServiceDiscovery.Yarp from 10.10.0 to 10.11.0
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps MongoDB.Bson to 2.30.0, 3.13.0
Bumps MongoDB.Driver to 3.13.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.20.1
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.19.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Http from 1.19.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Runtime from 1.19.0 to 1.20.1
Bumps SharpCompress from 0.48.1 to 0.50.7
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1

---
updated-dependencies:
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.MongoDB
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.RabbitMQ
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.Redis
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Dapr.AspNetCore
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Hangfire.Mongo
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Build.Tasks.Core
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ServiceDiscovery.Yarp
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SharpCompress
  dependency-version: 0.50.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Author

Superseded by #4.

@dependabot dependabot Bot closed this Oct 23, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/Aspire/minor-and-patch-ec5921877f branch October 23, 2026 18:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants