Bump dbup-sqlserver and 5 others

[dependabot]

Updated dbup-sqlserver from 5.0.40 to 7.2.0.

Release notes

Sourced from dbup-sqlserver's releases.

7.2.0

What's Changed

• Accept a Func instead of a pre-created connection by @​droyad in Accept a Func<SqlConnection> instead of a pre-created connection DbUp/dbup-sqlserver#34

Full Changelog: DbUp/dbup-sqlserver@7.1.0...7.2.0

7.1.0

What's Changed

• Breaking Change (only due to third party major version bump) Update Microsoft.Data.SqlClient from 5.2.2 to 6.1.2 by @​droyad in Update Microsoft.Data.SqlClient from 5.2.2 to 6.1.2 DbUp/dbup-sqlserver#27
• Allow use of an existing SQL Connection by @​droyad in Allow use of an existing SQL Connection DbUp/dbup-sqlserver#31
• Updated DbUp to 6.1.1 and patches to other libraries by @​droyad in Updated DbUp to 6.1.1 and patches to other libraries DbUp/dbup-sqlserver#30

Full Changelog: DbUp/dbup-sqlserver@6.0.16...7.1.0

6.0.16

What's Changed

• Use GenerateDocumentationFile to expose doc comments to package consumers by @​Bartleby2718 in Use GenerateDocumentationFile to expose doc comments to package consumers DbUp/dbup-sqlserver#25
• dbup-core v6.0.15 update by @​droyad in dbup-core v6.0.15 update DbUp/dbup-sqlserver#28

New Contributors

• @​Bartleby2718 made their first contribution in Use GenerateDocumentationFile to expose doc comments to package consumers DbUp/dbup-sqlserver#25

dbup-core changes: https://github.com/DbUp/DbUp/releases/tag/6.0.15
Full Changelog: DbUp/dbup-sqlserver@6.0.0...6.0.16

6.0.0

Breaking Changes

• Updated DbUp Core to 6.0.0, see https://dbup.readthedocs.io/en/latest/breaking-changes/ for full details
  • LibLog has been replaced by the standard .NET ILogger abstraction
    • The Autodetect logger feature provided by LibLog is removed
    • MultipleUpgradeLog has been replaced with AggregateLog
    • IUpgradeLogger still exists but method names have changed from Write* to Log* to match Microsoft's ILogger interface
  • Scripts with ScriptType.RunAlways will no longer be journaled
  • Only netstandard2.0 compatible frameworks are supported

• Update Azure SQL Authentication to use Azure.Identity by @​evochriso in Update Azure SQL Authentication to use Azure.Identity DbUp/dbup-sqlserver#14
• Replaced System.Data.SqlClient with Microsoft.Data.SqlClient

What's Else Has Changed

• Allow custom DB creation script to be passed by @​droyad in Allow custom DB creation script to be passed DbUp/dbup-sqlserver#20

New Contributors

• @​evochriso made their first contribution in Update Azure SQL Authentication to use Azure.Identity DbUp/dbup-sqlserver#14

Full Changelog: DbUp/dbup-sqlserver@5.0.41...6.0.0

6.0.0-beta.21

Full Changelog: DbUp/dbup-sqlserver@6.0.0-beta.9...6.0.0-beta.21

6.0.0-beta.9

What's Changed

• Updated DbUp Core to 6.0.0 by @​droyad in Updated DbUp Core to 6.0.0 DbUp/dbup-sqlserver#17

Full Changelog: https://github.com/DbUp/dbup-sqlserver/commits/6.0.0-beta.9

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.10 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 7.0.2 to 7.1.1.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.1.1

This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.

Package version alignment: The SqlClient family packages share the 7.1.1 version:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

Microsoft.SqlServer.Server is versioned independently and is not part of this release. Applications should use matching 7.1.1 versions of the driver and its companion packages. The aligned assemblies retain AssemblyVersion 7.0.0.0; upgrading from 7.1.0 does not require new .NET Framework strong-name binding redirects.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.1
• Microsoft.Data.SqlClient.Extensions.Azure 7.1.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1

Changes Since 7.1.0

Fixed

• Fixed an ArgumentException when sending zero-valued decimal or SqlDecimal parameters whose precision equals their scale. Nonzero precision validation and support for large decimal values are unchanged. (#​4715, #​4721, #​4732)

• Fixed connection pool V2 handing out pooled connections with expired or nearly expired access tokens. The pool now checks token expiry before reuse, matching the default pool's behavior while preserving transaction-affine reuse. This affects only applications that opt in to connection pool V2. (#​4734, #​4739)

• Fixed connection opens failing when ClearPool or ClearAllPools races with an in-flight open. Requests already admitted to the cleared pool can finish, and connections returned to the retired pool are discarded rather than reused. (#​4714, #​4718, #​4740)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.18
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 9.0.18
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.18
• System.Security.Cryptography.Pkcs 9.0.18
• System.Threading.RateLimiting 9.0.18

... (truncated)

7.1.0

This is the general availability release of Microsoft.Data.SqlClient 7.1. It closes out the 7.1 preview cycle with application identity reporting for telemetry, the deprecation of TransparentNetworkIPResolution, and a set of connection, transaction, and Named Pipes fixes.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The 7.1.0 GA release continues this alignment; the following packages ship together as 7.1.0:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0 when upgrading Microsoft.Data.SqlClient to 7.1.0.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2, 7.0.3, or any 7.1 preview to 7.1.0 does not require any new .NET Framework strong-name binding redirects. Applications upgrading from 7.0.0 or 7.0.1 should note that Extensions.Azure, Extensions.Abstractions, and Internal.Logging raised their AssemblyVersion from 1.0.0.0 to 7.0.0.0 in 7.0.2; see those release notes for the one-time .NET Framework impact.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0
• Microsoft.Data.SqlClient.Extensions.Azure 7.1.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

What Changed:

• Added a RegisteredApplication enum and a matching SqlConnection.RegisteredApplication property that let a library or tool identify itself to SQL Server through version 2 of the TDS USERAGENT feature extension. The payload also carries a new driver-owned 64-bit Driver Properties flag field; bit 0 reports whether connection pool V2 is enabled for the process. Both fields are emitted as unpadded uppercase hexadecimal. (#​3201, #​4632)

Who Benefits:

• Middleware and tooling built on top of the driver — Entity Framework Core, Semantic Kernel, SQL Server Management Studio, SqlPackage, Data API Builder, and similar — can be distinguished in server-side telemetry without the driver accepting arbitrary user-supplied user-agent text. This originated as a request from the Entity Framework Core team.
• Service operators gain a more accurate picture of which client stacks are connecting, which helps when diagnosing workload-specific behavior.

Impact:

• Purely additive from the application's perspective: a newly created physical connection whose RegisteredApplication is unset reports Unknown (0). On the wire the field itself is new — USERAGENT payload v1 carried no application identifier, while v2 always emits one.
• Set the property before calling Open or OpenAsync. Assigning it while the connection is connecting or open throws InvalidOperationException.

using var connection = new SqlConnection(connectionString);
connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore;
await connection.OpenAsync();

• The enum is ushort-backed and marked [CLSCompliant(false)]. Values are partitioned by range: 0x0001–0x7FFF for Microsoft-defined large-scale applications, 0x8000–0xBFFF for small-scale use, and 0xC000–0xFFFF for public/developer use. Applications that are not yet registered can cast an unassigned value from the appropriate range.
  ... (truncated)

7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview3

Added

• Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#​3672, #​3673)
• Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
  • Transaction support (#​4487)
  • Broken-connection replacement during command execution (#​4429)
  • Background warmup to Min Pool Size and automatic replenishment (#​4452)
  • Idle pruning driven by Connection Idle Timeout (#​4463)
  • Optional ConcurrencyLimiter rate limiting for new physical connections (#​4395, #​4396)
  • Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#​4529)
  • Metrics and tracing parity with the default pool (#​4504)

Changed

• Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#​4207, #​4239, #​4465, #​4474)
• Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#​4536)
• SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #​3677 (#​4535)
• No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#​4528)
• net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#​4507)
• Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#​4564)

Fixed

• Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#​4532)
• SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#​1881, #​4479)
• Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#​4504)
• OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#​1655, #​4443)
• TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#​3953, #​4294)
• DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#​3934, #​4439)
• ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#​4445)
• SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#​4520)
• Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#​4437)
• Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS endpoint. Ships in Microsoft.Data.SqlClient.Extensions.Azure (#​4496, #​4521)

Full details: release-notes/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3

Added

• SqlColumnEncryptionAzureKeyVaultProvider overrides the four asynchronous key store provider methods introduced in #​3673, calling the Azure SDK's own async APIs and flowing the supplied CancellationToken (#​4540)
• Concurrent cache misses for the same key collapse into a single Key Vault request. The gate is only awaited, so no thread blocks, and misses for different keys still proceed in parallel (#​4540)
  ... (truncated)

7.1.0-preview2

This update brings the following changes since the 7.1.0-preview1 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview2. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview2 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview2 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview2

Added

• SqlConnection.GetSchemaAsync overloads with CancellationToken support (#​3005)
• SQL Graph pseudo-column aliases ($node_id, $edge_id, $from_id, $to_id) accepted in SqlBulkCopy mappings (#​3677)
• SqlBatchCommand.CommandBehavior and SqlBatch.ExecuteReader(CommandBehavior) are now honored (#​4125)
• Configurable idle connection timeout via Connection Idle Timeout / SqlConnectionStringBuilder.IdleTimeout (opt-in via Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior=false) (#​4295)

Changed

• Connect Timeout now propagates through the pool when Switch.Microsoft.Data.SqlClient.UseOverallConnectTimeoutForPoolWait=true is set (default off; introduces a Microsoft.Bcl.TimeProvider dependency) (#​4270)
• SQL Server 2025 json type added to the DataTypes collection returned by SqlConnection.GetSchema (#​3858)
• Internal state-machine hardening via Interlocked.CompareExchange guards (#​4267)
• Internal cleanup of connection-options inheritance and related pool interfaces (#​4237, #​4261, #​4235, #​4415, #​4334)
• LCID hardcoded mappings to avoid repeated culture lookups (#​4212)
• Allocation reductions on SqlErrorCollection and null-return paths (#​4157, #​4099, #​4102)
• Improved EnclaveDiffieHellmanInfo.Size accuracy (#​4346)
• SqlVector<float> serialization is now explicitly little-endian for cross-architecture consistency (#​3861)
• Bundled .NET 10 SDK updated to 10.0.300 (#​4287)

Fixed

• NullReferenceException in SqlCommand.Cancel() when the connection has already been torn down (#​4372)
• Always Encrypted CMK signature verification incorrectly reusing cached results after a prior failure (#​4339)
• Missing TDS token / feature-ack length bounds checks (spoofing server could trigger unbounded allocations) (#​4340)
• SqlBulkCopy failing in least-privilege environments (#​4306)
• Always Encrypted CekMdVersion / EkValueCount reads aligned with the TDS specification (#​4240)
• LoginWithFailover parser-state validation (#​4140)
• SPN during login now uses the resolved port instead of instance name for Protocol=None / Protocol=Admin (#​4180)
• Race in SqlConnection.TryOpenInner that could surface as InvalidCastException now returns a deterministic InvalidOperationException (#​4179)
• Multiple CancellationTokenSource leaks in SqlDataReader, SqlConnection, SqlCommand reconnect paths, and sequential-stream helpers (#​4009)
• Docs fix for server certificate configuration (#​4408)

Removed (breaking)

• SQL Server 7.0 / 2000 code paths removed; Type System Version=SQL Server 2000 now throws ArgumentException at open. Applications should switch to Latest (or another supported value). No change to server-version support — 7.0 / 2000 were already rejected during login version negotiation. (#​4015)

Full details: release-notes/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview2

Added — WAM (Windows Account Manager) broker support for Entra ID authentication (Windows only) (#​4288, #​4388)

• Covers ActiveDirectoryIntegrated, ActiveDirectoryInteractive, ActiveDirectoryDeviceCodeFlow, and the deprecated ActiveDirectoryPassword modes.
  ... (truncated)

7.1.0-preview1

This update brings the following changes since the 7.0.0 release:

Added

SqlBatch Support on .NET Framework

What Changed:

• Added SqlBatch and related batch-command support for the .NET Framework target so the batching API is now available across the full supported platform matrix, including net462. (#​3926)

Who Benefits:

• Applications that target .NET Framework but also want to use the newer batching APIs no longer need a separate implementation strategy from .NET 8/9 applications.
• Libraries that multi-target .NET Framework and modern .NET can use a more consistent data-access surface area.

Impact:

• SqlBatch, SqlBatchCommand, and the related execution methods are now usable on .NET Framework builds in addition to .NET.

Cross-Driver Connection-String Synonym Alignment

What Changed:

• Added additional accepted connection-string synonyms for better compatibility with other SQL Server drivers and existing connection-string conventions. Newly accepted synonyms include ColumnEncryption, ConnectTimeout, FailoverPartner, PacketSize, and WorkstationId. (#​4192)

Who Benefits:

• Applications migrating connection strings from other SQL Server drivers or shared infrastructure can reuse more existing keywords without rewriting them first.

Impact:

• Existing canonical keywords continue to work unchanged; this preview simply accepts more equivalent aliases during parsing.

Changed

Type Forwards for Authentication Abstractions

What Changed:

• Added type forwards from the core Microsoft.Data.SqlClient assembly to public authentication-related types that were moved into Microsoft.Data.SqlClient.Extensions.Abstractions, including SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. (#​4067, #​4117)

Who Benefits:

• Applications and libraries compiled against earlier package layouts retain binary compatibility when those authentication types are resolved from the core assembly name.

Impact:

• No application code changes are required; the type forwards preserve existing compiled references.

User Agent Feature Extension Enabled by Default

... (truncated)

7.0.3

This update brings the following changes since the 7.0.2 release:

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
• Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#​4370, #​4306, #​4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#​4528, #​4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#​4520, #​4561, #​4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

... (truncated)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.11.0 to 2.12.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.12.0

2.12.0 (2026-08-12)

Features

• adds deserialization of the example extension (095ae3b)
• serialize license identifier as extension for earlier versions (d5cdce8)
• serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

• better nullability round-tripping (7a25659)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
• library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
• marks deprecated properties from the specification as obsolete (26aba69)
• marks deprecated properties from the specification as obsolete (abc5301)
• schema: serialize compatibility examples from examples list (be57a7c)
• serialize examples as extension in v2/v3 (d27141b)

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.11.0 to 3.10.2.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.10.2

3.10.2 (2026-08-20)

Bug Fixes

• duplicate schema example when serializing to v2 (#​3045) (50f5a2b)

3.10.1

3.10.1 (2026-08-19)

Bug Fixes

• circular ref guard (#​3033) (8018d40)
• harden yaml parsing (#​3027) (e0d5e9d)

3.10.0

3.10.0 (2026-08-11)

Features

• adds deserialization of the example extension (e5a1080)
• do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
• serialize license identifier as extension for earlier versions (d090989)
• serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

• better nullability round-tripping (655c2c8)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
• deserialize metadata url from extension in earlier version (9387b01)
• marks deprecated properties from the specification as obsolete (787b045)
• marks deprecated properties from the specification as obsolete (953c22a)
• schema: serialize compatibility examples from examples list (5d8ec3a)
• serialize examples as extension in v2/v3 (ff1dbc9)
• serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
• library: support schema keywords on references (434b2f8)
• library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
• handling of nullable enums for 3.0 (#​2920) (beb68f5)
• library: keep v3 schema references ref-only (c938727)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
• use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (78475e3)
• add contains/minContains/maxContains members (1a974f8)
• library: add missing json schema properties (9b1aed6)
• library: add missing json schema properties (82f84e0)

Bug Fixes

• library: always copy unevaluated properties (4907d1c)
• library: avoid false circular refs for external schema re-exports (b635242)
• library: avoid false circular refs for external schema re-exports (7a443c2)
• library: remove unshipped schema extension fallback (cf54bb3)
• library: use version-specific schema keyword callbacks (6e22ec6)
• library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (9b4f45b)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

• reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

• library: handle circular schema references (b3cd42b)
• library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (f97f91a)
• null reference exception for boolean component schemas (fe0b50a)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

• schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
• hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

• library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
• double encoding of json pointer for invalid reference rule (b246cd0)
• encoding of special characters for JSON paths (4c757e1)
• library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
• library: do not emit unevaluatedProperties for non-object schemas (19538aa)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
• potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
• library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
• securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

• implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
• library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
• library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

• models: add shared Content interface (#​2695) (338566f)

Bug Fixes

• broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

• models: add shared Content interface (9e13b25)
• models: add shared Content interface (#​2695) (9e13b25)
• models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

• hidi validate command now logs warnings (76a3c0f)
• hidi validate command now logs warnings (62e7d56)

Bug Fixes

• discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
• discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

• Support custom tag ordering (008576c)
• Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

• correct error pointer when extension parser throws OpenApiException (43c75a9)
• wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

• schema: always serialize additionalProperties: false (6651c36)
• schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

• Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

• load JSON documents that are preceded by multiple whitespace (6461bac)
• non-seekable json streams would fail to load as a document (2436d73)
• reading streams in an asp.net context would cause async exceptions (f9e5248)

3.0.2

3.0.2 (2025-12-08)

Bug Fixes

• additional properties serialization should not emit a schema in v2 (946cba9)
• additional properties serialization should not emit booleans in v3.1+ (946cba9)

3.0.1

3.0.1 (2025-11-17)

Bug Fixes

• empty strings should be quoted in yaml (8d215f9)
• empty strings should be quoted in yaml (0ca10db)

3.0.0

3.0.0 (2025-11-11)

⚠ BREAKING CHANGES

• adds support for OpenAPI 3.2.0

Note: Please refer to the upgrade guide for a detailed description of the breaking changes.

Note: ASP.net users should remain on version 1.X for ASP.net < 10, and version 2.X for ASP.net 10, this new major version will be implemented in a future version of ASP.net, more information

Features

• adds support for OpenAPI 3.2.0 (765a8dd)

Special thanks

• Matthieu Costabello

2.12.2

2.12.2 (2026-08-20)

Bug Fixes

• duplicate schema example when serializing to v2 (#​3046) (a6366be)

2.12.1

2.12.1 (2026-08-19)

Bug Fixes

• circular ref guard (#​3033) (#​3039) (406e6fd)
• harden yaml parsing (#​3034) (fdc5718)

2.12.0

2.12.0 (2026-08-12)

Features

• adds deserialization of the example extension (095ae3b)
• serialize license identifier as extension for earlier versions (d5cdce8)
• serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

• better nullability round-tripping (7a25659)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
• library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
• marks deprecated properties from the specification as obsolete (26aba69)
• marks deprecated properties from the specification as obsolete (abc5301)
• schema: serialize compatibility examples from examples list (be57a7c)
• serialize examples as extension in v2/v3 (d27141b)

Commits viewable in compare view.

Updated QuestPDF from 2026.7.3 to 2026.9.1.

Release notes

Sourced from QuestPDF's releases.

2026.9.1

• Updated Skia to m154.
• Updated qpdf to 12.4.1.
• Fixed an issue where garbage collection could corrupt PDF tag attributes during concurrent PDF generation (found and fixed by @​Lurtz7 in Keep PDF/UA attribute strings alive until the document is closed (fixes stale-pointer corruption and crashes in document_close) QuestPDF/QuestPDF#1483),
• Improved PDF/UA-1 compatibility when generating ZUGFeRD and Factur-X invoices.
• Fixed an issue in the DocumentOperation API where DocumentAttachmentRelationship.Supplement was incorrectly mapped to /Alternative.
• Improved handling of stream-writing exceptions during PDF generation.
• The ShowInCompanion API now automatically starts the Companion App if it is not already running (requires Companion App 2026.9.0 or newer).
• Improved exception messages related to Settings.ThrowOnMissingFontFamilies, Settings.ThrowOnMissingTextGlyphs, and Settings.UseSystemFonts.
• Reduced connection time to the Companion App on Windows.
• Added missing license files for dependencies.

2026.9.0

This release is dedicated to text handling improvements

QuestPDF 2026.9.0 improves font management to make document rendering more predictable across development machines, CI, containers, and cloud environments.

Fonts installed on the operating system vary between machines. A document that looks correct during development may use different fallback fonts, display placeholder glyphs, or lose text after deployment. To help catch these problems before a PDF reaches its recipient, QuestPDF now excludes system fonts by default and validates font availability and glyph coverage during document generation.

Upgrading to 2026.9.0

Deploy the required font files with your application and reference them by the family names stored in those files. Fonts in the application directory are registered automatically; you can also register them explicitly through FontManager. Use FontManager.GetRegisteredFonts() to inspect the available family names.

Please compare previous settings with the new defaults:

// previous behavior:
QuestPDF.Settings.UseSystemFonts = true;
QuestPDF.Settings.ThrowOnMissingFontFamilies = false;
QuestPDF.Settings.ThrowOnMissingTextGlyphs = false;
QuestPDF.Settings.EnableDetailedLayoutErrors = false;

// current behavior:
QuestPDF.Settings.UseSystemFonts = false;
QuestPDF.Settings.ThrowOnMissingFontFamilies = true;
QuestPDF.Settings.ThrowOnMissingTextGlyphs = true;
QuestPDF.Settings.EnableDetailedLayoutErrors = true;

Also review the deployment and API changes below. Renamed APIs remain available under their previous names, marked as obsolete with compiler warnings.

Covering additional languages

QuestPDF includes the bundled Lato font, which covers Latin, Greek, and Cyrillic scripts. For other scripts, such as Chinese, Japanese, Korean, Arabic, Hebrew, Thai, or emoji, we recommend additionally deploying the free, open-source Google Noto font family, registering it with FontManager, and configuring it as a font fallback in the default text style of the document.

// at application startup
FontManager.RegisterFontsFromDirectory("Fonts/Noto");

// in the document
Document.Create(document => 
{
    document.Page(page => 
    {
        page.DefaultTextStyle(style => style.FontFamily("Lato", "Noto Sans", "Noto Sans CJK SC", "Noto Emoji"));
    });
});

⚠️ Breaking changes

... (truncated)

2026.8.0

🚀 This release is dedicated to performance, parallelism, and use of available resources. 🚀

Documents render faster, allocate a fraction of the memory they used to, and scale across all available CPU cores. No code changes are required — existing documents benefit simply by upgrading the package.

The numbers below were measured on a MacBook Pro M5 (18-core CPU), using the invoice document from the Getting Started tutorial, across various levels of parallelism, over a sample of 5,000 documents.

• Reduced allocated memory amount and allocated object count by 85%.
• Improved single-threaded performance by around 15%.
• Substantially improved parallel scaling: throughput previously peaked at 4 threads and flattened beyond that, and now scales with available CPU cores — with around 4x better scaling.
• Improved performance and scalability for text-heavy documents.
• Improved cache usage (mainly for fonts) and significantly reduced locking.

✨ Other improvements:

• Added support for soft hyphens: the library does not hyphenate text automatically, but soft hyphen characters (U+00AD) are now correctly interpreted as optional break points and rendered as hyphens when a line breaks.
• Added the TextStyle.BreakAnywhere API, which allows a text span to break between any two characters, not only at word boundaries such as spaces or hyphens. Useful for content without natural break points, e.g. long URLs, identifiers, hashes, or file paths.
• Improved the visual position of the underline and double underline text decorations.
• Improved reliability of the Companion App integration: document previews are now refreshed from a consistent snapshot, and rendered pages are transferred more efficiently.
• Increased the zlib compression level used for PDF generation from 1 to 3, which produces significantly smaller files (for text-heavy documents) with a minimal increase in generation time.
• Updated the Skia native dependency to version m152.

⚠️ Breaking change

XPS generation has been removed. The format was supported only on Windows, had several rendering issues that could not be reliably resolved, and had negligible adoption. The GenerateXps and GenerateXpsAndShow methods are still present, but calling them now results in a compilation error, and code compiled against an earlier version throws an exception at runtime. Please use PDF generation instead.

Commits viewable in compare view.

Updated System.Drawing.Common from 10.0.11 to 10.0.12.

Release notesDescription has been truncated

[cnlarry]

@dependabot rebase

[cnlarry]

@dependabot rebase