Skip to content

Bump Jint and 22 others - #403

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-all-431f8d37a2
Open

Bump Jint and 22 others#403
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-all-431f8d37a2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown

Pinned Jint at 4.16.2.

Release notes

Sourced from Jint's releases.

4.16.2

Jint 4.16.2 is a maintenance release from the 4.x branch: correctness and conformance fixes backported from main, and nothing that changes an existing API or an existing default. If you are on 4.16.1 it is a drop-in update — every public signature is the one 4.16.0 shipped, on all five target frameworks, and the per-framework snapshots in Jint.Tests.PublicInterface/Verify/ are unchanged. main remains 5.0.0 development; what is coming there is recorded as it lands in docs/v5-migration.md.

Highlights

Failures that used to end the process, or never end. A native error raised while a call's arguments are being evaluated is propagated instead of leaving an empty value behind, which on 4.16.1 could recurse until the process died — decodeURIComponent on a malformed sequence was enough (#​4009). Native recursion and the forwarding paths through bound functions and proxies are guarded so a deep native chain raises a catchable error (#​4007). A module graph too deep to link raises an error the host can catch instead of overflowing the stack (#​3548). Temporal and Intl parsing cannot throw an uncatchable RegexMatchTimeoutException because the machine was busy (#​3543), a Temporal difference past a calendar's range raises RangeError instead of spinning forever (#​3555), and the process-wide Intl culture cache and Temporal zone cache are read-only and bounded, with a rejected zone no longer remembered — closing a script-driven unbounded growth (#​3546).

Generators and built-ins, step by step. A yield* delegation reached again by a loop both re-delegates and keeps its place: countdown(3) in a loop no longer hangs, and a delegating generator no longer returns the memoized first result (#​3545). Array.prototype.map and slice hand a @@​species constructor the length ToLength produced, and a non-callable map argument is a TypeError (#​3547). A trailing NUL pads neither a numeric string nor an array index (#​3552). A removed property slot is a tombstone rather than a free slot to reuse, so enumeration order survives a delete-and-readd (#​3318), and LengthOfArrayLike no longer clamps through a uint overload (#​3328).

Interop that answers for the right engine. Two engines in one process no longer decide each other's conversions and operators (#​3559), a host type converter's answer stays with the engine whose converter gave it (#​3563), and a value the host registers on a ShadowRealm — and the members its wrapper builds eagerly — belong to that realm (#​3557). Realm construction state is restored after nesting or a failure (#​4008). Overload selection is by the arguments in hand: an operator overload is chosen that way (#​3611), a params overload is chosen by the array's element type with a failing element declining rather than throwing (#​3782), an overload the argument cannot bind to is not a match, and a host operator that throws reports what it threw (#​3554). An index on a wrapped host collection is one property however it is spelled, and a member filter that hides the indexer hides it (#​3562); a read-only host collection refuses a write with a JavaScript TypeError rather than the CLR's NotSupportedException (#​3556).

Internationalization and Temporal. The Persian calendar extends into proleptic years on its 33-year cycle, so the ends of Temporal's range land in the right Persian year (#​4006); a calendar that counts Gregorian months writes their names (#​3612); and a -u- extension carrying more than one key is read whole (#​3613).

Errors. Only a string-valued stack counts as a pre-existing stack when a JavaScriptException is built, so an accessor or non-string stack on a thrown object no longer breaks error reporting (#​3677, reported by @​jeske).

Every change was verified failing-first against the unfixed branch on both .NET Framework and .NET 10, and the release was gated on a paired SunSpider and Dromaeo comparison against 4.16.1 on an idle machine: no row regressed outside run-to-run noise, most run 1–4 % faster.

What's Changed

Full Changelog: sebastienros/jint@v4.16.1...v4.16.2

4.16.1

Jint 4.16.1 is the first release from the new 4.x maintenance branch, and it marks the point where the two lines separate: main is now 5.0.0 development, and 4.x is where the 4.16.x line continues.

What that means for you. If you are on 4.16.0, this is a drop-in update — it is correctness and conformance work only, no API change and no changed default. Every public signature is the same one 4.16.0 shipped, on all five target frameworks. If you want the 4.x line, take it from 4.x and expect fixes rather than features. If you want to follow where the engine is going, watch main — v5 brings breaking API changes, an opt-in WHATWG web API surface, Web Workers, Node compatibility and a raised .NET Framework floor, and every one of them is recorded as it lands in docs/v5-migration.md.

From this release onward the 4.x public surface is snapshotted per target framework in Jint.Tests.PublicInterface/Verify/, so "did the API move?" is a diff rather than a judgement call — on this branch a diff there is a bug, and comparing those files against main's is the v4→v5 delta.

Highlights

Conformance, from a suite that now runs more of test262. The staging/ directory is generated and executed for the first time (#​3016), which is roughly 2,800 additional cases — largely SpiderMonkey's own suite contributed upstream, covering behaviour the stable directories never reach. Much of the work below is what it found.

Built-ins do what the spec says, step by step. The array built-ins perform the internal methods they name rather than equivalents (#​3066); Array.from honours IsConstructor and a typed array's length write throws (#​3043); an array truncation walks downwards and the generics report the writes they fail (#​3072); argument validation and evaluation order are corrected in five built-ins (#​3069); Map and Set get the [[SetData]] tombstone their traversals are specified over (#​3073); Date.prototype.setTime stores the clipped time value (#​3042); and Array.prototype.values/keys/entries no longer gate on an array-like receiver (#​3236).

Iterators and control flow. A throw from the iterator step no longer closes the iterator (#​3047); the done flag is consulted before stepping again (#​3048); a rejected return() propagates out of an abandoned for await loop (#​3113); an optional-chain short circuit is distinguished from a genuine undefined (#​3040); a computed property key is evaluated even when spelled as a literal (#​3039) and survives an await or yield intact (#​3144, #​3150); and destructuring the rest of an exhausted array yields an empty array rather than 2³² elements (#​3263).

Numeric and string accuracy. Math.acosh, asinh, atanh, cbrt, expm1 and log1p are ported from fdlibm for correctly-rounded results across every target framework (#​3050); toFixed formats from the double's exact value and reads this from [[NumberData]] (#​3071); String.prototype case conversion derives from Jint's own Unicode tables rather than the host's culture data (#​3068); and the regex engine is chosen per subject, with RegExp.prototype.replace no longer rewriting lastIndex (#​3070).

Bounds that hold. JavaScript strings have a maximum length instead of a wrapped array rent (#​3015); a JSON document too long to become a string is refused while it is being built (#​3028); a frame displaced by a proper tail call keeps counting while its trampoline runs, so MaxRecursionDepth cannot be evaded by leaving and re-entering the trampoline (#​3022); and an Atomics waiter is released when nothing can ever notify it again (#​3029).

Error messages no longer run user JavaScript (#​3041) — rendering a message for a value with a script-supplied toString used to invoke it, from inside the failure path.

Internationalization. The five Temporal members the proposal removed are dropped (#​3014), and u-extension options are canonicalized with every date format the spec allows (#​3018).

Two fixes in this release come from @​svenrog — a sloppy function answering its own arguments (#​3061) and the outer link on a parked Function-constructor environment (#​3063).

What's Changed

4.16.0

Jint 4.16.0 is a correctness- and reliability-focused release: alongside asynchronous module loading, proper tail calls and four new iterator built-ins, a pre-tag review swept the whole engine and fixed what it found — including long-standing defects that predate this cycle. No option defaults changed. Behaviour changes to note up front: JSON.stringify and other machine-readable output now format invariantly under every host culture — under Swedish or Finnish locales on .NET 8+ it used to emit a Unicode minus sign no JSON parser accepts; JSON.parse now rejects trailing commas as the grammar requires; bare identifiers at global scope resolve through the global's prototype chain per spec; IModuleLoader.Resolve is consulted once per (referrer, specifier) pair, so a loader using it as a per-import access-control checkpoint should move the check to LoadModule; and an inconsistent sort comparator now finishes with an implementation-defined order on every target framework instead of hanging (net462/netstandard) or throwing a CLR exception at script (net8+).

Highlights

Proper tail calls (#​2975). Strict-mode calls in tail position reuse their frame, so "use strict" tail recursion runs in constant stack — the first ES2015 PTC implementation among the .NET engines.

Asynchronous module loading (#​2872). IAsyncModuleLoader and the AsyncModuleLoader template let a host fetch module source over I/O without blocking a thread; Engine.Modules.StartImport returns an operation a game loop drives via ProcessTasks(), and ImportAsync awaits without holding a thread. The spec's load phase now exists as written, a warm-cache async loader keeps the blocking Import fully synchronous, and the blocking drain wakes on a work-arrived signal instead of polling. A module served over a transport keeps its whole url as Module.Location so its own relative imports resolve, a deferred namespace evaluates its module instead of exposing uninitialized bindings, and an import abandoned by a global snapshot restore reports itself faulted instead of polling forever.

The process no longer dies for recoverable reasons. Options.LimitRecursion used to kill the host process for most useful limits — the constraint fired, and the unwind itself overflowed the stack; exception filters now let it unwind ~7× deeper. The new opt-in Options.Constraints.StackOverflowGuard converts unbounded recursion — reachable through eighteen distinct routes, new, accessors, coercions and Proxy traps included — from a process kill into a catchable RangeError, exempting strict tail calls, which grow no stack. And a family of CLR exceptions that escaped engine.Evaluate past every script catch are now proper JavaScript errors or correct results: sorting with an inconsistent comparator, destructuring with a function-valued default (const { onChange = () => {} } = opts), toLocaleString outside DateTime's range, typed-array defineProperty without a value, DataView reads at 2³¹, String.replace $' with a lying exec, and the first instant of year 10000.

New built-ins. Iterator.prototype.join, chunks, windows and includes; take/drop now throw RangeError for a finite limit above 2^53−1 per the updated proposals. Intl.Locale.prototype.getCollations reports CLDR-cited collation data that Intl.Collator accepts in full, a malformed collation option is a RangeError, and Intl.supportedValuesOf("collation") derives from the same lists so the three can never drift.

Conformance, from a review that ran what the suite does not. Two of the fixed defects had test262 coverage only under the never-generated staging/ directory, and several had none at all: parseInt strips the sign before testing for a hex prefix, so parseInt("-0x10") is −16; a suspended finally no longer swallows a pending break/continue; a Proxy (or exotic host object) as the global's prototype answers bare identifiers through its get trap; Date.prototype.toISOString emits the spec's six-digit expanded year and round-trips through Date.parse in every spelling including year 0; iterator helpers close their receiver exactly once and only when the spec says so, and carry their own @@​toStringTag; Map/Set size is the prototype accessor the spec defines rather than a phantom own property; a Proxy's defineProperty trap receives the partial descriptor the caller wrote; a string's @@​iterator is read once, with the primitive as receiver; Array.prototype.join re-asks the array when a side effect fills a hole mid-join; a direct eval reaches the enclosing function's arguments in both modes; and Temporal.Now drops the methods the proposal removed.

Embedder surface. OperationDeadlineConstraint bounds a whole multi-entry host operation; ScriptPreparationOptions.StaticAnalysis trades prepare-time analysis for per-engine materialization on shared graphs; ModuleFactory.LocationOf exposes the module-naming rule a host must match; Engine.Advanced.HostDefined carries per-request state on a pooled engine; the CLR exception behind an interop error is reachable through JintException.TryGetClrException with opt-in ChainClrExceptions(), and a host method's own TargetException is no longer mistaken for a receiver mismatch; and a recursion-limit failure propagates out of a module load instead of becoming a catchable rejection.

Performance, gated. Against v4.15.3 on idle hardware, medians of three paired runs: controlflow-recursive −15.6% time and −40.4% allocation (proper tail calls), bitops-3bit-bits-in-byte −8.9%, math-spectral-norm −7.3%, crypto-sha1 −6.9%, 3d-raytrace −5.9%, math-cordic −5.8%, with a broad −1–4% tail across the call- and string-heavy rows; no row moved outside its own measured cross-run envelope in the other direction, and allocation is flat within ±0.2% suite-wide. Warmed parseInt call sites take the frameless fast-call lane (−13% on the parse loop), joined by the Number predicates, String.prototype.indexOf/startsWith/endsWith/includes/at/substr, global isNaN/isFinite and Array.isArray (−3% to −19%) and the Map/Set method family (map.get hit loop −13%); existence questions on a wrapped dictionary answer from ContainsKey, taking in −33% with −98% allocation and Object.keys −37%; resolving an inherited global no longer allocates per miss (−99.99% on the read loop) and a global created through an inherited write keeps the in-place store; JSON replacer/reviver eligibility is decided once per document, built-in callback dispatch once per loop, a call site's arguments reach an interpreted callee in registers, and function-local let/const live in fixed slots.

Breaking changes. Int32Extensions/Int64Extensions/DoubleExtensions — polyfill hosts that leaked into the public API — are now internal; on net462/netstandard2.0, code with using Jint; may have bound span Parse/TryParse members through them. JsonParser rejects trailing commas. Number.parseInt.length/Number.parseFloat.length report their spec values. Post-construction mutation of an Options instance no longer reaches an already-built engine, and Options.Configure callbacks work again. UnwrapIfPromise reports a cancelled engine as ExecutionCanceledException instead of a timeout. Time-zone matching is ASCII-case-insensitive per ECMA-402.

On the engine comparison benchmarks, Jint 4.16.0 is the fastest engine outright on 5 of 12 scripts — leading dromaeo-object-regexp-modern over native V8 by 1.25× — in a statistical tie for first on interop-collection-traversal, the fastest managed engine on 10 of 12, the fastest interpreter on all 12, and 8.6×–11.2× ahead of ClearScript (native V8) on every interop row while allocating 3.9×–12.4× less than the nearest managed competitor.

What's Changed

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.Authentication.JwtBearer at 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.DataProtection.EntityFrameworkCore at 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.DataProtection.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.OpenApi at 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.Analyzers at 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

5.0.1

Release Notes
Install Instructions

Repo

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

3.10.0-3.21201.20

Release

3.10.0-2.21153.36

Release

3.10.0-1.21102.26

Release

3.7.0-3.20312.3

Release Notes
Install Instructions

Repos

3.7.0-3.20269.11

Release Notes
Install Instructions

Repos

3.7.0-2.20277.1

Release Notes
Install Instructions

Repos

3.6.0

Release Notes
Install Instructions

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.Analyzers at 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

5.0.1

Release Notes
Install Instructions

Repo

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.Analyzers from 5.6.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

5.0.1

Release Notes
Install Instructions

Repo

Commits viewable in compare view.

Pinned Microsoft.CodeAnalysis.CSharp at 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

5.0.1

Release Notes
Install Instructions

Repo

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Http.Resilience at 10.10.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

  • OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

  • Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
  • Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
  • OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

  • Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
  • Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

  • Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
  • Bump PowerShell from 7.6.4 to 7.6.5 #​7702
  • [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
  • Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
  • Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
  • Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
  • Do not validate extension during publish step #​7725 by @​peterwaltonwork
  • Add skill for upgrading OpenAI #​7728 by @​jozkee
  • Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

  • @​Lroca88 made their first contribution in #​7718
  • @​thaildhe172591 made their first contribution in #​7735
  • @​ANcpLua submitted issue #​7665 (resolved by #​7735)
  • @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.9.0 to 10.10.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

  • OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

  • Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
  • Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
  • OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

  • Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
  • Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

  • Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
  • Bump PowerShell from 7.6.4 to 7.6.5 #​7702
  • [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
  • Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
  • Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
  • Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
  • Do not validate extension during publish step #​7725 by @​peterwaltonwork
  • Add skill for upgrading OpenAI #​7728 by @​jozkee
  • Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

  • @​Lroca88 made their first contribution in #​7718
  • @​thaildhe172591 made their first contribution in #​7735
  • @​ANcpLua submitted issue #​7665 (resolved by #​7735)
  • @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.8.1 to 18.10.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.10.0

What's Changed

Full Changelog: microsoft/vstest@v18.9.0...v18.10.0

18.9.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in compare view.

Pinned Microsoft.OpenApi at 3.10.2.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.10.2

3.10.2 (2026-08-20)

Bug Fixes

3.10.1

3.10.1 (2026-08-19)

Bug Fixes

3.10.0

3.10.0 (2026-08-11)

Features

  • adds deserialization of the example extension (e5a1080)
  • do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
  • serialize license identifier as extension for earlier versions (d090989)
  • serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

  • better nullability round-tripping (655c2c8)
  • bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
  • deserialize metadata url from extension in earlier version (9387b01)
  • marks deprecated properties from the specification as obsolete (787b045)
  • marks deprecated properties from the specification as obsolete (953c22a)
  • schema: serialize compatibility examples from examples list (5d8ec3a)
  • serialize examples as extension in v2/v3 (ff1dbc9)
  • serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

Bug Fixes

  • adds explicit error message for invalid json pointers (63fc55d)
  • adds explicit error message for invalid json pointers (bc93efe)
  • default mapping is not being serialized with the correct shape (fe4a25f)
  • differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
  • handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
  • validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

  • add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
  • library: support schema keywords on references (434b2f8)
  • library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

  • Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
  • handling of nullable enums for 3.0 (#​2920) (beb68f5)
  • library: keep v3 schema references ref-only (c938727)
  • preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
  • use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

  • add contains/minContains/maxContains members (78475e3)
  • add contains/minContains/maxContains members (1a974f8)
  • library: add missing json schema properties (9b1aed6)
  • library: add missing json schema properties (82f84e0)

Bug Fixes

  • library: always copy unevaluated properties (4907d1c)
  • library: avoid false circular refs for external schema re-exports (b635242)
  • library: avoid false circular refs for external schema re-exports (7a443c2)
  • library: remove unshipped schema extension fallback (cf54bb3)
  • library: use version-specific schema keyword callbacks (6e22ec6)
  • library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

  • reader: remove ParseNode infrastructure (9b4f45b)
  • Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

  • reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

  • library: handle circular schema references (b3cd42b)
  • library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

  • null reference exception for boolean component schemas (f97f91a)
  • null reference exception for boolean component schemas (fe0b50a)
  • schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

  • schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

  • hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
  • hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

  • security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

  • library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

  • a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
  • a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
  • double encoding of json pointer for invalid reference rule (b246cd0)
  • encoding of special characters for JSON paths (4c757e1)
  • library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
  • library: do not emit unevaluatedProperties for non-object schemas (19538aa)
  • library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
  • potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

  • library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
  • library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
  • securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

  • implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
  • library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
  • library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
  • optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

Bug Fixes

  • broken binary compatibility due t...

Description has been truncated

@dependabot
Bump Jint and 22 others
934554f 
Bumps Jint from 4.15.3 to 4.16.2
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.DataProtection.EntityFrameworkCore from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.TestHost from 10.0.11 to 10.0.12
Bumps Microsoft.CodeAnalysis.Analyzers to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp to 5.9.0
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Http.Resilience from 10.9.0 to 10.10.0
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.9.0 to 10.10.0
Bumps Microsoft.NET.Test.Sdk from 18.8.1 to 18.10.0
Bumps Microsoft.OpenApi from 2.10.0 to 3.10.2
Bumps MinVer from 7.0.0 to 8.0.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0
Bumps Scalar.AspNetCore from 2.16.19 to 2.17.3
Bumps Testcontainers.PostgreSql from 4.13.0 to 4.15.0
Bumps xunit.runner.visualstudio from 3.1.5 to 4.0.0
Bumps Xunit.SkippableFact from 1.5.61 to 1.5.85

---
updated-dependencies:
- dependency-name: Jint
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.DataProtection.EntityFrameworkCore
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: MinVer
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.17.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Testcontainers.PostgreSql
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Xunit.SkippableFact
  dependency-version: 1.5.85
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add missing keywords support for OpenAPIReference (and JsonSchemaRefernece Update Microsoft.OpenApi.OData to 3.2.1 on main (OpenAPI 3.2)

0 participants