Skip to content

chore(deps): Bump the nuget group with 5 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/bench/Fetchle.Bench/nuget-916b5dfe11
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/bench/Fetchle.Bench/nuget-916b5dfe11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown

Updated Microsoft.Extensions.Logging.Console from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Logging.Console's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated ModelContextProtocol.Core from 2.2.0 to 2.4.0.

Release notes

Sourced from ModelContextProtocol.Core's releases.

2.4.0

Version 2.4.0 adds experimental MCP Skills support through the new ModelContextProtocol.Extensions.Skills package, alongside OAuth hardening and reliability improvements for transport, session, and discovery flows. MCP Apps also now match protocol property names case-sensitively.

What's Changed

  • Add the experimental MCP Skills extension #​1856 by @​girishkvs (co-authored by @​PederHP)
  • Align Skills with server primitives and typed request handlers #​1993 by @​halter73 (co-authored by @​Copilot)
  • Require explicit opt-in for the legacy OAuth metadata fallback #​1952 by @​halter73 (co-authored by @​Copilot)
  • Preserve refresh tokens when OAuth refresh responses omit replacements #​1968 by @​halter73 (co-authored by @​Copilot)
  • Preserve canonical OAuth resource identifiers during refresh #​1967 by @​halter73 (co-authored by @​Copilot)
  • Fix cancellation being reported as missing OAuth metadata #​1891 by @​Empiree
  • Cancel open subscriptions/listen requests when the transport stops delivering messages #​1933 by @​pournasserian (co-authored by @​Copilot)
  • Fix dropped notifications and cancellation when a request is canceled #​1917 by @​zerotohero3
  • Prevent server/discover probes from committing the negotiated protocol version #​1956 by @​PrathmeshPawar2110 (co-authored by @​claude)
  • Fall back to SSE when AutoDetect receives a 405 with a JSON-RPC error body #​1849 by @​ump45nose
  • Fix legacy output schemas for delegating server tools #​1928 by @​Oxygen56
  • Match protocol property names case-sensitively #​1934 by @​FenjuFu

Documentation Updates

  • Clarify Skills discovery and documentation #​2000 by @​halter73 (co-authored by @​Copilot)
  • Fix Markdown link-check warnings and update the Skills specification link #​1975 by @​jeffhandley (co-authored by @​Copilot)

Test Improvements

  • Prevent discovery probe timeouts in controlled test connections #​1946 by @​tarekgh
  • Apply test discovery timeouts to Sampling_Stdio #​1950 by @​girishkvs
  • Use a task that runs until cancelled in the task store cancellation test #​1955 by @​girishkvs
  • Fix parallel integration test server startup #​1982 by @​jeffhandley (co-authored by @​Copilot)

Repository Infrastructure Updates

  • Bump fast-uri from 3.1.5 to 3.1.7 #​1850
  • Bump actions/deploy-pages from 5.0.0 to 5.0.1 #​1858
  • Support release-line docs publishing and release coordination #​1972 by @​jeffhandley (co-authored by @​Copilot)
  • Bump docfx from 2.78.5 to 2.81.0 #​1961
  • Bump actions/setup-node from 7.0.0 to 7.1.0 #​1927
  • Bump becheran/mlc from 1.2.0 to 1.3.0 #​1907
  • Bump the other-testing group with 2 updates #​1960
  • Bump actions/download-artifact from 8.0.1 to 8.0.2 #​1926
  • Bump Anthropic from 12.40.0 to 13.3.0 #​1962
  • Bump the opentelemetry-testing group with 6 updates #​1959
  • Bump actions/upload-artifact from 7.0.1 to 7.0.2 #​1925
  • Fix CI selection of patched .NET SDKs #​1995 by @​tarekgh

Acknowledgements

  • @​Empiree made their first contribution in #​1891
  • @​zerotohero3 made their first contribution in #​1917
  • @​girishkvs made their first contribution in #​1856
  • @​FenjuFu made their first contribution in #​1934
    ... (truncated)

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

  • Harden authenticated stateful MCP sessions (commit bfbd893) by @​halter73 (co-authored by @​Copilot @​jeffhandley @​tarekgh)

Repository Infrastructure Updates

  • Align docs publishing with shared orchestration #​1981 by @​jeffhandley (co-authored by @​Copilot)
  • Fix Markdown link-check warnings and outdated Skills specification link #​1979 by @​jeffhandley (co-authored by @​Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

  1. McpClient.ServerInfo is nullable — #​1903
    • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
    • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
    • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
    • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

  • Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
  • Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
    • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
  • Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
  • Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
  • Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
  • Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
  • Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
  • Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
  • Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
    • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
    • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
  • Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
  • Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

  • Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

  • Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

  • Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
  • Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
  • Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
  • Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

  • @​scottt732 made their first contribution in #​1855
  • @​Zir0-93 made their first contribution in #​1892
  • @​Coding-Professional made their first contribution in #​1903
    ... (truncated)

Commits viewable in compare view.

Updated System.IO.Hashing from 10.0.12 to 10.0.14.

Release notes

Sourced from System.IO.Hashing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated TUnit from 1.72.16 to 1.81.10.

Release notes

Sourced from TUnit's releases.

1.81.10

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.81.5...v1.81.10

1.81.5

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.81.0...v1.81.5

1.81.0

What's Changed

Other Changes

1.80.0

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.79.0...v1.80.0

1.79.0

What's Changed

Other Changes

1.78.0

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.77.0...v1.78.0

1.77.0

What's Changed

Other Changes

Full Changelog: thomhurst/TUnit@v1.76.45...v1.77.0

1.76.45

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.76.28...v1.76.45

1.76.28

What's Changed

Other Changes

Dependencies

New Contributors

Full Changelog: thomhurst/TUnit@v1.76.0...v1.76.28

1.76.0

What's Changed

Other Changes

1.75.0

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.74.0...v1.75.0

1.74.0

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.73.19...v1.74.0

1.73.19

What's Changed

Other Changes

Dependencies

New Contributors

Full Changelog: thomhurst/TUnit@v1.73.5...v1.73.19

1.73.5

What's Changed

Other Changes

Dependencies

Full Changelog: thomhurst/TUnit@v1.73.0...v1.73.5

1.73.0

What's Changed

Other Changes

Dependencies

New Contributors

Full Changelog: thomhurst/TUnit@v1.72.16...v1.73.0

Commits viewable in compare view.

Updated XenoAtom.Terminal from 2.2.0 to 2.5.0.

Release notes

Sourced from XenoAtom.Terminal's releases.

2.5.0

Changes

✨ New Features

  • Add VirtualTerminalBackend.FeedInput to decode raw input in tests (PR #​4) by @​guillaume86

Full Changelog: 2.4.0...2.5.0

Published with dotnet-releaser

2.4.0

Changes

✨ New Features

  • Add UseInstance overload allowing out-of-order scope disposal (7339eb9e)

Full Changelog: 2.3.0...2.4.0

Published with dotnet-releaser

2.3.0

Changes

✨ New Features

  • Add standalone TerminalInstance constructors and a per-thread ambient instance (PR #​3) by @​guillaume86

🧰 Misc

  • Restore Windows console modes when the backend closes (PR #​2) by @​trackd
  • Refresh compatible NuGet dependencies for 2.3.0 (69b7717e)
  • Dispose standalone instances at exit and scope output capture per instance (517174b9)
  • Publish to NuGet with trusted publishing instead of an API key (b35cae2f)

Full Changelog: 2.2.0...2.3.0

Published with dotnet-releaser

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Microsoft.Extensions.Logging.Console from 10.0.12 to 10.0.14
Bumps ModelContextProtocol.Core from 2.2.0 to 2.4.0
Bumps System.IO.Hashing from 10.0.12 to 10.0.14
Bumps TUnit from 1.72.16 to 1.81.10
Bumps XenoAtom.Terminal from 2.2.0 to 2.5.0

---
updated-dependencies:
- dependency-name: Microsoft.Extensions.Logging.Console
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: ModelContextProtocol.Core
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: System.IO.Hashing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: TUnit
  dependency-version: 1.81.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: XenoAtom.Terminal
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants