[dependabot]

Updated AngleSharp from 1.8.5 to 1.8.6.

Release notes

Sourced from AngleSharp's releases.

1.8.6

Released on Sunday, October 25 2026

What's Changed

• Removed temporary copies when serializing text that needs no HTML escaping @​perfloop-agent in Avoid rebuilding unescaped text during HTML serialization AngleSharp/AngleSharp#1388
• Fixed INode.Equals (isEqualNode) to compare what the DOM spec compares: character data, doctype identifiers, processing instructions, element prefixes and attribute local names, no longer base URLs, without overflowing the stack on deep trees
• Fixed IAttr.Equals comparing the prefix instead of the local name
• Fixed IDocument.Import (importNode) returning nodes owned by the source document instead of the importing one
• Fixed IDocument.Import accepting a shadow root instead of throwing NotSupported
• Fixed INode.Clone and Import overflowing the stack on deeply nested trees and templates
• Fixed a shallow clone of a <template> copying its contents
• Fixed serializing < and > in attribute values unescaped, which let markup break out when reparsed under different rules (mutation XSS); they are now written as < and > like browsers do since the HTML spec change of May 2025
• Fixed IRange.CopyContent and ExtractContent overflowing the stack on deeply nested ranges
• Fixed Dispatch (dispatchEvent) returning true for a canceled event
• Fixed MutationObserver not observing a document itself and throwing for one without a root element
• Fixed MutationObserver.Disconnect keeping the previous targets for a later Connect
• Fixed a failing navigation or submission from DoClick crashing the process; it is reported as a context error
• Fixed URLSearchParams treating non-ASCII values as single bytes and leaving + undecoded @​NotAFlightRisk in Decode URLSearchParams as UTF-8 and treat + as a space AngleSharp/AngleSharp#1390
• Added the IHtmlSelectElement.SelectedIndex setter
• Added HtmlParserOptions.MaximumDepth (default 512) to stop deeply nested markup from building trees that overflow the stack
• Added focusing of elements with a tabindex and blurring of any focused element
• Added DoClickAsync to await a click's navigation or form submission
• Added toggling the parent <details> when clicking its <summary>
• Added declarative shadow DOM: the parser attaches <template shadowrootmode="open"> (or closed) as the shadow root of its parent
• Added :host(<compound>), and selectors in a shadow tree reaching its host (only through :host)
• Released 1.8.6 by @​FlorianRappl in Release 1.8.6 AngleSharp/AngleSharp#1391

New Contributors

• @​perfloop-agent made their first contribution in Avoid rebuilding unescaped text during HTML serialization AngleSharp/AngleSharp#1388

Full Changelog: AngleSharp/AngleSharp@v1.8.5...v1.8.6

Commits viewable in compare view.

Updated Aspire.Hosting from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

• 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

• ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

• 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

---

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

• 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

• 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

---

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

• [release/13.6] Bump version to 13.6.2 by @​danegsta with @​Copilot in [release/13.6] Bump version to 13.6.2 microsoft/aspire#20877
• [release/13.6] Pin MessagePack to 2.5.307 for security fixes by @​eerhardt in [release/13.6] Pin MessagePack to 2.5.307 for security fixes microsoft/aspire#21156

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.MongoDB from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.MongoDB's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

• 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

• ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

• 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

---

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

• 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

• 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

---

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

• [release/13.6] Bump version to 13.6.2 by @​danegsta with @​Copilot in [release/13.6] Bump version to 13.6.2 microsoft/aspire#20877
• [release/13.6] Pin MessagePack to 2.5.307 for security fixes by @​eerhardt in [release/13.6] Pin MessagePack to 2.5.307 for security fixes microsoft/aspire#21156

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

• 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

• ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

• 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

---

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

• 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

• 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

---

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

• [release/13.6] Bump version to 13.6.2 by @​danegsta with @​Copilot in [release/13.6] Bump version to 13.6.2 microsoft/aspire#20877
• [release/13.6] Pin MessagePack to 2.5.307 for security fixes by @​eerhardt in [release/13.6] Pin MessagePack to 2.5.307 for security fixes microsoft/aspire#21156

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

• 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

• ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

• 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

---

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

• 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

• 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

---

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

• [release/13.6] Bump version to 13.6.2 by @​danegsta with @​Copilot in [release/13.6] Bump version to 13.6.2 microsoft/aspire#20877
• [release/13.6] Pin MessagePack to 2.5.307 for security fixes by @​eerhardt in [release/13.6] Pin MessagePack to 2.5.307 for security fixes microsoft/aspire#21156

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated bunit from 2.11.3 to 2.12.5.

Release notes

Sourced from bunit's releases.

2.12.5

Fixed

• WrapperBase.WrappedElement could return null and throw NullReferenceException when an element was accessed concurrently with component re-renders. Reported by @​psu-prog in #​1937. Fixed by @​Nacl-HCl.
• DisposeComponentsAsync() could dispose nothing when the renderer's dispatcher was busy, e.g. with a timer calling InvokeAsync. Reported by @​xfunc-tim-schneider in #​1939. Fixed by @​linkdotnet.
• Markup generation and FindComponents could recurse until the test host crashed with a stack overflow when a render threw while instantiating a child component. Reported in #​1935. Fixed by @​linkdotnet.
• Find() could keep returning DOM nodes from the previous render when a render, e.g. from a timer, happened while the nodes were parsed, causing UnknownEventHandlerIdException. Reported by @​xfunc-tim-schneider in #​1938. Fixed by @​linkdotnet.

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.12.2 to 2.13.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.13.0

2.13.0 (2026-10-19)

Features

• document: add GetOperationById to search operations across path… (#​3025) (#​3074) (75d6cea)

Bug Fixes

• components-key validation timeouts under load (#​3108) (#​3112) (5369417)
• openapi: omit null response descriptions (1344a43)

Commits viewable in compare view.

Updated Microsoft.Playwright from 1.63.0 to 1.64.1.

Release notes

Sourced from Microsoft.Playwright's releases.

1.64.1

Highlights

#​3391 - chore(driver): bump bundled Node.js to 24.22.1

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

1.64.0

🧰 WebMCP

New page.Webmcp and frame.Webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like
any other part of your app:

var browser = await playwright.Chromium.LaunchAsync(new() { Args = new[] { "--enable-features=WebMCP" } });
var page = await browser.NewPageAsync();
await page.GotoAsync("https://example.com");

foreach (var tool in await page.Webmcp.ToolsAsync())
    Console.WriteLine($"{tool.Name}: {tool.Description}");

var result = await page.Webmcp.CallToolAsync("add", new { a = 2, b = 40 });
Console.WriteLine(result?.GetProperty("content")[0].GetProperty("text")); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

await page.Screencast.StartAsync(new()
{
    Path = "video.webm",
    Size = new() { Width = 1920, Height = 1080 },
    Fps = 60,
});
await page.Screencast.ShowActionsAsync(new()
{
    Style = new()
    {
        Point = "width: 20px; height: 20px; border-radius: 50%; background: red",
        Highlight = "outline: 2px solid #​333; background: rgba(0, 128, 255, .15)",
        Title = "font-size: 16px",
    },
});

• New RecordVideoFps option and new Fps option in Screencast.StartAsync(). Firefox and WebKit currently capture up to 25 frames per second.
• New Style option takes CSS declarations for the Point marker, the target Highlight and the action Title. It replaces the FontSize option, which is now deprecated.
  ... (truncated)

Commits viewable in compare view.

Updated MongoDB.Bson from 3.12.0 to 3.13.0.

Release notes

Sourced from MongoDB.Bson's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

• CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
  • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
• CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
  • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
• CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
  • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
• CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
  • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
• CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
• CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
  • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
• CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
  • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
• CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
  • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
• CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
  • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
• CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
  • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
• CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
  • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

• CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

• CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
• CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
• CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

• CSHARP-6225: Latest server binary downloads require private S3
• CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated MongoDB.Driver from 3.12.0 to 3.13.0.

Release notes

Sourced from MongoDB.Driver's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

• CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
  • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
• CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
  • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
• CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
  • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
• CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
  • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
• CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
• CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
  • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
• CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
  • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
• CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
  • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
• CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
  • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
• CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
  • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
• CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
  • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

• CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

• CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
• CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
• CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

• CSHARP-6225: Latest server binary downloads require private S3
• CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated OpenTelemetry from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry's releases.

1.20.1

For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.

The following changes are from the previous release 1.20.0.

• NuGet: OpenTelemetry v1.20.1

  • Fixed a possible race condition on ARM64 when multiple threads record the
    first measurement with no tags, or the first overflow measurement, that could
    cause the measurement to be recorded incorrectly.
    (#​7951)

  • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
    and prefixed JWTs.
    (#​7955)

  • Fixed default HTTP client log filtering when registering the OTLP log exporter
    through OpenTelemetryLoggerOptions.
    (#​7959)

  • Fixed legacy self-diagnostics logging terminating the process when the log
    file is truncated or the log volume runs out of space.
    (#​7956)

  • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
    instrumentation suppression, which could cause recursive exports or deadlocks.
    (#​7961)

  • Fixed delta double counters losing subsequent measurements after a non-finite
    or large value and idle metric points with a NaN value failing to be reclaimed.
    (#​7963)

  • Improve the assignment of values to exponential histogram buckets when the
    value is near a bucket boundary by using a pre-computed lookup table.
    (#​7911)

  • Fixed LogRecords being returned to the shared pool while still queued for
    export when an exporter stops enumerating a single-item or array
    Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
    on the same provider to export missing or incorrect data.
    (#​7965)

  • Fixed a SuppressInstrumentationScope.Enter() reference count never being
    released when the Activity it was entered for is not recorded, which caused
    all subsequent telemetry in that execution context to be suppressed.
    (#​7966)

  • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
    or SelfDiagnosticsOptions, are now always created as new files.
    (#​7968)

... (truncated)

1.20.1-rc.1

The following changes are from the previous release 1.20.0.

• NuGet: OpenTelemetry v1.20.1-rc.1

  • Fixed a possible race condition on ARM64 when multiple threads record the
    first measurement with no tags, or the first overflow measurement, that could
    cause the measurement to be recorded incorrectly.
    (#​7951)

  • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
    and prefixed JWTs.
    (#​7955)

  • Fixed default HTTP client log filtering when registering the OTLP log exporter
    through OpenTelemetryLoggerOptions.
    (#​7959)

  • Fixed legacy self-diagnostics logging terminating the process when the log
    file is truncated or the log volume runs out of space.
    (#​7956)

  • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
    instrumentation suppression, which could cause recursive exports or deadlocks.
    (#​7961)

  • Fixed delta double counters losing subsequent measurements after a non-finite
    or large value and idle metric points with a NaN value failing to be reclaimed.
    (#​7963)

  • Improve the assignment of values to exponential histogram buckets when the
    value is near a bucket boundary by using a pre-computed lookup table.
    (#​7911)

  • Fixed LogRecords being returned to the shared pool while still queued for
    export when an exporter stops enumerating a single-item or array
    Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
    on the same provider to export missing or incorrect data.
    (#​7965)

  • Fixed a SuppressInstrumentationScope.Enter() reference count never being
    released when the Activity it was entered for is not recorded, which caused
    all subsequent telemetry in that execution context to be suppressed.
    (#​7966)

  • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
    or SelfDiagnosticsOptions, are now always created as new files.
    (#​7968)

  • Self-diagnostics messages written to the sinks configured by
    SelfDiagnosticsOptions are now truncated to 16,384 characters so that the
    ... (truncated)

1.20.1-beta.1

The following changes are from the previous release 1.20.0-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.20.1-beta.1

  • Fixed scrape responses being handed to the server in a single write, which
    made the server buffer a full copy of the response for each client that did
    not read it until the request completed or timed out. Responses are now
    written in bounded slices so the server's back-pressure applies.
    (#​7957)

  • Fixed startup scrapes permanently omitting target_info and configured
    resource constant labels from subsequent scrape responses.
    (#​7984)

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.20.1-beta.1

  • Fixed scrape responses being handed to the server in a single write, which
    on Linux and macOS made the listener allocate and hold a full copy of the
    response for each client that did not read it until the request completed or
    timed out. Responses are now written in bounded slices.
    (#​7957)

  • Fixed scrape requests that announce a request body holding a thread pool
    thread after their response had been sent on Linux and macOS for as long as
    the client kept trickling in the body. The connection is now closed after
    responding to a request with a body instead of being kept alive.
    (#​7962)

  • Fixed startup scrapes permanently omitting target_info and configured
    resource constant labels from subsequent scrape responses.
    (#​7984)

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.20.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Api from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Api's releases.

1.20.1

For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.

The following changes are from the previous release 1.20.0.

• NuGet: OpenTelemetry v1.20.1

  • Fixed a possible race condition on ARM64 when multiple threads record the
    first measurement with no tags, or the first overflow measurement, that could
    cause the measurement to be recorded incorrectly.
    (#​7951)

  • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
    and prefixed JWTs.
    (#​7955)

  • Fixed default HTTP client log filtering when registering the OTLP log exporter
    through OpenTelemetryLoggerOptions.
    (#​7959)

  • Fixed legacy self-diagnostics logging terminating the process when the log
    file is truncated or the log volume runs out of space.
    (#​7956)

  • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
    instrumentation suppression, which could cause recursive exports or deadlocks.
    (#​7961)

  • Fixed delta double counters losing subsequent measurements after a non-finite
    or large value and idle metric points with a NaN value failing to be reclaimed.
    (#​7963)

  • Improve the assignment of values to exponential histogram buckets when the
    value is near a bucket boundary by using a pre-computed lookup table.
    (#​7911)

  • Fixed LogRecords being returned to the shared pool while still queued for
    export when an exporter stops enumerating a single-item or array
    Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
    on the same provider to export missing or incorrect data.
    (#​7965)

  • Fixed a SuppressInstrumentationScope.Enter() reference count never being
    released when the Activity it was entered for is not recorded, which caused
    all subsequent telemetry in that execution context to be suppressed.
    (#​7966)

  • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
    or SelfDiagnosticsOptions, are now always created as new files.
    (#​7968)

... (truncated)

1.20.1-rc.1

The following changes are from the previous release 1.20.0.

• NuGet: OpenTelemetry v1.20.1-rc.1

  • Fixed a possible race condition on ARM64 when multiple threads record the
    first measurement with no tags, or the first overflow measurement, that could
    cause the measurement to be recorded incorrectly.
    (#​7951)

  • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
    and prefixed JWTs.
    (#​7955)

  • Fixed default HTTP client log filtering when registering the OTLP log exporter
    through OpenTelemetryLoggerOptions.
    (#​7959)

  • Fixed legacy self-diagnostics logging terminating the process when the log
    file is truncated or the log volume runs out of space.
    (#​7956)

  • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
    instrumentation suppression, which could cause recursive exports or deadlocks.
    (#​7961)

  • Fixed delta double counters losing subsequent measurements after a non-finite
    or large value and idle metric points with a NaN value failing to be reclaimed.
    (#​7963)

  • Improve the assignment of values to exponential histogram buckets when the
    value is near a bucket boundary by using a pre-computed lookup table.
    (#​7911)

  • Fixed LogRecords being returned to the shared pool while still queued for
    export when an exporter stops enumerating a single-item or array
    Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
    on the same provider to export missing or incorrect data.
    (#​7965)

  • Fixed a SuppressInstrumentationScope.Enter() reference count never being
    released when the Activity it was entered for is not recorded, which caused
    all subsequent telemetry in that execution context to be suppressed.
    (#​7966)

  • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
    or SelfDiagnosticsOptions, are now always created as new files.
    (#​7968)

  • Self-diagnostics messages written to the sinks configured by
    SelfDiagnosticsOptions are now truncated to 16,384 characters so that the
    ... (truncated)

1.20.1-beta.1

The following changes are from the previous release 1.20.0-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.20.1-beta.1

  • Fixed scrape responses being handed to the server in a single write, which
    made the server buffer a full copy of the response for each client that did
    not read it until the request completed or timed out. Responses are now
    written in bounded slices so the server's back-pressure applies.
    (#​7957)

  • Fixed startup scrapes permanently omitting target_info and configured
    resource constant labels from subsequent scrape responses.
    (#​7984)

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.20.1-beta.1

  • Fixed scrape responses being handed to the server in a single write, which
    on Linux and macOS made the listener allocate and hold a full copy of the
    response for each client that did not read it until the request completed or
    timed out. Responses are now written in bounded slices.
    (#​7957)

  • Fixed scrape requests that announce a request body holding a thread pool
    thread after their response had been sent on Linux and macOS for as long as
    the client kept trickling in the body. The connection is now closed after
    responding to a request with a body instead of being kept alive.
    (#​7962)

  • Fixed startup scrapes permanently omitting target_info and configured
    resource constant labels from subsequent scrape responses.
    (#​7984)

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.20.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.20.1.
    (#​7990)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.20.0 to 1.20.1.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.20.1

For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.

The following changes are from the previous release 1.20.0.

• NuGet: OpenTelemetry v1.20.1

  • Fixed a possible race condition on ARM64 when multiple threads record the
    first measurement with no tags, or the first overflow measurement, that could
    cause the measurement to be recorded incorrectly.
    (#​7951)

  • Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
    and prefixed JWTs.
    (#​7955)

  • Fixed default HTTP client log filtering when registering the OTLP log exporter
    through OpenTelemetryLoggerOptions.
    (#​7959)

  • Fixed legacy self-diagnostics logging terminating the process when the log
    file is truncated or the log volume runs out of space.
    (#​7956)

  • Experimental (pre-release builds only): Fixed Logger.EmitLog ignoring
    instrumentation suppression, which could cause recursive exports or deadlocks.
    (#​7961)

  • Fixed delta double counters losing subsequent measurements after a non-finite
    or large value and idle metric points with a NaN value failing to be reclaimed.
    (#​7963)

  • Improve the assignment of values to exponential histogram buckets when the
    value is near a bucket boundary by using a pre-computed lookup table.
    (#​7911)

  • Fixed LogRecords being returned to the shared pool while still queued for
    export when an exporter stops enumerating a single-item or array
    Batch<LogRecord> early which could cause a BatchLogRecordExportProcessor
    on the same provider to export missing or incorrect data.
    (#​7965)

  • Fixed a SuppressInstrumentationScope.Enter() reference count never being
    released when the Activity it was entered for is not recorded, which caused
    all subsequent telemetry in that execution context to be suppressed.
    (#​7966)

  • Self-diagnostics log files, whether configured through OTEL_DIAGNOSTICS.json
    or SelfDiagnosticsOptions, are now always created as new files.
    (#​7968)

... (truncated)

1.20.1-rc.1

The following changes are from the previous release [1.20.0](https://github.com/open-telemetry/opentelemetry-dotnet/releas...

_Description has been...

Description has been truncated

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.02%. Comparing base (4215b3d) to head (b1151f2).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #336      +/-   ##
==========================================
- Coverage   81.78%   78.02%   -3.77%     
==========================================
  Files         115      117       +2     
  Lines        2674     2717      +43     
  Branches      384      387       +3     
==========================================
- Hits         2187     2120      -67     
- Misses        407      518     +111     
+ Partials       80       79       -1     

see 25 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.