Skip to content

deps: Bump the dotnet group with 15 updates - #49

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/CameraModule/Serval.CameraModule.Tests/dotnet-113b5d2c0f
Open

deps: Bump the dotnet group with 15 updates#49
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/CameraModule/Serval.CameraModule.Tests/dotnet-113b5d2c0f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Updated LLamaSharp from 0.27.0 to 0.30.0.

Release notes

Sourced from LLamaSharp's releases.

0.30.0

Major Changes

Bug Fixes

Other Changes

New Contributors

Full Changelog: SciSharp/LLamaSharp@v0.29.0...v0.30.0

0.29.0

Major Changes

Bug Fixes

Other Changes

New Contributors

Full Changelog: SciSharp/LLamaSharp@v0.27.0...v0.29.0

Commits viewable in compare view.

Updated LLamaSharp.Backend.Cpu from 0.27.0 to 0.30.0.

Release notes

Sourced from LLamaSharp.Backend.Cpu's releases.

0.30.0

Major Changes

Bug Fixes

Other Changes

New Contributors

Full Changelog: SciSharp/LLamaSharp@v0.29.0...v0.30.0

0.29.0

Major Changes

Bug Fixes

Other Changes

New Contributors

Full Changelog: SciSharp/LLamaSharp@v0.27.0...v0.29.0

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.OpenApi from 2.12.2 to 2.13.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

2.13.0

2.13.0 (2026-10-19)

Features

Bug Fixes

Commits viewable in compare view.

Updated MongoDB.Driver from 3.12.0 to 3.13.0.

Release notes

Sourced from MongoDB.Driver's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

  • CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
    • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
  • CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
    • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
  • CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
    • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
  • CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
    • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
  • CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
  • CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
    • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
  • CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
    • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
  • CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
    • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
  • CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
    • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
  • CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
    • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
  • CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
    • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

  • CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

  • CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
  • CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
  • CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

  • CSHARP-6225: Latest server binary downloads require private S3
  • CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated Scalar.AspNetCore from 2.17.10 to 2.18.3.

Release notes

Sourced from Scalar.AspNetCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated SixLabors.ImageSharp from 3.1.12 to 3.2.0.

Release notes

Sourced from SixLabors.ImageSharp's releases.

3.2.0

What's Changed

Full Changelog: SixLabors/ImageSharp@v3.1.12...v3.2.0

Commits viewable in compare view.

Updated SQLitePCLRaw.lib.e_sqlite3 from 2.1.13 to 2.1.14.

Release notes

Sourced from SQLitePCLRaw.lib.e_sqlite3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.v3 from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the dotnet group with 15 updates
f64f093 
Bumps LLamaSharp from 0.27.0 to 0.30.0
Bumps LLamaSharp.Backend.Cpu from 0.27.0 to 0.30.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.12 to 10.0.14
Bumps Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.14
Bumps Microsoft.Data.Sqlite from 10.0.12 to 10.0.14
Bumps Microsoft.Extensions.Hosting from 10.0.12 to 10.0.14
Bumps Microsoft.Extensions.Http from 10.0.12 to 10.0.14
Bumps Microsoft.Extensions.Logging.Abstractions to 10.0.13, 10.0.14
Bumps Microsoft.Extensions.Options from 10.0.12 to 10.0.14
Bumps Microsoft.OpenApi from 2.12.2 to 2.13.0
Bumps MongoDB.Driver from 3.12.0 to 3.13.0
Bumps Scalar.AspNetCore from 2.17.10 to 2.18.3
Bumps SixLabors.ImageSharp from 3.1.12 to 3.2.0
Bumps SQLitePCLRaw.lib.e_sqlite3 from 2.1.13 to 2.1.14
Bumps xunit.v3 from 4.0.1 to 4.0.2

---
updated-dependencies:
- dependency-name: LLamaSharp
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: LLamaSharp.Backend.Cpu
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Data.Sqlite
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Hosting
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Http
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.OpenApi
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.18.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: SixLabors.ImageSharp
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: SQLitePCLRaw.lib.e_sqlite3
  dependency-version: 2.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from jeremiah-huston as a code owner October 26, 2026 13:43
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 26, 2026
@dependabot dependabot Bot mentioned this pull request Oct 26, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeremiah-huston jeremiah-huston Awaiting requested review from jeremiah-huston jeremiah-huston is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants