Bump DependencyInjection.Lifetime.Analyzers and 3 others

[dependabot]

Updated DependencyInjection.Lifetime.Analyzers from 2.18.0 to 2.18.24.

Release notes

Sourced from DependencyInjection.Lifetime.Analyzers's releases.

2.18.24

DependencyInjection.Lifetime.Analyzers 2.18.24

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI021/DI022 non-generic captured-scope resolutions — concurrent-handler analysis now recognizes exact framework IServiceProvider.GetService(typeof(T)) and GetRequiredService(typeof(T)) requests made through a scope or provider captured outside the handler. Literal typeof(T) is required, direct-static ordinal recovery is restricted to exact framework extension containers, and concrete provider implementations bind the requested type by semantic parameter type rather than parameter spelling. Provider-origin tracing preserves built-in identity, reference, and boxing conversions so existing generic/keyed resolution through captured value-type and IServiceProvider-constrained providers remains covered; constraint traversal is cycle-safe for temporarily invalid editor code. Runtime Type values, user-defined conversions on either the requested type or provider receiver, user-defined same-named helpers, and scopes created inside the handler remain silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.24

What changed

Fixed

• DI021/DI022 non-generic captured-scope resolutions — concurrent-handler analysis now recognizes exact framework IServiceProvider.GetService(typeof(T)) and GetRequiredService(typeof(T)) requests made through a scope or provider captured outside the handler. Literal typeof(T) is required, direct-static ordinal recovery is restricted to exact framework extension containers, and concrete provider implementations bind the requested type by semantic parameter type rather than parameter spelling. Provider-origin tracing preserves built-in identity, reference, and boxing conversions so existing generic/keyed resolution through captured value-type and IServiceProvider-constrained providers remains covered; constraint traversal is cycle-safe for temporarily invalid editor code. Runtime Type values, user-defined conversions on either the requested type or provider receiver, user-defined same-named helpers, and scopes created inside the handler remain silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.23

DependencyInjection.Lifetime.Analyzers 2.18.23

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI027 otherwise-unused private subscription fields — a Subscribe(...) token assigned directly to a private field declared on the subscriber now reports when that field has no other symbol-bound reference across any partial declaration. Any later disposal, return, argument pass, reassignment, or other field access remains conservative and silent; inherited and externally accessible fields also stay silent because handling outside the subscriber cannot be ruled out.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.23

What changed

Fixed

• DI027 otherwise-unused private subscription fields — a Subscribe(...) token assigned directly to a private field declared on the subscriber now reports when that field has no other symbol-bound reference across any partial declaration. Any later disposal, return, argument pass, reassignment, or other field access remains conservative and silent; inherited and externally accessible fields also stay silent because handling outside the subscriber cannot be ruled out.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.22

DependencyInjection.Lifetime.Analyzers 2.18.22

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI019 all-root conditional provider joins — provider aliases selected by a conditional expression now retain root-provider classification when both result arms are independently proven root providers through path-stable declarations or straight-line writes. Provider declarations and assignments are collected in source order, path stability propagates through copied aliases, later unclassified, deconstruction, coalescing-assignment, and ref/out writes invalidate older provider facts. Write facts become visible only after their right-hand side, initializer, or argument evaluation completes, and nested mutation events are processed before an enclosing write, so resolutions and alias copies observe the provider state that exists at that runtime point. Merely binding or retargeting a ref local preserves the referents' facts; source-positioned mappings ensure each actual later write and read follows only the referents active at that point, and reads classify the alias only when every possible storage agrees. A value write through a multi-referent ref alias invalidates every possible storage instead of falsely treating the write as definite for all referents. Conditional retargets, ref-conditional lvalues, and by-reference conditional arguments retain every possible referent. Forward or backward goto edges cannot make path-dependent facts stable. Field/property facts never qualify because source order cannot prove cross-method execution. Branch-, loop-, switch-, exception-, and short-circuit-dependent writes do not qualify. Deferred lambda and LINQ-query hazards become active from their creation point and survive later lexical assignments only for captured outer storage; local-function hazards likewise remain executable-wide for captured storage because the function is callable before its declaration. Locals and parameters owned by a deferred boundary retain ordinary path stability for declarations and straight-line writes, and control flow outside that owning boundary does not alter the write path executed inside it. Mixed root/scoped or unknown arms stay conservative.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.22

What changed

Fixed

• DI019 all-root conditional provider joins — provider aliases selected by a conditional expression now retain root-provider classification when both result arms are independently proven root providers through path-stable declarations or straight-line writes. Provider declarations and assignments are collected in source order, path stability propagates through copied aliases, later unclassified, deconstruction, coalescing-assignment, and ref/out writes invalidate older provider facts. Write facts become visible only after their right-hand side, initializer, or argument evaluation completes, and nested mutation events are processed before an enclosing write, so resolutions and alias copies observe the provider state that exists at that runtime point. Merely binding or retargeting a ref local preserves the referents' facts; source-positioned mappings ensure each actual later write and read follows only the referents active at that point, and reads classify the alias only when every possible storage agrees. A value write through a multi-referent ref alias invalidates every possible storage instead of falsely treating the write as definite for all referents. Conditional retargets, ref-conditional lvalues, and by-reference conditional arguments retain every possible referent. Forward or backward goto edges cannot make path-dependent facts stable. Field/property facts never qualify because source order cannot prove cross-method execution. Branch-, loop-, switch-, exception-, and short-circuit-dependent writes do not qualify. Deferred lambda and LINQ-query hazards become active from their creation point and survive later lexical assignments only for captured outer storage; local-function hazards likewise remain executable-wide for captured storage because the function is callable before its declaration. Locals and parameters owned by a deferred boundary retain ordinary path stability for declarations and straight-line writes, and control flow outside that owning boundary does not alter the write path executed inside it. Mixed root/scoped or unknown arms stay conservative.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.21

DependencyInjection.Lifetime.Analyzers 2.18.21

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI015 Generic Host lifetime service fidelity — Microsoft.Extensions.Hosting.IHostLifetime, which the Generic Host registers as a singleton, now participates in the default framework-services assumption alongside IHostApplicationLifetime. Strict mode, same-named user types, and keyed requests still report; shared dependency analysis now preserves the key and lets explicit registrations override ambient framework lifetimes, so scoped IHostLifetime replacements remain visible to DI019 and DI020.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.21

What changed

Fixed

• DI015 Generic Host lifetime service fidelity — Microsoft.Extensions.Hosting.IHostLifetime, which the Generic Host registers as a singleton, now participates in the default framework-services assumption alongside IHostApplicationLifetime. Strict mode, same-named user types, and keyed requests still report; shared dependency analysis now preserves the key and lets explicit registrations override ambient framework lifetimes, so scoped IHostLifetime replacements remain visible to DI019 and DI020.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.20

DependencyInjection.Lifetime.Analyzers 2.18.20

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI019 exact framework resolution extensions — same-named user-defined GetService* extensions no longer trigger root-scoped diagnostics merely because their receiver is an IServiceProvider. Both reduced and direct-static calls must now bind to the matching framework ServiceProviderServiceExtensions or ServiceProviderKeyedServiceExtensions container; real framework calls keep the existing root-provider analysis.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.20

What changed

Fixed

• DI019 exact framework resolution extensions — same-named user-defined GetService* extensions no longer trigger root-scoped diagnostics merely because their receiver is an IServiceProvider. Both reduced and direct-static calls must now bind to the matching framework ServiceProviderServiceExtensions or ServiceProviderKeyedServiceExtensions container; real framework calls keep the existing root-provider analysis.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.19

DependencyInjection.Lifetime.Analyzers 2.18.19

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI016 null-coalescing throw guards — builder .Services registration flows now remain recognizable through an identity-preserving ?? throw guard, so (builder.Services ?? throw ...).BuildServiceProvider() reports like the unguarded call. Coalesces with an arbitrary fallback collection remain conservative and silent because the provider may be built from a different source.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.19

What changed

Fixed

• DI016 null-coalescing throw guards — builder .Services registration flows now remain recognizable through an identity-preserving ?? throw guard, so (builder.Services ?? throw ...).BuildServiceProvider() reports like the unguarded call. Coalesces with an arbitrary fallback collection remain conservative and silent because the provider may be built from a different source.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.18

DependencyInjection.Lifetime.Analyzers 2.18.18

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI019 direct static service-resolution calls — root-provider analysis now recovers the provider from the bound ordinal-zero extension parameter for direct calls through ServiceProviderServiceExtensions, including non-generic overloads with reordered named arguments. Calls through scoped or otherwise unproven providers remain quiet, and the code fixer deliberately offers no rewrite for static-call syntax.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.18

What changed

Fixed

• DI019 direct static service-resolution calls — root-provider analysis now recovers the provider from the bound ordinal-zero extension parameter for direct calls through ServiceProviderServiceExtensions, including non-generic overloads with reordered named arguments. Calls through scoped or otherwise unproven providers remain quiet, and the code fixer deliberately offers no rewrite for static-call syntax.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.17

DependencyInjection.Lifetime.Analyzers 2.18.17

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI003 IServiceCollection.Insert(0, ...) registrations — the shared registration collector now includes ServiceDescriptor registrations prepended at a compile-time-zero index, including reordered named arguments and concrete framework ServiceCollection receivers. Descriptor precedence models normal additions plus repeated prepends in runtime list order, so a prepended descriptor cannot falsely override a later descriptor; nonzero or dynamic indexes and source-defined concrete Insert bodies remain conservative and silent because their absolute position or mutation behavior is not provable.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.17

What changed

Fixed

• DI003 IServiceCollection.Insert(0, ...) registrations — the shared registration collector now includes ServiceDescriptor registrations prepended at a compile-time-zero index, including reordered named arguments and concrete framework ServiceCollection receivers. Descriptor precedence models normal additions plus repeated prepends in runtime list order, so a prepended descriptor cannot falsely override a later descriptor; nonzero or dynamic indexes and source-defined concrete Insert bodies remain conservative and silent because their absolute position or mutation behavior is not provable.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.16

DependencyInjection.Lifetime.Analyzers 2.18.16

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI016 direct static BuildServiceProvider calls — registration-context analysis now recovers the IServiceCollection receiver from the bound extension parameter for ServiceCollectionContainerBuilderExtensions.BuildServiceProvider(...). Builder .Services flows report in ordinary methods and top-level statements even with named/reordered arguments, while provider-factory methods that intentionally return IServiceProvider remain quiet.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.16

What changed

Fixed

• DI016 direct static BuildServiceProvider calls — registration-context analysis now recovers the IServiceCollection receiver from the bound extension parameter for ServiceCollectionContainerBuilderExtensions.BuildServiceProvider(...). Builder .Services flows report in ordinary methods and top-level statements even with named/reordered arguments, while provider-factory methods that intentionally return IServiceProvider remain quiet.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.15

DependencyInjection.Lifetime.Analyzers 2.18.15

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025/DI026 identity-preserving publisher casts — event subscriptions now retain injected-receiver lifetime proofs through identity and reference casts, including constructor parameters, injected fields, and already-proven stable receiver chains. Matching unsubscriptions canonicalize across casted and uncast syntax, while user-defined conversions and unstable chains remain conservative and silent; DI027 and the code fixer are unchanged.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.15

What changed

Fixed

• DI025/DI026 identity-preserving publisher casts — event subscriptions now retain injected-receiver lifetime proofs through identity and reference casts, including constructor parameters, injected fields, and already-proven stable receiver chains. Matching unsubscriptions canonicalize across casted and uncast syntax, while user-defined conversions and unstable chains remain conservative and silent; DI027 and the code fixer are unchanged.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.14

DependencyInjection.Lifetime.Analyzers 2.18.14

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI018 value-type activation fidelity — default structs and enums registered by implementation type now report because the default container's reflection path cannot see their synthetic parameterless constructors and fails at first resolution. Structs with an explicitly declared public constructor remain valid, while factory and implementation-instance registrations stay quiet.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.14

What changed

Fixed

• DI018 value-type activation fidelity — default structs and enums registered by implementation type now report because the default container's reflection path cannot see their synthetic parameterless constructors and fails at first resolution. Structs with an explicitly declared public constructor remain valid, while factory and implementation-instance registrations stay quiet.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.13

DependencyInjection.Lifetime.Analyzers 2.18.13

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI021 stable shared lock monitors — lock suppression now rejects monitor fields, outer locals, and captured parameters that the concurrent handler writes. Replacing the monitor inside an invocation can make handlers lock different objects, so those shared-state accesses continue to report; stable shared monitors remain valid serialization guards.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.13

What changed

Fixed

• DI021 stable shared lock monitors — lock suppression now rejects monitor fields, outer locals, and captured parameters that the concurrent handler writes. Replacing the monitor inside an invocation can make handlers lock different objects, so those shared-state accesses continue to report; stable shared monitors remain valid serialization guards.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.12

DependencyInjection.Lifetime.Analyzers 2.18.12

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI021 invocation-local lock parameters — serialization suppression now requires a parameter monitor to be declared outside the concurrent handler. Locking the handler's own parameter no longer hides shared-state diagnostics because different invocations can receive different monitor objects; a parameter captured from the enclosing method remains a valid shared lock.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.12

What changed

Fixed

• DI021 invocation-local lock parameters — serialization suppression now requires a parameter monitor to be declared outside the concurrent handler. Locking the handler's own parameter no longer hides shared-state diagnostics because different invocations can receive different monitor objects; a parameter captured from the enclosing method remains a valid shared lock.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.11

DependencyInjection.Lifetime.Analyzers 2.18.11

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI021/DI022 symbol-bound concurrency knobs — strengthen-only fallback scans now accept a constant concurrency value only when the assignment binds to the expected SDK option property for Service Bus, RabbitMQ, ParallelOptions, or TPL Dataflow. Unrelated user properties with names such as MaxConcurrentCalls or ConsumerDispatchConcurrency no longer upgrade a config-gated DI022 Info diagnostic into a false DI021 Warning.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.11

What changed

Fixed

• DI021/DI022 symbol-bound concurrency knobs — strengthen-only fallback scans now accept a constant concurrency value only when the assignment binds to the expected SDK option property for Service Bus, RabbitMQ, ParallelOptions, or TPL Dataflow. Unrelated user properties with names such as MaxConcurrentCalls or ConsumerDispatchConcurrency no longer upgrade a config-gated DI022 Info diagnostic into a false DI021 Warning.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.10

DependencyInjection.Lifetime.Analyzers 2.18.10

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI017 MEDI constructor-set fidelity — circular-dependency analysis now mirrors the default container's resolvable-constructor ambiguity rule: the greediest constructor is selected only when its resolved service-identifier set contains every other resolvable constructor's service identifiers. Equivalent constructors whose parameters are reordered now expose real cycles, while non-superset constructor sets — including same-typed keyed parameters requesting different keys — stay silent because the container rejects them as ambiguous before activation.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.10

What changed

Fixed

• DI017 MEDI constructor-set fidelity — circular-dependency analysis now mirrors the default container's resolvable-constructor ambiguity rule: the greediest constructor is selected only when its resolved service-identifier set contains every other resolvable constructor's service identifiers. Equivalent constructors whose parameters are reordered now expose real cycles, while non-superset constructor sets — including same-typed keyed parameters requesting different keys — stay silent because the container rejects them as ambiguous before activation.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.9

DependencyInjection.Lifetime.Analyzers 2.18.9

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI014 conditional/coalesce ownership transfer — root-provider disposal and caller-ownership proofs now follow BuildServiceProvider() results through ternary arms and null-coalescing operands. Returned providers and providers assigned to reliably disposed locals, fields, or properties no longer produce false positives, including nested transparent wrappers; user-defined conversions still break the same-instance proof and report.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.9

What changed

Fixed

• DI014 conditional/coalesce ownership transfer — root-provider disposal and caller-ownership proofs now follow BuildServiceProvider() results through ternary arms and null-coalescing operands. Returned providers and providers assigned to reliably disposed locals, fields, or properties no longer produce false positives, including nested transparent wrappers; user-defined conversions still break the same-instance proof and report.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.8

DependencyInjection.Lifetime.Analyzers 2.18.8

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI020 direct static UseMiddleware calls — middleware activation analysis now recognizes generic and direct-typeof(T) non-generic calls made through the framework UseMiddlewareExtensions class. Receiver, middleware, and explicit activation arguments are bound by declared parameter, including reordered named arguments and expanded params; runtime Type values and user-defined same-named static helpers remain conservative and silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.8

What changed

Fixed

• DI020 direct static UseMiddleware calls — middleware activation analysis now recognizes generic and direct-typeof(T) non-generic calls made through the framework UseMiddlewareExtensions class. Receiver, middleware, and explicit activation arguments are bound by declared parameter, including reordered named arguments and expanded params; runtime Type values and user-defined same-named static helpers remain conservative and silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.7

DependencyInjection.Lifetime.Analyzers 2.18.7

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI024 direct private helper loops — hosted-service analysis now follows one-hop, directly invoked private helpers in the same type declaration and applies the existing helper-local scope/service loop checks. Unsafe helper-local reuse now reports, while uncalled helpers, deferred lambda/local-function/query invocations, transitive helpers, and cross-method field flow remain conservative and silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.7

What changed

Fixed

• DI024 direct private helper loops — hosted-service analysis now follows one-hop, directly invoked private helpers in the same type declaration and applies the existing helper-local scope/service loop checks. Unsafe helper-local reuse now reports, while uncalled helpers, deferred lambda/local-function/query invocations, transitive helpers, and cross-method field flow remain conservative and silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.6

DependencyInjection.Lifetime.Analyzers 2.18.6

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI024 keyed service resolution — hosted-service reuse analysis now carries the compile-time service key through generic and direct-typeof(T) non-generic GetKeyedService/GetRequiredKeyedService calls. Keyed scoped services resolved once before a process-lifetime loop report, while scopes used only for the matching keyed singleton no longer warn; dynamic keys remain conservative and silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.6

What changed

Fixed

• DI024 keyed service resolution — hosted-service reuse analysis now carries the compile-time service key through generic and direct-typeof(T) non-generic GetKeyedService/GetRequiredKeyedService calls. Keyed scoped services resolved once before a process-lifetime loop report, while scopes used only for the matching keyed singleton no longer warn; dynamic keys remain conservative and silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.5

DependencyInjection.Lifetime.Analyzers 2.18.5

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI024 non-generic service resolution — hosted-service reuse analysis now understands framework GetRequiredService(typeof(T)) and IServiceProvider.GetService(typeof(T)) calls, including casts and null-forgiving wrappers. Scoped services resolved once before a process-lifetime loop report, while scopes used only for registration-proven singletons no longer produce an opaque-use warning; runtime Type values and user-defined same-named methods remain conservative and silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.5

What changed

Fixed

• DI024 non-generic service resolution — hosted-service reuse analysis now understands framework GetRequiredService(typeof(T)) and IServiceProvider.GetService(typeof(T)) calls, including casts and null-forgiving wrappers. Scoped services resolved once before a process-lifetime loop report, while scopes used only for registration-proven singletons no longer produce an opaque-use warning; runtime Type values and user-defined same-named methods remain conservative and silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.4

DependencyInjection.Lifetime.Analyzers 2.18.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI024 nested logical negation — hosted-service loop analysis now reduces nested ! operators by polarity before applying the existing cancellation, conjunction, disjunction, and De Morgan rules. Odd-parity cancellation loops such as while (!(!(!token.IsCancellationRequested))) report, while even-parity conditions and cancellation-plus-counter bounded loops remain silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.4

What changed

Fixed

• DI024 nested logical negation — hosted-service loop analysis now reduces nested ! operators by polarity before applying the existing cancellation, conjunction, disjunction, and De Morgan rules. Odd-parity cancellation loops such as while (!(!(!token.IsCancellationRequested))) report, while even-parity conditions and cancellation-plus-counter bounded loops remain silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.3

DependencyInjection.Lifetime.Analyzers 2.18.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI027 direct self-observer subscriptions — discarded BCL subscriptions such as observable.Subscribe(this) now report when this is bound to an IObserver<T> parameter, because the longer-lived observable directly retains the shorter-lived subscriber. Separate observer objects and non-observer overloads remain silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.3

What changed

Fixed

• DI027 direct self-observer subscriptions — discarded BCL subscriptions such as observable.Subscribe(this) now report when this is bound to an IObserver<T> parameter, because the longer-lived observable directly retains the shorter-lived subscriber. Separate observer objects and non-observer overloads remain silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.2

DependencyInjection.Lifetime.Analyzers 2.18.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI027 direct static extension calls — Rx subscriptions invoked as ObservableExtensions.Subscribe(source, handler) now receive the same discarded-token and lifetime analysis as source.Subscribe(handler). Bound extension-parameter mapping preserves named and reordered arguments, while non-extension static helpers and static callbacks remain silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.2

What changed

Fixed

• DI027 direct static extension calls — Rx subscriptions invoked as ObservableExtensions.Subscribe(source, handler) now receive the same discarded-token and lifetime analysis as source.Subscribe(handler). Bound extension-parameter mapping preserves named and reordered arguments, while non-extension static helpers and static callbacks remain silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.18.1

DependencyInjection.Lifetime.Analyzers 2.18.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI024 compound cancellation loops — hosted-service scope-per-iteration analysis now recognises parenthesised && and || compositions of long-running loop conditions and applies De Morgan semantics to negated cancellation-token conditions. Hoisted scopes and scoped services are reported when the compound condition can run for the host lifetime, while bounded conjunctions and unproven conditions remain silent.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.1

What changed

Fixed

• DI024 compound cancellation loops — hosted-service scope-per-iteration analysis now recognises parenthesised && and || compositions of long-running loop conditions and applies De Morgan semantics to negated cancellation-token conditions. Hoisted scopes and scoped services are reported when the compound condition can run for the host lifetime, while bounded conjunctions and unproven conditions remain silent.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.18.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.18

Release

What's Changed

• Update branding to 9.0.18 by @​vseanreesermsft in Update branding to 9.0.18 dotnet/aspnetcore#66983
• [release/9.0] (deps): Bump src/submodules/googletest from d72f9c8 to a721f1b by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from d72f9c8 to a721f1b dotnet/aspnetcore#66974
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#66717
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#66640
• [release/9.0] Update dependencies from dotnet/source-build-assets by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/source-build-assets dotnet/aspnetcore#66992
• [release/9.0] Add 1ES Unofficial pipeline for Components E2E tests by @​wtgodbe in [release/9.0] Add 1ES Unofficial pipeline for Components E2E tests dotnet/aspnetcore#66988
• [release/9.0] Bump Crypto.Xml to 8.0.3 for RepoTasks by @​wtgodbe in [release/9.0] Bump Crypto.Xml to 8.0.3 for RepoTasks dotnet/aspnetcore#66765
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#67104
• [release/9.0] Update npm dependencies by @​wtgodbe in [release/9.0] Update npm dependencies dotnet/aspnetcore#67143
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#67057
• [release/9.0] Update Microsoft Identity Web package versions to 3.15.1 by @​wtgodbe in [release/9.0] Update Microsoft Identity Web package versions to 3.15.1 dotnet/aspnetcore#67163
• [release/9.0] (deps): Bump src/submodules/googletest from a721f1b to 7140cd4 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from a721f1b to 7140cd4 dotnet/aspnetcore#67217
• [release/9.0] Update dependencies from dotnet/source-build-assets by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/source-build-assets dotnet/aspnetcore#67113
• [release/9.0] Reject ASCII control characters in cookie auth return URLs by @​github-actions[bot] in [release/9.0] Reject ASCII control characters in cookie auth return URLs dotnet/aspnetcore#67156

Full Changelog: dotnet/aspnetcore@v9.0.17...v9.0.18

9.0.17

Release

What's Changed

• Update branding to 9.0.17 by @​vseanreesermsft in Update branding to 9.0.17 dotnet/aspnetcore#66590
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#66482
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#66371
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#66661

Full Changelog: dotnet/aspnetcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

• [release/9.0] Update branding to 9.0.16 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.16 dotnet/aspnetcore#66206
• [release/9.0] Update NPM dependencies by @​wtgodbe in [release/9.0] Update NPM dependencies dotnet/aspnetcore#66051
• [release/9.0] Move off of dead-lettered Windows preview helix queue by @​wtgodbe in [release/9.0] Move off of dead-lettered Windows preview helix queue dotnet/aspnetcore#66219
• [release/9.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 dotnet/aspnetcore#66088
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65906
• [release/9.0] Fix lodash CVE by adding npm override for >=4.18.0 by @​wtgodbe in [release/9.0] Fix lodash CVE by adding npm override for >=4.18.0 dotnet/aspnetcore#66224
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65907
• [release/9.0] Update azure/msal-browser by @​github-actions[bot] in [release/9.0] Update azure/msal-browser dotnet/aspnetcore#66234
• [release/9.0] Stop overwriting Arcade default MicrosoftTemplateEngineAuthoringTasks… by @​wtgodbe in [release/9.0] Stop overwriting Arcade default MicrosoftTemplateEngineAuthoringTasks… dotnet/aspnetcore#66235
• [release/9.0] Use source-build-assets repo by @​NikolaMilosavljevic in [release/9.0] Use source-build-assets repo dotnet/aspnetcore#66278
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#66288
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#66316

Full Changelog: dotnet/aspnetcore@v9.0.15...v9.0.16

9.0.15

Release

What's Changed

• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/aspnetcore#65634
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65439
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65438
• [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea dotnet/aspnetcore#65587
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65706
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65731

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/aspnetcore#65294
• [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 dotnet/aspnetcore#65290
• [release/9.0] Remove package baseline by @​Copilot in [release/9.0] Remove package baseline dotnet/aspnetcore#65208
• [release/9.0] Set network isolation policy for aspnetcore-ci by @​github-actions[bot] in [release/9.0] Set network isolation policy for aspnetcore-ci dotnet/aspnetcore#65172
• [release/9.0] Package dotnet-getdocument from current TFM into top-level by @​wtgodbe in [release/9.0] Package dotnet-getdocument from current TFM into top-level dotnet/aspnetcore#65164
• [release/9.0] Fix URL format for JDK download on linux by @​github-actions[bot] in [release/9.0] Fix URL format for JDK download on linux dotnet/aspnetcore#65075
• [release/9.0] Disable parallel restore for Grpc JsonTranscoding by @​github-actions[bot] in [release/9.0] Disable parallel restore for Grpc JsonTranscoding dotnet/aspnetcore#65072
• [release/9.0] Update Ubuntu queue to 22.04 by @​wtgodbe in [release/9.0] Update Ubuntu queue to 22.04 dotnet/aspnetcore#65298
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65117
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65089
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65365
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65364
• [release/9.0] Disable parallel restore for linker tests by @​github-actions[bot] in [release/9.0] Disable parallel restore for linker tests dotnet/aspnetcore#65374
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65381
• [release/9.0] Switch to non-preview 2022 queue by @​github-actions[bot] in [release/9.0] Switch to non-preview 2022 queue dotnet/aspnetcore#65412

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

• Update branding to 9.0.13 by @​vseanreesermsft in Update branding to 9.0.13 dotnet/aspnetcore#64938
• [release/9.0] (deps): Bump src/submodules/googletest from 1b96fa1 to 9156d4c by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 1b96fa1 to 9156d4c dotnet/aspnetcore#64908
• [release/9.0] Pass container image correctly for source-build job in official build by @​akoeplinger in [release/9.0] Pass container image correctly for source-build job in official build dotnet/aspnetcore#64781
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64686
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64685
• [release/9.0] Update gradle by @​github-actions[bot] in [release/9.0] Update gradle dotnet/aspnetcore#64980
• Backport #​64657: Use shallow clones for CI jobs by @​Copilot in Backport #64657: Use shallow clones for CI jobs dotnet/aspnetcore#64677
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65012
• [release/9.0] Add .slnx fallback for TestHost content root discovery by @​Copilot in [release/9.0] Add .slnx fallback for TestHost content root discovery dotnet/aspnetcore#64953
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65046

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

• Update branding to 9.0.12 by @​vseanreesermsft in Update branding to 9.0.12 dotnet/aspnetcore#64248
• Update Microsoft.Build versions to 17.8.43 by @​MackinnonBuck in Update Microsoft.Build versions to 17.8.43 dotnet/aspnetcore#64277
• [release/9.0] (deps): Bump src/submodules/googletest from 9706f75 to 6ec14df by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9706f75 to 6ec14df dotnet/aspnetcore#64230
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64111
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64065
• [release/9.0] Upgrade to MacOS 15 for CI by @​wtgodbe in [release/9.0] Upgrade to MacOS 15 for CI dotnet/aspnetcore#64310
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#64312
• [release/9.0] Don't use netcoreapp2.1 in dotnet-get-document by @​wtgodbe in [release/9.0] Don't use netcoreapp2.1 in dotnet-get-document dotnet/aspnetcore#64351
• [release/9.0] AppContext for HttpSys CBT hardening by @​BrennanConroy in [release/9.0] AppContext for HttpSys CBT hardening dotnet/aspnetcore#64297
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64350
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64388
• [release/9.0] Delete signalr-daily-tests.yml by @​github-actions[bot] in [release/9.0] Delete signalr-daily-tests.yml dotnet/aspnetcore#64589
• [release/9.0] (deps): Bump src/submodules/googletest from 6ec14df to 1b96fa1 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 6ec14df to 1b96fa1 dotnet/aspnetcore#64580
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64503

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

• Update branding to 9.0.11 by @​vseanreesermsft in Update branding to 9.0.11 dotnet/aspnetcore#63950
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63677
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63678
• [release/9.0] (deps): Bump src/submodules/googletest from eb2d85e to 9706f75 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from eb2d85e to 9706f75 dotnet/aspnetcore#63894
• [release/9.0] Fixed devtools url used for debug with chrome and edge by @​github-actions[bot] in [release/9.0] Fixed devtools url used for debug with chrome and edge dotnet/aspnetcore#61948
• [release/9.0] (http2): Lower WINDOWS_UPDATE received on (half)closed stream to stream abortion by @​DeagleGross in [release/9.0] (http2): Lower WINDOWS_UPDATE received on (half)closed stream to stream abortion dotnet/aspnetcore#63934
• [release/9.0] Re-quarantine ServerRoutingTest.NavigationLock_OverlappingNavigationsCancelExistingNavigations_HistoryNavigation by @​github-actions[bot] in [release/9.0] Re-quarantine ServerRoutingTest.NavigationLock_OverlappingNavigationsCancelExistingNavigations_HistoryNavigation dotnet/aspnetcore#63956
• [release/9.0] Fix nginx install on mac, linux by @​wtgodbe in [release/9.0] Fix nginx install on mac, linux dotnet/aspnetcore#63966
• [Hot Reload] Do not attempt to apply empty deltas. by @​tmat in [Hot Reload] Do not attempt to apply empty deltas. dotnet/aspnetcore#63979
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#64036
• Revert log level severity for unknown proxy in ForwardedHeadersMiddleware by @​BrennanConroy in Revert log level severity for unknown proxy in ForwardedHeadersMiddleware dotnet/aspnetcore#64091
• Set timeoutInMinutes to 0 for Windows build job by @​vseanreesermsft in Set timeoutInMinutes to 0 for Windows build job dotnet/aspnetcore#64126

Full Changelog: dotnet/aspnetcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

• Update branding to 9.0.10 by @​vseanreesermsft in Update branding to 9.0.10 dotnet/aspnetcore#63510
• [9.0] Make duplicate deb/rpm packages so we can sign them with the new PMC key by @​jkoritzinsky in [9.0] Make duplicate deb/rpm packages so we can sign them with the new PMC key dotnet/aspnetcore#63249
• [release/9.0] Extend Unofficial 1ES template in IdentityModel nightly tests job by @​github-actions[bot] in [release/9.0] Extend Unofficial 1ES template in IdentityModel nightly tests job dotnet/aspnetcore#63465
• [release/9.0] (deps): Bump src/submodules/googletest from 373af2e to eb2d85e by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 373af2e to eb2d85e dotnet/aspnetcore#63501
• [release/9.0] Quarantine ResponseBody_WriteContentLength_PassedThrough by @​wtgodbe in [release/9.0] Quarantine ResponseBody_WriteContentLength_PassedThrough dotnet/aspnetcore#63533
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63304
• [release/9.0] [OpenAPI] Use invariant culture for TextWriter by @​martincostello in [release/9.0] [OpenAPI] Use invariant culture for TextWriter dotnet/aspnetcore#62239
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63303
• Unquarantine RadioButtonGetsResetAfterSubmittingEnhancedForm by @​ilonatommy in Unquarantine RadioButtonGetsResetAfterSubmittingEnhancedForm dotnet/aspnetcore#63556
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63577
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#63604
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63648
• backport(9.0): Fix runtime architecture detection logic in ANCM. by @​DeagleGross in backport(9.0): Fix runtime architecture detection logic in ANCM. dotnet/aspnetcore#63707

Full Changelog: dotnet/aspnetcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

• Update branding to 9.0.9 by @​vseanreesermsft in Update branding to 9.0.9 dotnet/aspnetcore#63107
• [release/9.0] (deps): Bump src/submodules/googletest from c67de11 to 373af2e by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from c67de11 to 373af2e dotnet/aspnetcore#63035
• [release/9.0] Dispose the certificate chain elements with the chain by @​github-actions[bot] in [release/9.0] Dispose the certificate chain elements with the chain dotnet/aspnetcore#62992
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#62702
• [release/9.0] Update Microsoft.Build versions by @​wtgodbe in [release/9.0] Update Microsoft.Build versions dotnet/aspnetcore#62505
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#62832
• [release/9.0] Update SignalR Redis tests to use internal Docker Hub mirror by @​github-actions[bot] in [release/9.0] Update SignalR Redis tests to use internal Docker Hub mirror dotnet/aspnetcore#63116
• [release/9.0] [SignalR] Don't throw for message headers in Java client by @​github-actions[bot] in [release/9.0] [SignalR] Don't throw for message headers in Java client dotnet/aspnetcore#62783
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#63151
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63190
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63214

Full Changelog: dotnet/aspnetcore@v9.0.8...v9.0.9

9.0.7

Release

What's Changed

• Update branding to 9.0.7 by @​vseanreesermsft in Update branding to 9.0.7 dotnet/aspnetcore#62242
• [release/9.0] (deps): Bump src/submodules/googletest from 04ee1b4 to e9092b1 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 04ee1b4 to e9092b1 dotnet/aspnetcore#62199
• Fix OpenApiJsonSchema array parsing (#​62051) by @​BrennanConroy in Fix OpenApiJsonSchema array parsing (#62051) dotnet/aspnetcore#62118
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61986
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61945
• [release/9.0] Update Alpine helix references by @​wtgodbe in [release/9.0] Update Alpine helix references dotnet/aspnetcore#62240
• [Backport 9.0] [IIS] Manually parse exe bitness (#​61894) by @​BrennanConroy in [Backport 9.0] [IIS] Manually parse exe bitness (#61894) dotnet/aspnetcore#62038
• [release/9.0] Associate tagged keys with entries so replacements are not evicted by @​github-actions in [release/9.0] Associate tagged keys with entries so replacements are not evicted dotnet/aspnetcore#62248
• [release/9.0] Block test that is failing after switching to latest-chrome by @​github-actions in [release/9.0] Block test that is failing after switching to latest-chrome dotnet/aspnetcore#62283
• [release/9.0] Update dependencies from dotne...

Description has been truncated

[what-the-diff]

PR Summary

• Dependency Injection package update
  The version of the package responsible for managing how different parts of our application work together (DependencyInjection.Lifetime.Analyzers) has been updated from 2.18.0 to 2.18.24. This can lead to more efficient and better-structured code.

• System.IO.Hashing package update
  The package that helps us manage file and data verification (System.IO.Hashing) was upgraded from version 10.0.8 to 10.0.10. This helps ensure data integrity and security in our app.

• System.ServiceModel.Syndication package updates for different target frameworks
  We have updated the package System.ServiceModel.Syndication (used for creating and consuming RSS feeds) for both the net8.0 and net9.0 target frameworks, from versions 8.0.0 and 9.0.0 respectively to 9.0.18. This may enable cleaner data sharing and receiving capabilities.

• Microsoft.Extensions.Http.Polly package updates for different target frameworks
  The version of Microsoft.Extensions.Http.Polly has been updated for the net8.0 and net9.0 target frameworks, from versions 8.0.0 and 9.0.0 respectively to 9.0.18. This package helps the app better handle errors and retries when making network requests, thereby providing a smoother functioning of our web services.

[dependabot]

Superseded by #321.