Skip to content

Bump BenchmarkDotNet and 6 others - #336

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-dependencies-1ae2f701b6
Closed

Bump BenchmarkDotNet and 6 others#336
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-dependencies-1ae2f701b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Updated BenchmarkDotNet from 0.14.0 to 0.15.8.

Release notes

Sourced from BenchmarkDotNet's releases.

0.15.8

This release adds OpenMetrics exporter support for Prometheus-compatible metrics export, improves the Roslyn analyzers with multi-target support and better type checking, and fixes several bugs including process deadlocks and WASM trimming issues.

Features

  • Add OpenMetrics exporter for Prometheus-compatible metrics output (#​2801)
  • Add Job info to DisassemblyDiagnoser report headers to distinguish assemblies when using multiple coreruns (#​2884, fixes #​2573)
  • Add NO_COLOR environment variable support for disabling console colors (#​2870)

Improvements

  • Multi-target analyzers with improved type assignability checking using semantic model (#​2866)
  • Add new analyzer diagnostic BDN1503 for better argument/params validation (#​2865, fixes #​2864)
  • Use PolySharp for [DynamicallyAccessedMembers] attribute polyfill (#​2883)
  • Refactor to use AsyncProcessOutputReader for cleaner process output handling (#​2878)

Bug Fixes

  • Fix process deadlock issue when reading process output (#​2877)
  • Fix WASM generated project being trimmed out (#​2872)
  • Allow filters to filter out every benchmark from a type without errors (#​2879, fixes #​2860)
  • Fix unhandled exception when running BenchmarkRunner.Run<T>() with arguments on invalid benchmark type (#​2880, fixes #​2724)

Internal

  • Update release workflow for analyzers (#​2882)
  • Improve docs building workflow
  • Cleanup #if-#endif preprocessor directives using PolySharp polyfills (#​2881)

Full Changelog: dotnet/BenchmarkDotNet@v0.15.7...v0.15.8

0.15.7

This release introduces Roslyn analyzers to catch incorrect BenchmarkDotNet usage at compile time, improves .NET Framework version detection, and updates OS detection support.

Features

  • Add Roslyn analyzers to detect incorrect usage of BenchmarkDotNet at compile-time (#​2837)
    • Validates benchmark class structure (public, non-sealed, generic constraints)
    • Checks [Arguments], [Params], and [ParamsAllValues] attribute usage
    • Verifies [GenericTypeArguments] requirements
    • Ensures only one baseline method per category
    • Validates BenchmarkRunner.Run invocations

Improvements

  • Improve .NET Framework version detection by retrieving version from TargetFrameworkAttribute (#​2682)
  • Bump Perfolizer 0.6.0 → 0.6.1, bringing updated Windows and macOS version detection in OsBrandHelper

Bug Fixes

  • Fix null reference handling and exception logging in TestCaseFilter for the test adapter
  • Fix flaky CI tests by increasing build timeout values (#​2854)

Internal

  • Improve release workflow in release.yaml

Full Changelog: dotnet/BenchmarkDotNet@v0.15.6...v0.15.7

0.15.6

v0.15.6

This release adds ref struct parameter support for [ArgumentsSource], fixes Native AOT runtime moniker resolution, and upgrades to Perfolizer 0.6.0 with the new Pragmastat statistical engine.

Features

  • Add ref struct parameter support for [ArgumentsSource] attribute, enabling Span<T> and ReadOnlySpan<char> parameters (#​2849)

Bug Fixes

  • Fix runtime moniker normalization for Native AOT targets (#​2852)

Improvements

  • Upgrade to Perfolizer 0.6.0 with Pragmastat statistical engine integration

Documentation

  • Add documentation for breaking changes related to disassembler native dependencies (#​2836)

Internal

  • Introduce GitHub Actions release workflow

Full Changelog: dotnet/BenchmarkDotNet@v0.15.5...v0.15.6

0.15.5

This release fixes job naming consistency when using --runtimes, clamps histogram bin bounds to avoid confusing negative values, and reduces output directory clutter by filtering unnecessary runtime and satellite assembly files.

Features

  • Add custom MSBuild targets to remove unnecessary files from the bin directory (#​2737)
    • Filters out Capstone native binaries for non-target platforms
    • Removes satellite assemblies from Microsoft.CodeAnalysis packages

Bug Fixes

  • Fix job names consistency between SimpleJobAttribute and --runtimes CLI option (#​2841)
    • Jobs now use runtime names as IDs consistently across all runtime monikers
  • Clamp histogram bin lower bounds to non-negative values (#​1821)
    • Prevents confusing negative values in histogram output for non-negative measurements

Internal

  • Bump Perfolizer: 0.5.3 → 0.5.4 (#​2773)
  • Update changelog and GitHub Pages generation workflows
  • Enable workflow_dispatch for test workflow (#​2835)

Full Changelog: dotnet/BenchmarkDotNet@v0.15.4...v0.15.5

0.15.4

This release fixes issues with ParamsSource attribute resolution in inheritance scenarios and corrects a MSBuild syntax error in the TestAdapter.

Bug Fixes

  • Allow [ParamsSource] to resolve overridden methods and properties in derived classes (#​2832)
  • Fix MSBuild condition syntax for TestTfmsInParallel property that prevented Visual Studio from loading projects (#​2831)

Full Changelog: dotnet/BenchmarkDotNet@v0.15.3...v0.15.4

0.15.3

This release brings .NET 10 NativeAOT instruction set support, improved CPU detection on Windows when WMIC is unavailable, test adapter filtering, and numerous bug fixes.

Breaking Changes

  • Deprecated .WithNuget() job extension in favor of .WithMsBuildArguments() (#​2812)

Features

  • Add VS Test Adapter filter support for running specific benchmarks (#​2788)
  • Update NativeAOT instruction set support for .NET 10+ (#​2828)

Improvements

  • Add PowerShell-based CPU detection fallback for Windows when WMIC is unavailable (#​2749)
  • Improve IsNetCore and IsNativeAOT detection for single-file apps without AOT (#​2799)
  • Use --nodeReuse:false for dotnet CLI commands to improve build isolation (#​2814)
  • Enable assembly signing for debug builds (#​2774)

Bug Fixes

  • Fix ArgumentsSource on external types not working if the argument type is not primitive (#​2820)
  • Fix workload warmup mode not working correctly
  • Fix EtwProfiler for file paths slightly under 260 characters (#​2808)
  • Fix console logs being output twice when using TestAdapter (#​2790)
  • Fix EventProcessor.OnEndValidationStage not being called when critical validation errors occur (#​2816)
  • Fix XmlException thrown when TextReader.Null is passed to AppConfigGenerator (#​2817)
  • Fix case sensitivity issue in NativeMemoryLogParser program name matching (#​2795)
  • Fix typo in BuildPlots.R

Internal

  • Replace StyleCop.Analyzers with unstable version for improved analysis (#​2796)
  • Add workflow to run selected tests (#​2797)
  • Fix flaky MemoryDiagnoser tests on macOS (#​2813)
  • Fix x86 disassembler tests for net462 (#​2792)
  • Split TimeConsumingBenchmark class to reduce test time
  • Update BenchmarkDotNetDiagnosers package version (#​2805)
  • Fix comment in package props about GenerateProgramFile (#​2802)

Full Changelog: dotnet/BenchmarkDotNet@v0.15.2...v0.15.3

0.15.2

This release improves memory allocation measurement accuracy and adds new features for job ordering and runtime validation.

Features

  • Add JobOrderPolicy option to sort jobs in numeric order instead of ordinal order (#​2770)
  • Add RuntimeValidator to detect benchmarks with null runtime configuration (#​2771)

Improvements

  • Improve memory diagnoser accuracy with better allocation measurement isolation, warm-up phase, and handling of tiered JIT (#​2562)

Bug Fixes

  • Auto-generate unique job IDs between benchmark runs to prevent ID collisions
  • Skip null runtime validation for in-process toolchain (#​2780)
  • Fix flaky memory allocation test (#​2782)
  • Fix benchmark test adapter enumeration issues (#​2766)

Internal

  • Modify macOS runner image for CI (#​2775)
  • Add setting to skip test reports when original workflow is cancelled (#​2772)
  • Suppress xunit non-serializable data warnings (#​2769)
  • Enable --force-clone for docs-fetch in generate-gh-pages workflow
  • Allow workflow_dispatch for publish-nightly workflow
  • Enhance docs-fetch command with additional options
  • Remove docs/_changelog folder from main branch (migrated to docs-changelog branch)

Full Changelog: dotnet/BenchmarkDotNet@v0.15.1...v0.15.2

0.15.1

A maintenance release with improved cross-platform compatibility, a new feature for referencing external types in source attributes, and several bug fixes for ARM CPUs and unsupported operating systems.

Features

  • Allow [ArgumentsSource] and [ParamsSource] to reference methods in other types via new constructor overload: [ArgumentsSource(typeof(MyClass), nameof(MyClass.Values))] (#​2748)

Bug Fixes

  • Fix WakeLock P/Invoke compatibility with ARM CPUs by refactoring REASON_CONTEXT to use proper union structure (#​2745, #​2756)
  • Fix Console.CancelKeyPress crash on platforms that don't support it (Android, iOS, tvOS, WASM) (#​2739, #​2741)
  • Fix CPU detection crash on unsupported operating systems by returning CpuInfo.Unknown (#​2740)
  • Support .slnx solution file format when searching for solution files (#​2764)

Improvements

  • Bump Perfolizer: 0.5.2 → 0.5.3
  • Make ExporterBase.GetArtifactFullName accessibility modifier more permissive

Internal

  • Update .NET SDK version to 8.0.410 (#​2762)
  • Update Microsoft.NET.Test.Sdk and other package dependencies (#​2750, #​2755)
  • Rework changelog generation to use docs-changelog branch (#​93d12c42)
  • Fix line-endings to LF in several files
  • Update GitHub Actions workflows

Full Changelog: dotnet/BenchmarkDotNet@v0.15.0...v0.15.1

0.15.0

BenchmarkDotNet v0.15.0 brings .NET 10 support, a new WakeLock feature to prevent system sleep during benchmarks, improved engine internals for more consistent measurements, and numerous bug fixes and improvements.

Features

  • WakeLock support: New [WakeLock] attribute and --wakeLock CLI option to prevent the system from entering sleep mode while benchmarks are running (#​2670)
  • .NET 10 support: Added RuntimeMoniker.Net10, NativeAot10, and Mono10 with full toolchain support (#​2642)
  • Box plots in ScottPlotExporter: New box plot visualization for benchmark results with improved font sizing
  • RiscV64 platform support: Added Platform.RiscV64 for RISC-V 64-bit architecture (#​2644, #​2647)
  • Required properties support: Benchmark classes can now use C# 11 required properties (#​2579)
  • HostSignal.AfterProcessStart: New signal allows diagnosers to obtain the process ID of a benchmark process started in suspended state (#​2674)
  • Parallel build control: New ConfigOptions.DisableParallelBuild option to force sequential builds (#​2725)
  • Auto-hide empty metric columns: ThreadingDiagnoser and ExceptionDiagnoser now support configuration to hide columns when metrics have no values (#​2673)
  • Measurements in DiagnoserResults: Custom diagnosers can now access measurements for calculations (#​2731)

Improvements

  • Constant stack size engine refactoring: Engine stages refactored to use IEngineStageEvaluator for more consistent instruction location and simpler code (#​2688)
  • Use ArtifactsPath instead of IntermediateOutputPath: Improved build artifact handling for SDK 8+ (#​2676)
  • InProcessNoEmitRunner NativeAOT support: Basic support for running InProcessNoEmitRunner with NativeAOT (#​2702)
  • Allow ParamsAttribute values from derived classes: ParamsAttribute.Values setter is now protected instead of private (#​2716)
  • Updated clrmd to 3.1: Disassembler now uses ClrMdV3Disassembler (#​2488)
  • Updated ScottPlot to 5.0.54: Plotting exporter updated to latest ScottPlot version (#​2709)
  • Perfolizer upgraded to 0.5.2: CPU/OS detection logic moved to Perfolizer with new Perfonar exporters replacing Phd exporters
  • Log warnings for empty benchmarks: Clear warning messages when running benchmarks that match no methods (#​2718)
  • Validation for sealed benchmark classes: Compiler now warns when benchmark classes are sealed (#​2660)
  • Improved baseline warning message: More descriptive warning when baseline benchmarks are misconfigured (#​2650)

Bug Fixes

  • Fix async GlobalSetup/GlobalCleanup with InProcessEmit: Async setup and cleanup methods are now properly awaited (#​2109)
  • Fix Windows path too long: Handle Windows MAX_PATH limitations in build paths (#​2681)
  • Fix builds with --keepFiles: Include auto-incremented ID in build artifacts directory to avoid conflicts (#​2423)
  • Fix Ctrl-C handling: System state (power management, console title) is now properly reverted on process termination (#​2483, #​2661)
  • Fix dotnet command failure detection: Commands now always fail when dotnet returns non-zero exit code (#​2535)
  • Fix deadlock in GetDotNetSdkVersion: Resolved potential deadlock in SDK version detection (#​2622)
  • Fix lscpu CPU frequency parsing: Corrected frequency parsing from lscpu output
  • Make lscpu call language-invariant: CPU detection now works correctly regardless of system locale (#​2577)
  • Clean up unsupported Native AOT flags: Removed obsolete IlcGenerateCompleteTypeMetadata and updated flag names (#​2616)
  • Native AOT projects copy SettingsWeWantToCopy: Build settings are now properly propagated (#​2665)

Breaking Changes

  • Removed ConfigCompatibilityValidator: No longer validates config compatibility between runs (#​2599)
  • Phd exporters renamed to Perfonar: [PhdExporter][PerfonarExporter], PhdJsonExporterPerfonarJsonExporter, PhdMdExporterPerfonarMdExporter
  • Removed netstandard1.0 target from Annotations package: Minimum target is now netstandard2.0

Documentation

  • Added Visual Studio Profiler documentation with samples (#​2672)
  • Added WakeLock documentation and samples (#​2670)
    ... (truncated)

Commits viewable in compare view.

Pinned Confluent.Kafka at 2.15.0.

Release notes

Sourced from Confluent.Kafka's releases.

2.15.0

Upgrade considerations

Ensure you're not calling StoreOffset with an EOF message.
As when calling Commit with an EOF message, it will throw an InvalidOperationException.
Previously this could cause skipping an offset (<2.1.0) or message reprocessing (>=2.1.0).

New features

  • New optional package Confluent.Kafka.OAuthBearer.Aws provides AWS IAM-based
    OAUTHBEARER authentication via AWS STS GetWebIdentityToken. Activate by
    setting SaslOauthbearerMethod = SaslOauthbearerMethod.Oidc,
    SaslOauthbearerMetadataAuthenticationType.AwsIam, and supplying
    region and audience in SaslOauthbearerConfig. See the package's README
    for details.

Enhancements

  • References librdkafka.redist 2.15.0. Refer to the librdkafka v2.15.0 release notes for more information.
  • Added support for .NET 10 (LTS) and dropped support for .NET 6 (end of support since November 2024). The library now multi-targets net8.0 and net10.0 alongside netstandard2.0 and net462. Builds on the approach proposed in #​2545 by @​ffernandolima, adapted for the centralized Directory.Build.props structure on current master.
  • Adds support for union-of-pools/ auto pool mapping for Schema Registry (#​2634)

Fixes

  • Throw an InvalidOperationException when calling StoreOffset with an EOF consume result, to match Commit behavior (#​2621)
  • Handle non-http errors during retries (#​2633)

2.14.2

Enhancements

  • References librdkafka.redist 2.14.2. Refer to the librdkafka v2.14.2 release notes for more information.
  • Add IHeader overload to Headers.Add() method (#​2604)

Fixes

  • Handle anyOf/allOf in JSON transforms (#​2611)
  • Allow encrypting enum for JObject in dotnet (#​2615)
  • Fix 'occured' -> 'occurred' typo in ConsumeException XML doc comments (#​2609)

2.14.0

Enhancements

  • References librdkafka.redist 2.14.0. Refer to the librdkafka v2.14.0 release notes for more information.
  • Add AssociatedNameStrategy (#​2577)
  • Add enableAt to RuleSet (#​2593)
  • Add config to validate before domain rules for JSON Schema (#​2596)
  • Cache FieldAccessor to address CSFLE perf with JSON (#​2601)

Fixes

  • Ensure dispose methods clean up properly (#​2595)

2.13.2

Enhancements

  • Preserve inner exceptions in RestService (#​2571)

Fixes

  • Support multi-certificate PEM bundles in Schema Registry SslCaLocation (#​2576)

2.13.1

Enhancements

  • Unify build configurations and remove redundant properties (#​2464)
  • JSONSchema Validation Errors: Include paths to nested properties (#​2554)
  • Add Confluent-Client-Version header to requests to SR, C# client (#​2549)

Fixes

  • Fix DeriveKey in Hkdf implementation (#​2559)
  • Ensure single use of HttpRequestMessage for token fetch (#​2544)
  • Fix race conditions when retrieving KEK/DEK (#​2565)
  • Allowing for Confluent-Identity-Pool-Id to be optional (#​2564)
  • Ensure JSON schema access is thread-safe (#​2567)
  • Use lock on root schema when protecting access to subschemas (#​2568)
  • Processing arrays and maps sequentially to avoid race conditions (#​2569)

2.13.0

Enhancements

  • References librdkafka.redist 2.13.0. Refer to the librdkafka v2.13.0 release notes for more information.
  • Support Avro schema references for C# client (#​2534)
  • Add Accept-Version header (#​2536)
  • Handle evolution during field transformation (#​2541)
  • Re-enable deserialization optimization by removing unnecessary array conversions (#​2531)

Fixes

  • Ensure schemaId initialization is thread-safe (#​2540)
  • Ensure all deps are strongly named (#​2548)

2.12.0

KIP-848 – General Availability

Starting with Confluent.Kafka 2.12.0, the next generation consumer group rebalance protocol defined in KIP-848 is production-ready. Please refer to the following migration guide for moving from Classic to Consumer protocol.

Note: The new consumer group protocol defined in KIP-848 is not enabled by default. There are few contract change associated with the new protocol and might cause breaking changes. GroupProtocol configuration property dictates whether to use the new Consumer protocol or older Classic protocol. It defaults to Classic if not provided.

Enhancements

  • References librdkafka.redist 2.12.0. Refer to the librdkafka v2.12.0 release notes for more information.
  • OAuth OIDC method example for Kafka metadata based authentication with
    an Azure IMDS endpoint using an attached managed identity as principal (#​2526).

2.11.1

Enhancements

2.11.0

Enhancements

2.10.1

Enhancements

2.10.0

Enhancements

  • References librdkafka.redist 2.10.0. Refer to the librdkafka v2.10.0 release notes for more information.
  • [KIP-848] Group Config is now supported in AlterConfigs, IncrementalAlterConfigs and DescribeConfigs. (#​2366)

2.9.0

Enhancements

  • Add utilities to convert decimals from/to Protobuf (#​2424)
  • Add client credentials OAuth support (#​2426)
  • Add support for passing schema ID during serialization (#​2428)
  • Optimize schema registry client by caching results of LookupSchemaAsync (#​2429)
  • Use ConcurrentDictionary as default cache for Schema Registry client (#​2433)

Fixes

  • Fix JSON Schema validation to use latest schema if needed (#​2406)
  • Support Protobuf oneof fields in Data Contract rules (#​2413)

2.8.0

v2.8.0 is a feature release with the following features, fixes and enhancements:

Enhancements

  • References librdkafka.redist 2.8.0. Refer to the librdkafka v2.8.0 release notes for more information.
  • Add retry logic to RestService for Schema Registry (#​2353)
  • Add config for validating payloads against JSON Schema (#​2350)
  • Add ability to override disable flag and actions on a rule (#​2377)
  • Add AWS AssumeRole support to AWS KMS (#​2379)

Fixes

  • Retrieve version for writer schema when getting migrations (#​2358)
  • Add missing JSON Schema validate check (#​2372)
  • Ensure different key ids use different client instances (#​2374)
  • DGS-19409 Ensure Avro serde caches per subject (#​2387)
  • Update hash code for schema references so they can be retrieved correctly (#​2390)

Commits viewable in compare view.

Updated Grpc.Net.Client from 2.80.0 to 2.83.0.

Release notes

Sourced from Grpc.Net.Client's releases.

2.83.0

What's Changed

New Contributors

Full Changelog: grpc/grpc-dotnet@v2.80.0...v2.83.0

2.83.0-pre1

What's Changed

New Contributors

Full Changelog: grpc/grpc-dotnet@v2.80.0...v2.83.0-pre1

Commits viewable in compare view.

Pinned Handlebars.Net at 2.4.3.

Release notes

Sourced from Handlebars.Net's releases.

2.4.3

A performance-focused release: rendering is up to 36% faster with up to 56% fewer allocations, and template compilation is up to 88% faster. No API or behavior changes — all improvements are behavior-preserving and were validated against the full test suite (1912 tests) and A/B benchmark runs at every step. (#​667, #​668)

Performance

Rendering — up to 36% faster, up to 56% fewer allocations (#​667)

Suite 2.4.2 2.4.3 Time Alloc
RenderToString clean 10.49 µs / 30.2 KB 7.48 µs / 13.4 KB −29% −56%
RenderToString html 13.15 µs / 33.4 KB 10.37 µs / 16.7 KB −21% −50%
RenderList 100 (object) 18.95 µs 12.16 µs −36%
RenderList 1000 (dictionary) 191.3 µs 126.7 µs −34%
RenderNested 20 (object) 19.18 µs 12.44 µs −35%
RenderSimple (object) 636 ns 431 ns −32%
EndToEnd 26.1 µs 23.5 µs −10%

What changed:

  • Cache helper-resolver presence in the late-bind descriptors. ObservableList<T>.Count acquires a ReaderWriterLockSlim per call, and every simple {{name}} paid it once per render — loops paid hundreds of lock acquisitions per render. The descriptors now subscribe once to the append-only resolver list and keep a flag; resolvers registered after compile still take effect.
  • Retain up to 32K chars in the pooled ReusableStringWriter. Outputs over 4096 chars discarded the pooled writer every render, re-growing a fresh StringBuilder(16) chunk by chunk — most of RenderToString's allocations.
  • Monomorphic descriptor cache on ChainSegment. Dotted member access re-resolved the instance's ObjectDescriptor through the ambient context + type-keyed lookup on every segment per render; each segment now holds an immutable (factory, version, type) → descriptor entry, self-invalidated via a version stamp when descriptor providers are registered.
  • Skip the frame-helper cascade walk when no frame-local helpers exist (decorator / in-render registration is tracked per frame).
  • Skip the ConditionalWeakTable probe in SafeStrings until a safe-marked string is ever produced.
  • Read ThrowOnUnresolvedBindingExpression only on the unresolved branch of path resolution.
  • Cheaper falsy checks: typed zero comparisons instead of Convert.ToBoolean dispatch, an O(1) ICollection.Count emptiness fast path, and enumerator disposal in Any().

Compilation — up to 88% faster (#​668)

Benchmark 2.4.2 2.4.3 Change
Compilation (nested 3-level template) 10.80 ms 1.85 ms −83%
CompileMany N=10 57.7 ms 6.97 ms −88%
CompileMany N=100 537.9 ms 78.1 ms −85%

Template compile time turned out to be dominated by the JIT compiling each template's dynamic method at CreateDelegate, inline-expanding the [AggressiveInlining] write/encoder machinery into every mustache call site of every template. The compiler now emits thin NoInlining static entry points that are JIT-compiled once per process. Render performance was verified unchanged by A/B guardrail benchmarks (the one variant that cost ~4% at render time was rejected and kept inline).

Compatibility notes

  • No public API changes; all new members are internal. Template semantics are unchanged, including late registration of helpers, helper resolvers, and descriptor providers after compile.
  • The ChainSegment descriptor cache allocates a small entry (~48 B) when a segment observes a new instance type; heterogeneous collections rendered through dotted access can re-allocate per type flip, while the common homogeneous case allocates once per segment ever.

Contributors

@​rexm

Full Changelog: Handlebars-Net/Handlebars.Net@2.4.2...2.4.3

2.4.2

Compatibility notes

  • The published package now includes a net10.0 target. CI was already building and testing against the .NET 10 SDK, and the test/benchmark projects already targeted net10.0, but the Handlebars library itself only shipped netstandard2.0, netstandard2.1, and net8.0 — so .NET 10 apps silently fell back to the net8.0 binary. The package now ships a first-class net10.0 build alongside the existing targets. (#​666, fixes #​659)
  • No API or behavior changes. Existing targets are unchanged; consumers on .NET 10 simply pick up the new target automatically on upgrade.

Contributors

@​rexm

Full Changelog: Handlebars-Net/Handlebars.Net@2.4.1...2.4.2

2.4.1

Fixes

Both regressions below were introduced on 2026-06-20 and shipped in 2.4.0 (released 2026-08-06). Neither was an intentional public API change — this release restores prior correct behavior.

  • Static template text no longer has its line endings silently rewritten. A fix for internal indentation handling started normalizing every \r\n/\r in static template text to \n, so a literal \r\n a caller wrote into a template string (e.g. between {{#each}} iterations) was silently turned into \n. Static text now round-trips verbatim, matching this library's long-standing behavior and handlebars.js. (#​663, fixes #​661)
  • Subexpression results are plain strings again, not an internal wrapper type. A fix for double-encoding across subexpression boundaries (#​543) wrapped every writer-based helper's captured output in an internal sealed class SafeString when used as a subexpression argument. Only a few internal call sites knew how to unwrap it — any other consumer, including reflection-based/typed helper binders in third-party packages (e.g. Handlebars.Net.Helpers), received an opaque type it could neither cast to string nor unwrap, throwing InvalidCastException. The double-encoding fix is preserved, but the signal is now carried by an invisible reference-keyed marker instead of a boxing type, so the value is a genuine System.String everywhere except the one place that needs to know. (#​664, fixes #​660)

Compatibility notes

  • No API surface changes. Both fixes are behavior reverts to what 2.3.0 and earlier already did; anything that worked before 2.4.0 works the same way again.
  • If your code adapted to either regression (e.g. expected \n-only output regardless of source line endings, or handled a SafeString-typed subexpression argument), that adaptation is no longer necessary but should remain harmless.

Contributors

@​rexm

Full Changelog: Handlebars-Net/Handlebars.Net@2.4.0...2.4.1

2.4.0

Performance

Rendering plain .NET objects and string-heavy templates got substantially faster this release, across three targeted changes to the hot rendering path:

  • ~10–33% faster object rendering, less allocationObjectDescriptor's member accessor is now pre-bound to its described type instead of re-resolving through a shared type-keyed lookup on every access, and bool property reads return cached boxed instances instead of allocating a fresh box per read. (#​652)
    Benchmark Case Before After Δ
    RenderSimple object 856.85 ns 575.79 ns −32.8%
    RenderNested object, rows=20 24.52 us 18.94 us −22.7%
    RenderList N=100, object 27.48 us 22.77 us −17.1%
  • ~10–20% faster string-heavy rendering — HTML encoders now bulk-write clean runs of text via SearchValues<char> (net8.0+) or a plain scan (netstandard) instead of one TextWriter.Write(char) call per character, falling back to the original per-character path only where escaping is actually needed. Output is byte-for-byte identical. (#​651)
    Benchmark Case Before After Δ
    RenderSimple dictionary 509.96 ns 399.20 ns −21.7%
    RenderList N=100, object 27.48 us 22.05 us −19.8%
    RenderToString clean 13.95 us 10.97 us −21.4%
  • Zero-allocation {{#each}} iteration — the boxed-integer cache used for iterator indexes grew from 20 to 1024 entries, eliminating a 24-byte-per-item allocation that was the dominant remaining allocation source in list rendering (e.g. 23.5 KB → 0 B for a 1000-item {{#each}}). (#​653)

Combined, typical object-rendering and list-rendering templates should see meaningfully lower latency and near-zero allocation on the common paths; dictionary/expando-backed templates benefit from the encoder work but were otherwise already efficient.

New features

  • Nullable Reference Types — the entire public API surface is now annotated for Nullable Reference Types. Binary- and runtime-compatible (annotations are compile-time metadata only); projects without <Nullable>enable</Nullable> are unaffected. Nullable-enabled consumers get compiler-checked null contracts on the public API, and extensibility interfaces (IPartialTemplateResolver, ITextEncoder, IMemberAccessor, IHelperResolver, IFormatterProvider, IObjectDescriptorProvider, IHelperDescriptor<T>, ViewEngineFileSystem) gained nullability annotations that may surface mismatch warnings (e.g. CS8767) in existing implementations until updated. (#​642, @​TheConstructor)
  • System.Text.Json.JsonElement support — first-class support for JsonElement (e.g. the result of JsonSerializer.Deserialize<object>(json)) in templates: nested member access, {{#each}} iteration over both JSON objects and arrays, and correct {{#if}}/{{#unless}} truthiness — bringing it to parity with the existing Newtonsoft JObject/JToken support. (#​657)
  • Multi-dimensional array support — true C# multi-dimensional arrays (e.g. int[,]) can now be indexed via path expressions ({{grid.[0].[1]}}) and iterated with {{#each}}, which walks the outer-most dimension and yields row/slab slices for the rest. Jagged arrays and existing IList/IEnumerable behavior are unaffected. (#​649)
  • else if chaining for block helpers{{else name args}}...{{/outer}} now works for any block helper, not just {{#if}}, and chains recursively to any depth, e.g. {{#StringEqualityBlockHelper @​value 'dog'}}...{{else StringEqualityBlockHelper @​value 'cat'}}...{{else}}...{{/StringEqualityBlockHelper}}. (#​648)

Fixes

  • Properties whose only implementation is a C# 8+ default interface member (declared and bodied on an interface, not overridden by the concrete class) are now resolved correctly by both {{PropertyName}} lookup and {{#each this}} enumeration, instead of being silently skipped. (#​658, fixes #​601)
  • {{#*inline "name" ...}} no longer throws when passed hash arguments or extra positional arguments, matching Handlebars.js's inline decorator behavior. (#​647, fixes #​560)
  • Corrected the nullable annotation on Try* out-parameters for concrete reference types (introduced in #​642) from [MaybeNullWhen(false)] out T to [NotNullWhen(true)] out T?, matching BCL convention (e.g. Uri.TryCreate) and giving a stronger compiler guarantee against unchecked dereferences. Affects ~20 Try* methods across IObjectDescriptorProvider/ObjectDescriptor, IFormatterProvider, DynamicMemberAccessor, TypeExtensions, BindingContext, PathResolver, and BlockAccumulatorContext. Compile-time-only change, not binary breaking. (#​655, fixes #​654)
  • Resolved a SonarCloud reliability regression (A→B) surfaced by #​642's diff against two pre-existing mutable-array-exposure smells; Closure.A is now internal and PathInfo.Segments carries an explicit suppression. (#​656)

Compatibility notes

  • All changes in this release are binary-compatible. The Nullable Reference Types annotations and the NotNullWhen/MaybeNullWhen correction are compile-time metadata only.
  • If you implement IPartialTemplateResolver, ITextEncoder, IMemberAccessor, IHelperResolver, IFormatterProvider, IObjectDescriptorProvider, IHelperDescriptor<T>, or derive from ViewEngineFileSystem, and build with <Nullable>enable</Nullable>, you may see new nullability-mismatch warnings until your implementation's annotations are updated to match.
  • HandlebarsConfiguration.FileSystem is now declared nullable (ViewEngineFileSystem?), matching its actual default.
  • Built-in collection formatters now throw ArgumentNullException (with parameter name) instead of a raw NullReferenceException for null/mismatched values.

Contributors

@​TheConstructor, @​rexm

Full Changelog: Handlebars-Net/Handlebars.Net@2.2.0...2.4.0

2.3.0

Changes

  • Nullable Reference Types @​TheConstructor (#​642)

    The entire public API surface is now annotated for Nullable Reference Types.

    Compatibility notes:

    • Binary- and runtime-compatible. Nullability annotations are compile-time metadata only; generated IL is unchanged. Projects without <Nullable>enable</Nullable> are unaffected.
    • Nullable-enabled consumers get compiler-checked null contracts on the public API: Try* methods are annotated with [MaybeNullWhen(false)], optional parameters and nullable returns are declared with ?, etc.
    • If you implement extensibility interfaces, their signatures gained nullability annotations and your existing implementations may produce nullability-mismatch warnings (e.g. CS8767) until you add the matching ? annotations. Affected: IPartialTemplateResolver, ITextEncoder, IMemberAccessor, IHelperResolver, IFormatterProvider, IObjectDescriptorProvider, IHelperDescriptor<T>, and the ViewEngineFileSystem base class.
    • HandlebarsConfiguration.FileSystem is now declared nullable (ViewEngineFileSystem?), matching its actual default.
    • The built-in collection formatters now throw ArgumentNullException with a parameter name instead of a raw NullReferenceException when given a null or mismatched value.

Contributors

@​TheConstructor

Full Changelog: Handlebars-Net/Handlebars.Net@2.2.0...2.3.0

2.2.0

Handlebars.Net 2.2.0

⚠️ Behavior & compatibility changes — please read before upgrading

  • Dropped end-of-life target frameworks. Removed netstandard1.3, net451, and net6. The package now targets netstandard2.0, netstandard2.1, and net8.0. Modern consumers (.NET Framework 4.6.1+, .NET Core 2.0+, .NET 5/8+) are unaffected via netstandard2.0; only consumers on the removed legacy frameworks need to stay on 2.1.x.
  • Single quote (') is now HTML-encoded by default (#​546), matching Handlebars.js behavior. This is invisible when rendering HTML, but changes raw output bytes — review any exact-string or snapshot assertions on rendered output.

Bug fixes

  • Case-sensitive resolution of same-spelling path variables, resolved independently in PathBinder (#​434)
  • Case-sensitive key lookup for IDictionary/Hashtable (#​521) and DictionaryMemberAccessor (#​466)
  • @​partial-block now usable inside #if and as a block partial (#​519)
  • #if with includeZero=true now supported; includeZero honored in built-in conditional blocks (#​285)
  • Parent context traversal inside custom block helpers within #each (#​539)
  • Safe-string flag preserved when helper output crosses a subexpression boundary (#​543)
  • WriteSafeString encoding consistent regardless of helper registration order (#​559)
  • Preserve backslashes in template literal text (#​462) and double backslashes in static text (#​349)
  • Preserve partial indentation (#​614)
  • Handle escaped double-quotes in delimited string literal arguments (#​584)
  • Allow Unicode letters as first character in identifiers (#​416); strip invisible Unicode chars (BOM, etc.) from identifiers (#​605)
  • Clearer error when a partial is registered on the wrong Handlebars instance (#​545)
  • Removed byref/in delegate parameters incompatible with Mono/Xamarin (#​458)
  • Prevent unbounded DictionarySlim growth when replacing existing keys (#​541)
  • Normalize CRLF to LF in StaticConverter for platform-independent output

Maintenance

  • CI moved to windows-latest; bumped deprecated GitHub Actions and SDK versions; pinned third-party actions to commit SHAs
  • Resolved SonarCloud security/quality findings; dev environment updated to .NET 10
  • Added render-time/compile-scaling benchmark suite and Handlebars.js regression coverage

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.3.0 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

8.19.1

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.

8.19.0

New Features

  • Add ML-DSA (FIPS 204) post-quantum signature support. See PR #​3479.
  • Cache custom crypto providers in CryptoProviderFactory. See PR #​3489.

Bug Fixes

  • Disable automatic redirects on default HttpClient for JKU retrieval. See PR #​3494.
  • Adjust rented buffer handling in claim set parsing. See PR #​3493.
  • Tidy null handling in SAML conditions validation. See PR #​3491.
  • Improve validation of jku claim. See PR #​3481.
  • Limit telemetry algorithm dimension cardinality. See PR #​3490.
  • Add defensive copy of collections in ValidationParameters. See PR #​3492.
  • Update TokenValidationParameter copy constructor to make a deep copy. See PR #​3488.
  • Update to fail-closed when replay protection isn't configured and other DPoP hardening. See PR #​3505.
  • Apply RFC 3986 section 6.2.2 normalization to DPoP htu comparison. See PR #​3509.

8.18.0

New Features

  • Introduced a new interface IConfigurationEventHandlerContextAware<T> that provides context to the configuration event handler implementation, allowing it to optionally bypass a cache lookup. See PR #​3444.
  • Added Microsoft.IdentityModel.Dpop — a new package implementing DPoP (Demonstrating Proof-of-Possession) per RFC 9449. Provides both client-side and server-side proof validation with no System.Net.Http dependency. See PR #​3443.

8.17.0

Dependencies

  • Downgrade MicrosoftExtensionsLoggingAbstractionsVersion to 8.0.0 on .NET 10. See PR #​3435.

8.16.0

New Features

  • Add telemetry around signature validation. See PR #​3415 for details.

Fundamentals

  • Fix FileVersion format to use two-digit year and day of year. See PR #​3389 for details.

8.15.0

New Features

  • Add ECDsa support in X509SecurityKey and JsonWebKeyConverter.ConvertFromX509SecurityKey
    Extended X509SecurityKey and JsonWebKeyConverter.ConvertFromX509SecurityKey to support ECDSA keys.
    See PR #​2377 for details.

Bug Fixes

  • Sanitize logs to avoid leaking sensitive data
    Updated logging to sanitize sensitive values, reducing the risk of inadvertently exposing secrets or PII in logs.
    See PR #​3316 for details.
  • Optimize log sanitization with SearchValues
    Improved the performance of the log sanitization logic introduced earlier by using SearchValues, making sanitization more efficient in high-throughput scenarios.
    See PR #​3341 for details.
  • Update test for IDX10400
    Adjusted the IDX10400 test to align with the current behavior and error messaging.
    See PR #​3314 for details.

Fundamentals

  • Add supported algorithm tests
    Added new tests to validate the set of supported cryptographic algorithms, increasing confidence in algorithm coverage and compatibility.
    See PR #​3296 for details.
  • Migrate repository agent rules from .clinerules to agents.md
    Moved repository agent/AI-assist rules into markdown documentation to make them more visible and easier to maintain.
    See PR #​3313 for details.
  • Migrate Microsoft.IdentityModel.TestExtensions from Newtonsoft.Json to System.Text.Json
    Updated Microsoft.IdentityModel.TestExtensions to use System.Text.Json instead of Newtonsoft.Json, aligning tests with the runtime serialization stack.
    See PR #​3356 for details.
  • Disable code coverage comments
    Turned off automated code coverage comments on PRs to reduce noise while retaining coverage data elsewhere.
    See PR #​3349 for details.
  • Fix CodeQL alerts
    Addressed CodeQL-reported issues to improve security posture and static analysis cleanliness.
    See PR #​3364 for details.

.NET 10 / SDK and tooling updates

  • Building with .NET 10 preview / RC 1
    Updated the repository to build and test against .NET 10.0 preview/RC1, ensuring early compatibility with the upcoming runtime.
    See PRs #​3287, #​3357, and #​3358 for details.
  • Fix .NET 10 test execution consistency
    Ensured consistent use of the TargetNetNext parameter across build, test, and pack phases so .NET 10.0 tests execute reliably.
    See PR #​3337 for details.
  • Update project files and workflows for .NET 10.0 compatibility
    Adjusted project files and CI workflows to correctly target and run on .NET 10.0, including test and pack scenarios.
    See PR #​3363 for details.
  • Update .NET version to meet CG compliance
    Updated the .NET version references to be compliant with corporate governance (CG) requirements.
    See PR #​3353 for details.
  • Update Coverlet collector and test SDK
    • Bumped CoverletCollectorVersion to 6.0.4.
      See PR #​3333 for details.
    • Upgraded Microsoft.NET.Test.Sdk to a newer version for improved test reliability and tooling support.
      ... (truncated)

8.14.0

8.14.0

Bug Fixes

  • Switch back to use ValidationResult instead of OperationResult when validating a token in a new experimental validation flow. Additionally removed the dependency on Microsoft.IdentityModel.Abstractions. See #​3299 for details.

8.13.1

8.13.1

Dependencies

Microsoft.IdentityModel now depends on Microsoft.Identity.Abstractions 9.3.0

Bug Fixes

  • Fixed a decompression failure happening for large JWE payloads. See #​3286 for details.

Work related to redesign of IdentityModel's token validation logic #​2711

  • Update the validation methods to return Microsoft.Identity.Abstractions.OperationResult. See #​3284 for details.

8.13.0

8.13.0

8.13.0

Fundamentals

  • CaseSensitiveClaimsIdentity.SecurityToken setter is now protected internal (was internal). See PR #​3278 for details.
  • Update .NET SDK version to 9.0.108 used when building or running the code. See PR #​3274 for details.
  • Update RsaSecurityKey.cs to replace the Pkcs1 padding by Pss from HasPrivateKey check. See #​3280 for details.

What's Changed

New Contributors

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.12.1...8.13.0

8.12.1

8.12.1

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3263 for details.
  • To keep our experimental code separate from production code, all files associated with experimental features have been moved to the Experimental folders. See PR #​3261 for details.
  • Experimental code leaked into TokenValidationResult from early prototypes. See PR #​3259 for details.

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.12.0...8.12.1

8.12.0

8.12.0

New Features

  • Enhance ConfigurationManager with event handling
    Added event handling capabilities to the ConfigurationManager, enabling consumers to subscribe to configuration change events. This enhancement improves extensibility and allows more responsive applications. For details see #​3253

Bug Fixes

  • Add expected Base64UrlEncoder.Decode overload for NET6 and 8
    Introduced the expected overload of Base64UrlEncoder.Decode for .NET 6 and 8, ensuring compatibility and preventing missing method issues on these frameworks.
    For details see #​3249

Fundamentals

  • Add AI assist rules
    Incorporated AI assist rules to enhance AI agents effectiveness.
    For details see #​3255
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0
    Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added).
    For details see #​3256
  • Move suppression of RS006 to csproj
    Centralized suppression of RS006 warnings in project files for easier management.
    For details see #​3230

What's Changed

Description has been truncated

Bumps BenchmarkDotNet from 0.14.0 to 0.15.8
Bumps Confluent.Kafka from 2.6.1 to 2.15.0
Bumps Grpc.Net.Client from 2.80.0 to 2.83.0
Bumps Handlebars.Net from 2.1.6 to 2.4.3
Bumps Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.3.0 to 8.22.0
Bumps RabbitMQ.Client from 7.0.0 to 7.2.2
Bumps System.IdentityModel.Tokens.Jwt from 8.3.0 to 8.22.0

---
updated-dependencies:
- dependency-name: BenchmarkDotNet
  dependency-version: 0.15.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Confluent.Kafka
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Grpc.Net.Client
  dependency-version: 2.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Handlebars.Net
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.IdentityModel.Protocols.OpenIdConnect
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: RabbitMQ.Client
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 10, 2026
@omercelikdev

Copy link
Copy Markdown
Collaborator

Superseded by #332, which landed every one of these — verified against main rather than assumed:

Handlebars.Net                                   2.4.3
Confluent.Kafka                                 2.15.0
RabbitMQ.Client                                  7.2.2
Microsoft.IdentityModel.Protocols.OpenIdConnect 8.22.0
System.IdentityModel.Tokens.Jwt                 8.22.0
BenchmarkDotNet                                 0.15.8
Grpc.Net.Client                                  2.83.0

This PR's diff is written against a base from before that merge, which is why its checks are red: it would roll Handlebars back to 2.1.6 and then forward again. Nothing here is unwanted, it is just already done.

@omercelikdev
omercelikdev deleted the dependabot/nuget/nuget-dependencies-1ae2f701b6 branch August 10, 2026 08:22
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant