Bump the dotnet group with 7 updates

[dependabot]

Updated Microsoft.OpenApi from 2.11.0 to 3.10.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.10.0

3.10.0 (2026-08-11)

Features

• adds deserialization of the example extension (e5a1080)
• do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
• serialize license identifier as extension for earlier versions (d090989)
• serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

• better nullability round-tripping (655c2c8)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
• deserialize metadata url from extension in earlier version (9387b01)
• marks deprecated properties from the specification as obsolete (787b045)
• marks deprecated properties from the specification as obsolete (953c22a)
• schema: serialize compatibility examples from examples list (5d8ec3a)
• serialize examples as extension in v2/v3 (ff1dbc9)
• serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
• library: support schema keywords on references (434b2f8)
• library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
• handling of nullable enums for 3.0 (#​2920) (beb68f5)
• library: keep v3 schema references ref-only (c938727)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
• use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (78475e3)
• add contains/minContains/maxContains members (1a974f8)
• library: add missing json schema properties (9b1aed6)
• library: add missing json schema properties (82f84e0)

Bug Fixes

• library: always copy unevaluated properties (4907d1c)
• library: avoid false circular refs for external schema re-exports (b635242)
• library: avoid false circular refs for external schema re-exports (7a443c2)
• library: remove unshipped schema extension fallback (cf54bb3)
• library: use version-specific schema keyword callbacks (6e22ec6)
• library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (9b4f45b)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

• reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

• library: handle circular schema references (b3cd42b)
• library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (f97f91a)
• null reference exception for boolean component schemas (fe0b50a)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

• schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
• hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

• library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
• double encoding of json pointer for invalid reference rule (b246cd0)
• encoding of special characters for JSON paths (4c757e1)
• library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
• library: do not emit unevaluatedProperties for non-object schemas (19538aa)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
• potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
• library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
• securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

• implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
• library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
• library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

• models: add shared Content interface (#​2695) (338566f)

Bug Fixes

• broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

• models: add shared Content interface (9e13b25)
• models: add shared Content interface (#​2695) (9e13b25)
• models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

• hidi validate command now logs warnings (76a3c0f)
• hidi validate command now logs warnings (62e7d56)

Bug Fixes

• discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
• discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

• Support custom tag ordering (008576c)
• Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

• correct error pointer when extension parser throws OpenApiException (43c75a9)
• wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

• schema: always serialize additionalProperties: false (6651c36)
• schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

• Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

• load JSON documents that are preceded by multiple whitespace (6461bac)
• non-seekable json streams would fail to load as a document (2436d73)
• reading streams in an asp.net context would cause async exceptions (f9e5248)

3.0.2

3.0.2 (2025-12-08)

Bug Fixes

• additional properties serialization should not emit a schema in v2 (946cba9)
• additional properties serialization should not emit booleans in v3.1+ (946cba9)

3.0.1

3.0.1 (2025-11-17)

Bug Fixes

• empty strings should be quoted in yaml (8d215f9)
• empty strings should be quoted in yaml (0ca10db)

3.0.0

3.0.0 (2025-11-11)

⚠ BREAKING CHANGES

• adds support for OpenAPI 3.2.0

Note: Please refer to the upgrade guide for a detailed description of the breaking changes.

Note: ASP.net users should remain on version 1.X for ASP.net < 10, and version 2.X for ASP.net 10, this new major version will be implemented in a future version of ASP.net, more information

Features

• adds support for OpenAPI 3.2.0 (765a8dd)

Special thanks

• Matthieu Costabello

2.12.0

2.12.0 (2026-08-12)

Features

• adds deserialization of the example extension (095ae3b)
• serialize license identifier as extension for earlier versions (d5cdce8)
• serialize license identifier as extension for earlier versions (fde38d8)

Bug Fixes

• better nullability round-tripping (7a25659)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (a361360)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (4db9af0)
• library: serialize multiple schema types as anyOf/oneOf for OpenAPI 3.0 (6568896)
• marks deprecated properties from the specification as obsolete (26aba69)
• marks deprecated properties from the specification as obsolete (abc5301)
• schema: serialize compatibility examples from examples list (be57a7c)
• serialize examples as extension in v2/v3 (d27141b)

Commits viewable in compare view.

Updated ReverseMarkdown from 6.1.1 to 6.2.1.

Release notes

Sourced from ReverseMarkdown's releases.

6.2.1

Full Changelog: mysticmind/reversemarkdown-net@6.2.0...6.2.1

Commits viewable in compare view.

Updated Sentry.AspNetCore from 6.8.0 to 6.9.0.

Release notes

Sourced from Sentry.AspNetCore's releases.

6.9.0

Features ✨

• feat: Allow users to control Mechanism.Handled for captured exceptions by @​vladbrincoveanu in #​5449

Fixes 🐛

• fix(serilog): logs from application namespaces beginning with "Sentry" are discarded by @​jamescrosswell in #​5456
• fix: rate limit on one data category no longer blocks all others by @​jamescrosswell in #​5482

Dependencies ⬆️

Deps

• chore(deps): update Native SDK to v0.16.3 by @​github-actions in #​5486
• chore(deps): update Cocoa SDK to v9.26.0 by @​github-actions in #​5485
• chore(deps): update Cocoa SDK to v9.25.0 by @​github-actions in #​5472
• chore(deps): update Native SDK to v0.16.2 by @​github-actions in #​5477
• chore(deps): update Java SDK to v8.52.0 by @​github-actions in #​5471
• chore(deps): update Cocoa SDK to v9.24.0 by @​github-actions in #​5460
• chore(deps): update Java SDK to v8.51.0 by @​github-actions in #​5457
• chore(deps): update Native SDK to v0.16.1 by @​github-actions in #​5459
• chore(deps): update Native SDK to v0.16.0 by @​github-actions in #​5452
• chore(deps): update Java SDK to v8.50.1 by @​github-actions in #​5441
• chore(deps): update CLI to v3.6.2 by @​github-actions in #​5443
• chore(deps): update Cocoa SDK to v9.23.0 by @​github-actions in #​5442

Other

• ref: migrate Cocoa bindings from PrivateSentrySDKOnly to SentryObjCSDK.internal by @​jamescrosswell in #​5409

Commits viewable in compare view.

Updated System.Security.Cryptography.Xml from 10.0.10 to 10.0.11.

Release notes

Sourced from System.Security.Cryptography.Xml's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Umbraco.Cms from 18.1.0 to 18.1.1.

Release notes

Sourced from Umbraco.Cms's releases.

18.1.1

What's Changed

🔒 Security

• Resolved incorrect authorization lets Content-only backoffice users modify Templates, enabling remote code execution from GHSA-f7m5-5x7g-2p52
• Resolved insufficient authorization on Management API search endpoints from GHSA-w5q3-9wf8-43gg

🐛 Bug Fixes

• Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #​22581) by @​AndyButland in Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #22581) umbraco/Umbraco-CMS#23653

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc...release-18.1.1

Commits viewable in compare view.

Updated Umbraco.Cms.DevelopmentMode.Backoffice from 18.1.0 to 18.1.1.

Release notes

Sourced from Umbraco.Cms.DevelopmentMode.Backoffice's releases.

18.1.1

What's Changed

🔒 Security

• Resolved incorrect authorization lets Content-only backoffice users modify Templates, enabling remote code execution from GHSA-f7m5-5x7g-2p52
• Resolved insufficient authorization on Management API search endpoints from GHSA-w5q3-9wf8-43gg

🐛 Bug Fixes

• Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #​22581) by @​AndyButland in Routing: Don't retain the fallback default culture captured during an upgrade boot (closes #22581) umbraco/Umbraco-CMS#23653

Full Changelog: umbraco/Umbraco-CMS@release-18.1.0-rc...release-18.1.1

Commits viewable in compare view.

Updated uSync from 18.0.3 to 18.1.1.

Release notes

Sourced from uSync's releases.

18.1.1

Fixes

• Import: fixed a property that's been moved out of all groups (an empty tab, no matching <Tabs> entry) not actually persisting that move on import — it took a second import to stick. (#​1043)
• Reliability: save failures rejected by Umbraco (e.g. an invalid ISO code, a rejected content/media/template save) were previously discarded silently, so a failed import step could still get reported as a success. These now surface as proper import failures across Language, DictionaryItem, Webhook, ContentType/MediaType/MemberType, DataType, Domain, Template, Media, and Content serializers. (#​1040, #​1042)
• Blueprints: fixed bulk-imported content blueprints being saved through the wrong path, which silently corrupted their object type and caused duplicate-key errors on the next import. Blueprints saved during the second-pass bulk import now go through SaveBlueprint like a normal single-item save. (#​1035)

Other

• Dependency bumps (chalk, vite-plugin-dts, and a few NuGet/npm dependency-group updates).
• CI/CD: nightly builds are now automatically published to the Azure Artifacts nightly feed on every push to this branch.

18.1.0

This is a minor update to uSync for Umbraco 18 — an opt-in import performance cache, a double-export fix for save-and-publish, several allocation/perf improvements ported from v17, and a move to the Jumoo.Json package for JSON handling.

uSync 18.1.0

Added

• Opt-in import state cache — uSync:Settings:CacheImportState (default false). uSync normally decides whether an item has changed by loading it, serializing it, and hashing it — every item, every run. With this on, uSync remembers the hash of items it has already confirmed match, so unchanged items are skipped without a database lookup or re-serialize on the next run. The first run after enabling it is no faster than before; the benefit lands on the second run. Read docs/perf/state-cache.md before enabling it, especially the limitations section. (#​1016)
• Extender API: the cancelable per-item notifications gain an optional Message (used instead of uSync's generic cancel message) and, on the import/report ones, Force, so a subscriber can stand down when the user has asked for a forced import.

Fixed

• Content and Library items are no longer exported twice by one editor action. Umbraco 18.1 raises the saved notification for a save-and-publish as well as the published one (umbraco/Umbraco-CMS#​23523); uSync now shares a record of exported items across the notifications for one operation, so each item is exported once. (#​1018)
• HandlerSettings.Clone() no longer drops CreateClean and FullFileOnDifference — handlers that set either value in their own block are now honoured.
• Property values containing a quote, backslash or control character are now converted to valid JSON (previously produced invalid JSON in the string fallback). Inherited with the move to Jumoo.Json.
• Restored backoffice guard and content paging fixes that were dropped in the v17 → v18 merge. (#​1012)

Performance

• Ported the v17 allocation work: fewer redundant dictionary lookups on hot paths, and internal/private classes are now sealed so the JIT can devirtualize their calls. No behavioural changes. (#​1019, #​1020)

  Extender API: SyncHandlerRoot.SyncChangeInfo is now sealed (still protected, so handlers can still construct/return one from IsItemCurrentAsync, just not derive from it).

• Handler settings now inherit from HandlerDefaults. A handler's own settings block is layered over the set's defaults instead of replacing them wholesale, so it only needs to specify what it wants to change. (#​1001)

  Breaking: a handler block that previously reset settings back to built-in defaults will now inherit the set's HandlerDefaults instead. Review any set mixing HandlerDefaults with per-handler blocks.

• JSON helpers now come from the Jumoo.Json package, replacing uSync's own copy which had drifted behind it. uSync.Core.Extensions.JsonTextExtensions still works but is [Obsolete] (removed in v20) — switch to using Jumoo.Json;. Note TryGetPropertyAsObject → TryGetPropertyAsJsonObject, GetPropertyAsObject → GetPropertyAsJsonObject, and missing/null values now return null instead of string.Empty. (#​1014, #​1015)
• Removed three O(n²) lookups from import (duplicate-key/"keys to keep" checks now use set lookups; second-pass content/media imports index the action list once instead of scanning it per item). (#​1017)

  Actions updated by a second pass are now updated in place, keeping their original position in the results list, rather than being moved to the end. Only display/reporting order is affected.
  Extender API: List<uSyncAction>.CreateActionIndex() and a matching UpdateActions(index, key, handlerAlias, attempt) overload are new.

• Serializing, comparing and expanding large property values allocates far less, some previously on the large object heap. Inherited with the move to Jumoo.Json.

Extender API

• ISyncManagementService gains UnpackStreamAsync(Stream); the synchronous UnpackStream(Stream) is now obsolete (removed in v19). (#​1005)

Cleanup

• Cleared the remaining build warnings left over from the Umbraco 18 upgrade: replaced ITemplate.MasterTemplateAlias with LayoutTemplateAlias, and inlined the legacy {localLink:x} parsing Umbraco is removing in v18. No behavioural changes. (#​1002, #​1003, #​1004)

Full Changelog: KevinJump/uSync@v18.0.3...v18.1.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions