Skip to content

Bump the nuget group with 4 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/ExternalInfrastructure/nuget-ae9154200f
Open

Bump the nuget group with 4 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/ExternalInfrastructure/nuget-ae9154200f

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 14, 2026

Updated AutoMapper from 11.0.1 to 16.1.1.

Release notes

Sourced from AutoMapper's releases.

16.1.1

What's Changed

Security

Fixed an issue where certain cyclic or self-referential object graphs could trigger uncontrolled recursion during mapping, potentially resulting in stack exhaustion and denial of service.

Applications that process untrusted or attacker-controlled object graphs through affected mapping paths may be impacted.

Users should upgrade to this release.

Security advisory: GHSA-rvv3-g6hj-g44x

Thanks to @​bluefossa for responsibly disclosing this issue.

Full Changelog: LuckyPennySoftware/AutoMapper@v16.1.0...v16.1.1

16.1.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v16.0.0...v16.1.0

16.0.0

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0

16.0.0-beta-1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.1.0...v16.0.0-beta-1

This release is a beta release that introduces .NET 10 support and package signing. Signed packages means going forward packages can be validated against trusted authorities that the package has been published by Lucky Penny Software and not tampered with.

15.1.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.1...v15.1.0

15.0.1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v15.0.0...v15.0.1

This release supersedes the 15.0.0 release, reverting behavior and overloads so that the AddAutoMapper overloads separate the "scanning for maps" from the "scanning for dependencies". Unfortunately it's not really possible to combine these two together.

This also fixes a critical bug in #​4545 that does not work with .NET 4.x applications (as intended).

Because of this, the 15.0.0 will be delisted because of the breaking changes there.

15.0.0

Full Changelog: LuckyPennySoftware/AutoMapper@v14.0.0...v15.0.0

  • Added support for .NET Standard 2.0
  • Requiring license key
  • Moving from MIT license to dual commercial/OSS license

To set your license key:

services.AddAutoMapper(cfg => {
    cfg.LicenseKey = "<License key here>";
});

This also introduced a breaking change with MapperConfiguration requiring an ILoggerFactory for logging purposes:

public MapperConfiguration(MapperConfigurationExpression configurationExpression, ILoggerFactory loggerFactory)

Registering AutoMapper with services.AddAutoMapper will automatically supply this parameter. Otherwise you'll need to supply the logger factory.

You can obtain your license key at AutoMapper.io

14.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.1...v14.0.0

13.0.1

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v13.0.0...v13.0.1

13.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v12.0.1...v13.0.0

12.0.1

What's Changed

Full Changelog: LuckyPennySoftware/AutoMapper@v12.0.0...v12.0.1

12.0.0

What's Changed

New Contributors

Full Changelog: LuckyPennySoftware/AutoMapper@v11.0.1...v12.0.0
Upgrade Guide: https://docs.automapper.org/en/latest/12.0-Upgrade-Guide.html

Commits viewable in compare view.

Updated MongoDB.Bson from 2.15.1 to 2.19.0.

Release notes

Sourced from MongoDB.Bson's releases.

2.19.0

.NET Driver Version 2.19.0 Release Notes

This is the general availability release for the 2.19.0 version of the driver.

The main new features in 2.19.0 include:

  • Atlas Search builders
  • Default LinqProvider changed to LINQ3
  • ObjectSerializer allowed types configuration
  • Bucket and BucketAuto stages support in LINQ3
  • Support Azure VM-assigned Managed Identity for Automatic KMS Credentials
  • Native support for AWS IAM Roles

This version addresses CVE-2022-48282.

ObjectSerializer allowed types configuration

The ObjectSerializer has been changed to only allow deserialization of types that are considered safe.
What types are considered safe is determined by a new configurable AllowedTypes function (of type Func<Type, bool>).
The default AllowedTypes function is ObjectSerializer.DefaultAllowedTypes which returns true for a number of well-known framework types that we have deemed safe.
A typical example might be to allow all the default allowed types as well as your own types. This could be accomplished as follows:

var objectSerializer = new ObjectSerializer(type => ObjectSerializer.DefaultAllowedTypes(type) || type.FullName.StartsWith("MyNamespace"));
BsonSerializer.RegisterSerializer(objectSerializer);

More information about the ObjectSerializer is available in our FAQ.

Default LinqProvider changed to LINQ3

Default LinqProvider has been changed to LINQ3.
LinqProvider can be changed back to LINQ2 in the following way:

var connectionString = "mongodb://localhost";
var clientSettings = MongoClientSettings.FromConnectionString(connectionString);
clientSettings.LinqProvider = LinqProvider.V2;
var client = new MongoClient(clientSettings);

If you encounter a bug in LINQ3 provider, please report it in CSHARP JIRA project.

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.18.0

.NET Driver Version 2.18.0 Release Notes

This is the general availability release for the 2.18.0 version of the driver.

The main new features in 2.18.0 include:

  • Snappy compression now uses a managed implementation
  • ZStandard compression now uses a managed implementation
  • Cache AWS credentials when possible
  • New cross driver standard logging support
  • Support for $documents aggregation pipeline stage

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.18.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.18.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

2.17.1

.NET Driver Version 2.17.1 Release Notes

This is a patch release that fixes a potential data corruption bug in RewrapManyDataKey when rotating encrypted data encryption keys backed by GCP or Azure key services.

The following conditions will trigger this bug:

  • A GCP-backed or Azure-backed data encryption key being rewrapped requires fetching an access token for decryption of the data encryption key.

The result of this bug is that the key material for all data encryption keys being rewrapped is replaced by new randomly generated material, destroying the original key material.

To mitigate potential data corruption, upgrade to this version or higher before using RewrapManyDataKey to rotate Azure-backed or GCP-backed data encryption keys. A backup of the key vault collection should always be taken before key rotation.

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.17.1.md

The list of JIRA tickets resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.17.1%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

http://mongodb.github.io/mongo-csharp-driver/

Upgrading

There are no known backwards breaking changes in this release.

2.17.0

.NET Driver Version 2.17.0 Release Notes

This is the general availability release for the 2.17.0 version of the driver.

The main new features in 2.17.0 include:

  • Support for MongoDB server version 6.0.0 GA
  • [BETA] Support for Queryable Encryption
  • LINQ3 bug fixes and improvements
  • Add arbitrary aggregation stages to LINQ queries using IMongoQueryable.AppendStage() method (LINQ3)
  • Support for $topN and related accumulators in $group aggregation stage

EstimatedDocumentCount and Stable API

EstimatedDocumentCount is implemented using the count server command. Due to an oversight in versions
5.0.0-5.0.8 of MongoDB, the count command, which EstimatedDocumentCount uses in its implementation,
was not included in v1 of the Stable API. If you are using the Stable API with EstimatedDocumentCount,
you must upgrade to server version 5.0.9+ or set strict: false when configuring ServerApi to avoid
encountering errors.

For more information about the Stable API see:

https://mongodb.github.io/mongo-csharp-driver/2.16/reference/driver/stable_api/

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.17.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.17.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

2.16.1

.NET Driver Version 2.16.1 Release Notes

This is a patch release that addresses some issues reported since 2.16.0 was released.

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.16.1.md

The list of JIRA tickets resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.16.1%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

http://mongodb.github.io/mongo-csharp-driver/

Upgrading

There are no known backwards breaking changes in this release.

2.16.0

This is the general availability release for the 2.16.0 version of the driver.

The main new features in 2.16.0 include:

Support for MongoDB server version 6.0.0
[BETA] Support for Queryable Encryption
Support for creating collections with clustered indexes
Use count command for estimatedDocumentCount
LINQ3 bug fixes and improvements
Support for carry forward ($locf) and numerical/date densification ($densify)
Support for limit in $filter expressions
Support point-in-time pre-/post-images in change streams
Preemptively cancel in-progress operations when SDAM heartbeats timeout

EstimatedDocumentCount and Stable API

EstimatedDocumentCount is implemented using the count server command. Due to an oversight in versions 5.0.0-5.0.8 of MongoDB, the count command, which EstimatedDocumentCount uses in its implementation, was not included in v1 of the Stable API. If you are using the Stable API with EstimatedDocumentCount, you must upgrade to server version 5.0.9+ or set strict: false when configuring ServerApi to avoid encountering errors.

For more information about the Stable API see:

https://mongodb.github.io/mongo-csharp-driver/2.16/reference/driver/stable_api/

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.16.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.16.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

Commits viewable in compare view.

Updated MongoDB.Driver from 2.15.1 to 2.19.0.

Release notes

Sourced from MongoDB.Driver's releases.

2.19.0

.NET Driver Version 2.19.0 Release Notes

This is the general availability release for the 2.19.0 version of the driver.

The main new features in 2.19.0 include:

  • Atlas Search builders
  • Default LinqProvider changed to LINQ3
  • ObjectSerializer allowed types configuration
  • Bucket and BucketAuto stages support in LINQ3
  • Support Azure VM-assigned Managed Identity for Automatic KMS Credentials
  • Native support for AWS IAM Roles

This version addresses CVE-2022-48282.

ObjectSerializer allowed types configuration

The ObjectSerializer has been changed to only allow deserialization of types that are considered safe.
What types are considered safe is determined by a new configurable AllowedTypes function (of type Func<Type, bool>).
The default AllowedTypes function is ObjectSerializer.DefaultAllowedTypes which returns true for a number of well-known framework types that we have deemed safe.
A typical example might be to allow all the default allowed types as well as your own types. This could be accomplished as follows:

var objectSerializer = new ObjectSerializer(type => ObjectSerializer.DefaultAllowedTypes(type) || type.FullName.StartsWith("MyNamespace"));
BsonSerializer.RegisterSerializer(objectSerializer);

More information about the ObjectSerializer is available in our FAQ.

Default LinqProvider changed to LINQ3

Default LinqProvider has been changed to LINQ3.
LinqProvider can be changed back to LINQ2 in the following way:

var connectionString = "mongodb://localhost";
var clientSettings = MongoClientSettings.FromConnectionString(connectionString);
clientSettings.LinqProvider = LinqProvider.V2;
var client = new MongoClient(clientSettings);

If you encounter a bug in LINQ3 provider, please report it in CSHARP JIRA project.

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

2.18.0

.NET Driver Version 2.18.0 Release Notes

This is the general availability release for the 2.18.0 version of the driver.

The main new features in 2.18.0 include:

  • Snappy compression now uses a managed implementation
  • ZStandard compression now uses a managed implementation
  • Cache AWS credentials when possible
  • New cross driver standard logging support
  • Support for $documents aggregation pipeline stage

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.18.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.18.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

2.17.1

.NET Driver Version 2.17.1 Release Notes

This is a patch release that fixes a potential data corruption bug in RewrapManyDataKey when rotating encrypted data encryption keys backed by GCP or Azure key services.

The following conditions will trigger this bug:

  • A GCP-backed or Azure-backed data encryption key being rewrapped requires fetching an access token for decryption of the data encryption key.

The result of this bug is that the key material for all data encryption keys being rewrapped is replaced by new randomly generated material, destroying the original key material.

To mitigate potential data corruption, upgrade to this version or higher before using RewrapManyDataKey to rotate Azure-backed or GCP-backed data encryption keys. A backup of the key vault collection should always be taken before key rotation.

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.17.1.md

The list of JIRA tickets resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.17.1%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

http://mongodb.github.io/mongo-csharp-driver/

Upgrading

There are no known backwards breaking changes in this release.

2.17.0

.NET Driver Version 2.17.0 Release Notes

This is the general availability release for the 2.17.0 version of the driver.

The main new features in 2.17.0 include:

  • Support for MongoDB server version 6.0.0 GA
  • [BETA] Support for Queryable Encryption
  • LINQ3 bug fixes and improvements
  • Add arbitrary aggregation stages to LINQ queries using IMongoQueryable.AppendStage() method (LINQ3)
  • Support for $topN and related accumulators in $group aggregation stage

EstimatedDocumentCount and Stable API

EstimatedDocumentCount is implemented using the count server command. Due to an oversight in versions
5.0.0-5.0.8 of MongoDB, the count command, which EstimatedDocumentCount uses in its implementation,
was not included in v1 of the Stable API. If you are using the Stable API with EstimatedDocumentCount,
you must upgrade to server version 5.0.9+ or set strict: false when configuring ServerApi to avoid
encountering errors.

For more information about the Stable API see:

https://mongodb.github.io/mongo-csharp-driver/2.16/reference/driver/stable_api/

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.17.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.17.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

2.16.1

.NET Driver Version 2.16.1 Release Notes

This is a patch release that addresses some issues reported since 2.16.0 was released.

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.16.1.md

The list of JIRA tickets resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.16.1%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

http://mongodb.github.io/mongo-csharp-driver/

Upgrading

There are no known backwards breaking changes in this release.

2.16.0

This is the general availability release for the 2.16.0 version of the driver.

The main new features in 2.16.0 include:

Support for MongoDB server version 6.0.0
[BETA] Support for Queryable Encryption
Support for creating collections with clustered indexes
Use count command for estimatedDocumentCount
LINQ3 bug fixes and improvements
Support for carry forward ($locf) and numerical/date densification ($densify)
Support for limit in $filter expressions
Support point-in-time pre-/post-images in change streams
Preemptively cancel in-progress operations when SDAM heartbeats timeout

EstimatedDocumentCount and Stable API

EstimatedDocumentCount is implemented using the count server command. Due to an oversight in versions 5.0.0-5.0.8 of MongoDB, the count command, which EstimatedDocumentCount uses in its implementation, was not included in v1 of the Stable API. If you are using the Stable API with EstimatedDocumentCount, you must upgrade to server version 5.0.9+ or set strict: false when configuring ServerApi to avoid encountering errors.

For more information about the Stable API see:

https://mongodb.github.io/mongo-csharp-driver/2.16/reference/driver/stable_api/

An online version of these release notes is available at:

https://github.com/mongodb/mongo-csharp-driver/blob/master/Release%20Notes/Release%20Notes%20v2.16.0.md

The full list of JIRA issues resolved in this release is available at:

https://jira.mongodb.org/issues/?jql=project%20%3D%20CSHARP%20AND%20fixVersion%20%3D%202.16.0%20ORDER%20BY%20key%20ASC

Documentation on the .NET driver can be found at:

https://mongodb.github.io/mongo-csharp-driver/

Commits viewable in compare view.

Updated RestSharp from 107.3.0 to 112.0.0.

Release notes

Sourced from RestSharp's releases.

112.0.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@111.4.1...112.0.0

111.4.1

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@111.4.0...111.4.1

111.4.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@111.3.0...111.4.0

111.3.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@111.2.0...111.3.0

111.2.0

What's Changed

Full Changelog: restsharp/RestSharp@111.1.0...111.2.0

111.0.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@110.2.0...111.0.0

110.2.0

What's Changed

Full Changelog: restsharp/RestSharp@110.1.0...110.2.0

110.1.0

What's Changed

Full Changelog: restsharp/RestSharp@110.0.0...110.1.0

110.0.0

What's Changed

Breaking change

The IRestClient interface signature is different, so any non-standard implementations need to adopt the changes.

To keep DefaultParameters thread-safe, it got a new type DefaultParameters, and request property Parameters has a dedicated type RequestParameter. Code-wise the change is non-breaking as the signatures are the same, but v110 is not binary compatible with previous versions. The difference is that DefaultParameters collection wraps all its mutations in a lock.

Full Changelog: restsharp/RestSharp@109.0.1...110.0.0

109.0.1

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@109.0.0...109.0.1

109.0.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@108.0.3...109.0.0

108.0.3

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@108.0.2...108.0.3

108.0.2

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@108.0.1...108.0.2

108.0.1

Full Changelog: restsharp/RestSharp@108.0.0...108.0.1

108.0.0

What's Changed

New Contributors

Full Changelog: restsharp/RestSharp@107.3.0...108.0.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the nuget group with 4 updates
d2e435b 
Bumps AutoMapper from 11.0.1 to 16.1.1
Bumps MongoDB.Bson from 2.15.1 to 2.19.0
Bumps MongoDB.Driver from 2.15.1 to 2.19.0
Bumps RestSharp from 107.3.0 to 112.0.0

---
updated-dependencies:
- dependency-name: AutoMapper
  dependency-version: 16.1.1
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: MongoDB.Bson
  dependency-version: 2.19.0
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: MongoDB.Driver
  dependency-version: 2.19.0
  dependency-type: direct:production
  dependency-group: nuget
- dependency-name: RestSharp
  dependency-version: 112.0.0
  dependency-type: direct:production
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Mar 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants