Bump the nuget group with 6 updates

[dependabot]

Updated Microsoft.Data.SqlClient from 5.0.1 to 5.1.3.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

5.1.3

[Stable release 5.1.3] - 2024-01-09

Fixed

• Fixed encryption downgrade issue. CVE-2024-0056
• Fixed certificate chain validation logic flow.

For summary of all changes over v5.1.2, refer to 5.1.3.md

5.1.2

[Stable release 5.1.2] - 2023-10-26

Fixed

• Fixed access violation when using SQL Express user instance. #​2101
• Fixed Always Encrypted secure enclave retry logic for async queries. #​1988
• Fixed LocalDb and managed SNI by improving the error messages and avoid falling back to the local service. #​2129
• Fixed .NET and .NET Standard file version. 2093
• Fixed non-string values and SqlConnectionStringBuilder property indexer issue. #​2018
• Fixed SqlConnectionEncryptOption type conversion by introducing the SqlConnectionEncryptOptionConverter attribute when using appsettings.json files. #​2057
• Fixed Transient fault handling issue with OpenAsync. #​1983
• Fixed activity correlator to continue use of same GUID for connection activity. #​1997

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.1. #​2123

For summary of all changes over v5.1.1, refer to 5.1.2.md

5.1.1

[Stable release 5.1.1] - 2023-03-28

Fixed

• Fixed an incorrect exception when a symmetric key fails to decrypt a column using Always Encrypted. #​1968
• Fixed TransactionScope connection issue when Enlist is enabled, Pooling is disabled, and Network Connection Type is set to Redirect. #​1967
• Fixed throttling of token requests by calling AcquireTokenSilent. #​1966
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync. #​1965
• Fixed NullReferenceException in GetBytesAsync. #​1964

For summary of all changes over v5.1.0, refer to 5.1.1.md

5.1.0

Breaking changes

• Dropped support for .NET Core 3.1. #​1704 #​1823

Added

• Added support for .NET 6.0. #​1704
• Added support for DateOnly and TimeOnly for SqlParameter value and GetFieldValue. #​1813
• Added support for TLS 1.3 on .NET Core and native SNI. #​1821
• Added ServerCertificate setting for Encrypt=Mandatory or Encrypt=Strict. #​1822
• Added Windows ARM64 support when targeting .NET Framework. #​1828

Fixed

• Fixed thread safety of transient error list in configurable retry logic. #​1882
• Fixed deadlock when using SinglePhaseCommit with distributed transactions. #​1801
• Fixed Dedicated Admin Connections (DAC) to localhost in managed SNI #​1865
• Fixed memory leak regression from #​1781 using a DisposableTemporaryOnStack struct. #​1818
• Fixed ReadAsync() behavior to register Cancellation token action before streaming results. #​1781
• Fixed NullReferenceException when assigning null to SqlConnectionStringBuilder.Encrypt. #​1778
• Fixed missing HostNameInCertificate property in .NET Framework Reference Project. #​1776
• Fixed async deadlock issue when sending attention fails due to network failure. #​1766
• Fixed failed connection requests in ConnectionPool in case of PoolBlock. #​1768
• Fixed hang on infinite timeout and managed SNI. #​1742
• Fixed Default UTF8 collation conflict. #​1739

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.0. #​1889 which includes fix for AppDomain crash in issue #​1418, TLS 1.3 Support, removal of ARM32 binaries, and support for the ServerCertificate option. #​1822 Read more
• Reverted "Excluding unsupported TLS protocols" for issue #​1151 (i.e. removed Switch.Microsoft.Data.SqlClient.EnableSecureProtocolsByOS) by adding support for TLS 1.3. #​1824
• Changed the SqlConnectionEncryptOption string parser to public. #​1771
• Converted ExecuteNonQueryAsync to use async context object. #​1692
• Code health improvements #​1867 #​1849 #​1812 #​1520 #​1604 #​1598 #​1595 #​1443

For summary of all changes over v5.0, refer to 5.1.0.md

5.1.0-preview2.22314.2

[Preview Release 5.1.0-preview2.22314.2] - 2022-11-10

This update brings the below changes over the previous release:

Breaking changes over preview release v5.1.0-preview1

• Add support for .NET 6.0 and Dropped support for .NET Core 3.1. #​1704 #​1823

Added

• Added support for DateOnly and TimeOnly for SqlParameter value and GetFieldValue. #​1813
• Added support for TLS 1.3 for .NET Core and SNI Native. #​1821
• Added ServerCertificate support for Encrypt=Mandatory or Encrypt=Strict. #​1822
• Added Windows ARM64 support when targeting .NET Framework. #​1828

Fixed

• Fixed memory leak regression from #​1781 using a DisposableTemporaryOnStack struct. #​1818

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.0-preview2.22311.2. #​1831 which includes the fix for the TLS 1.3 timeout and double handshake issue, removal of ARM32 binaries, and support for the ServerCertificate option. #​1822
• Reverted "Excluding unsupported TLS protocols" for issue #​1151 (i.e. removed Switch.Microsoft.Data.SqlClient.EnableSecureProtocolsByOS) by adding support for TLS 1.3. #​1824
• Code health improvements #​1812 #​1520

For detailed release notes, refer to 5.1.0-preview2.md

5.1.0-preview1.22279.3

[Preview Release 5.1.0-preview1.22279.3] - 2022-10-19

This update brings the below changes over the stable release v5.0.0:

Fixed

• Fixed ReadAsync() behavior to register Cancellation token action before streaming results. #​1781
• Fixed NullReferenceException when assigning null to SqlConnectionStringBuilder.Encrypt. #​1778
• Fixed missing HostNameInCertificate property in .NET Framework Reference Project. #​1776
• Fixed async deadlock issue when sending attention fails due to network failure. #​1766
• Fixed failed connection requests in ConnectionPool in case of PoolBlock. #​1768
• Fixed hang on infinite timeout and managed SNI. #​1742
• Fixed Default UTF8 collation conflict. #​1739

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.0-preview1.22278.1. #​1787 which includes TLS 1.3 Support and fix for AppDomain crash in issue #​1418
• Changed the SqlConnectionEncryptOption string parser to public. #​1771
• Converted ExecuteNonQueryAsync to use async context object. #​1692
• Code health improvements #​1604 #​1598 #​1595 #​1443

Known issues

• When using Encrypt=Strict with TLS v1.3, the TLS handshake occurs twice on initial connection on .NET Framework due to a timeout during the TLS handshake and a retry helper re-establishes the connection; however, on .NET Core, it will throw a System.ComponentModel.Win32Exception (258): The wait operation timed out. and is being investigated. If you're using Microsoft.Data.SqlClient with .NET Core on Windows 11, you will need to enable the managed SNI on Windows context switch using following statement AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.UseManagedNetworkingOnWindows", true); to use TLS v1.3 or disabling TLS 1.3 from the registry by assigning 0 to the following HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client\Enabled registry key and it'll use TLS v1.2 for the connection. This will be fixed in a future release.

For detailed release notes, refer to 5.1.0-preview1.md

5.0.2

[Stable release 5.0.2] - 2023-03-31

Fixed

• Fixed memory leak regression from #​1785 using a DisposableTemporaryOnStack struct. #​1980
• Fixed TransactionScope connection issue when Enlist is enabled, Pooling is disabled, and Network Connection Type is set to Redirect. #​1978
• Fixed an incorrect exception when a symmetric key fails to decrypt a column using Always Encrypted. #​1977
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync. #​1976
• Fixed deadlock when using SinglePhaseCommit with distributed transactions. #​1975

For summary of all changes over v5.0.1, refer to 5.0.2.md

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 6.27.0 to 6.34.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

6.34.0

Security fixes

See https://aka.ms/IdentityModel/Jan2024/zip and https://aka.ms/IdentityModel/Jan2024/jku for details.

6.33.0

Bug Fixes:

• Clean up log messages. See #​2339 for details.
• Decouple JsonElements from JsonDocument, which causes issues in multi-threaded environments. See #​2340 for details.

6.32.3

• Fix logging messages. See scrub log messages AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2288 for details.

6.32.2

6.32.2

Bug fixes:

• Underlying JsonDocument is never disposed, causing high latency in large scale services. See #​2258 for details.

6.32.1

• Fix thread safety for JsonClaimSet Claims and JsonWebToken Audiences. See Better thread safety for JsonClaimSet Claims and JsonWebToken Audiences AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2185 for details.

6.32.0

New features:

• Adding an AAD specific signing key issuer validator. See issue #​2134 for details.
• Better support for WsFederation (#​2100)

Bug fixes

• Address perf regression introduced in 6.31.0 (#​2131)

6.31.0

This release contains work from the following PRs and commits:

• Introduce ConfigurationValidationException(#​2076)
• Disarm security artifacts(#​2064)
• Throw SecurityTokenMalformedTokenException on malformed tokens(#​2080)
• Add ClaimsMapping to JsonWebTokenHandler
  AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8e7f07e

6.30.1

This release contains work from the following PRs:

• Modified token validation to be async throughout the call graph #​2075
• Enforce key sizes when creating HMAC #​2072
• Fix AotCompatibilityTests #​2066
• Use up-to-date "now", in case take long time to get Metadata #​2063

This release addresses #​1743 and, as such, going forward if the SymmetricKey is smaller than the required size for HMAC IdentityModel will throw an ArgumentOutOfRangeException which is the same exception when the SymmetricKey is smaller than the minimum key size for encryption.

6.30.0

Beginning in release 6.28.0 the library stopped throwing SecurityTokenUnableToValidateException. This version (6.30.0) marks the exception type as obsolete to make this change more discoverable. Not including it in the release notes explicitly for 6.28.0 was a mistake. This exception type will be removed completely in the next few months as the team moves towards a major version bump. More information on how to replace the usage going forward can be found here: https://aka.ms/SecurityTokenUnableToValidateException

Indicate that a SecurityTokenDescriptor can create JWS or JWE
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2055
Specify 'UTC' in log messages
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@ceb10b1
Fix order of log messages
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@05eeeb5

Fixed issues with matching Jwt.Kid with a X509SecurityKey.x5t
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2057
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2061

Marked Exception that is no longer used as obsolete
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2060

Added support for AesGcm on .NET 6.0 or higher
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@85fa86a

First round of triming analysis preperation for AOT
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2042

Added new API on TokenHandler.ValidateTokenAsync(SecurityToken ...) implemented only on JsonWebTokenHandler.
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2056

6.29.0

• Add BootstrapRefreshInterval (#​2052)
• Added net462 target (#​2049)
• Create the configuration cache in the BaseConfigurationManager class (#​2048)

6.28.1

• Bug fix where internal cache was not instantiated set default LastKnownGood cache instance. AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2045

6.28.0

• Update Wilson logs with aka.ms pointers to known wikis in Update Wilson logs with aka.ms pointers to known wikis AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2027
• Fix typo in documentation Fix typo in documentation AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2034
• Introduce a LKG configuration cache to store each valid base configuration instead of a single entry of configuration Xiao/LKG configuration cache AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2007
• Add encryption keys to base configuration Add encryption keys to base configuration AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2023
• Updated CHANGELOG link Update CHANGELOG link AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2026

Commits viewable in compare view.

Updated MongoDB.Bson from 2.18.0 to 2.19.0.

Release notes

Sourced from MongoDB.Bson's releases.

2.19.0

.NET Driver Version 2.19.0 Release Notes

This is the general availability release for the 2.19.0 version of the driver.

The main new features in 2.19.0 include:

• Atlas Search builders
• Default LinqProvider changed to LINQ3
• ObjectSerializer allowed types configuration
• Bucket and BucketAuto stages support in LINQ3
• Support Azure VM-assigned Managed Identity for Automatic KMS Credentials
• Native support for AWS IAM Roles

This version addresses CVE-2022-48282.

ObjectSerializer allowed types configuration

The ObjectSerializer has been changed to only allow deserialization of types that are considered safe.
What types are considered safe is determined by a new configurable AllowedTypes function (of type Func<Type, bool>).
The default AllowedTypes function is ObjectSerializer.DefaultAllowedTypes which returns true for a number of well-known framework types that we have deemed safe.
A typical example might be to allow all the default allowed types as well as your own types. This could be accomplished as follows:

var objectSerializer = new ObjectSerializer(type => ObjectSerializer.DefaultAllowedTypes(type) || type.FullName.StartsWith("MyNamespace"));
BsonSerializer.RegisterSerializer(objectSerializer);

More information about the ObjectSerializer is available in our FAQ.

Default LinqProvider changed to LINQ3

Default LinqProvider has been changed to LINQ3.
LinqProvider can be changed back to LINQ2 in the following way:

var connectionString = "mongodb://localhost";
var clientSettings = MongoClientSettings.FromConnectionString(connectionString);
clientSettings.LinqProvider = LinqProvider.V2;
var client = new MongoClient(clientSettings);

If you encounter a bug in LINQ3 provider, please report it in CSHARP JIRA project.

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated MongoDB.Driver from 2.18.0 to 2.19.0.

Release notes

Sourced from MongoDB.Driver's releases.

2.19.0

.NET Driver Version 2.19.0 Release Notes

This is the general availability release for the 2.19.0 version of the driver.

The main new features in 2.19.0 include:

• Atlas Search builders
• Default LinqProvider changed to LINQ3
• ObjectSerializer allowed types configuration
• Bucket and BucketAuto stages support in LINQ3
• Support Azure VM-assigned Managed Identity for Automatic KMS Credentials
• Native support for AWS IAM Roles

This version addresses CVE-2022-48282.

ObjectSerializer allowed types configuration

The ObjectSerializer has been changed to only allow deserialization of types that are considered safe.
What types are considered safe is determined by a new configurable AllowedTypes function (of type Func<Type, bool>).
The default AllowedTypes function is ObjectSerializer.DefaultAllowedTypes which returns true for a number of well-known framework types that we have deemed safe.
A typical example might be to allow all the default allowed types as well as your own types. This could be accomplished as follows:

var objectSerializer = new ObjectSerializer(type => ObjectSerializer.DefaultAllowedTypes(type) || type.FullName.StartsWith("MyNamespace"));
BsonSerializer.RegisterSerializer(objectSerializer);

More information about the ObjectSerializer is available in our FAQ.

Default LinqProvider changed to LINQ3

Default LinqProvider has been changed to LINQ3.
LinqProvider can be changed back to LINQ2 in the following way:

var connectionString = "mongodb://localhost";
var clientSettings = MongoClientSettings.FromConnectionString(connectionString);
clientSettings.LinqProvider = LinqProvider.V2;
var client = new MongoClient(clientSettings);

If you encounter a bug in LINQ3 provider, please report it in CSHARP JIRA project.

An online version of these release notes is available here.

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Updated Npgsql from 6.0.7 to 6.0.11.

Release notes

Sourced from Npgsql's releases.

6.0.11

This version contains a high-severity security patch for CVE-2024-32655 everyone is advised to upgrade.

Thanks to @​paul-gerste-sonarsource for reporting the vulnerability.

6.0.10

v6.0.10 contains many bug fixes, everyone is strongly encouraged to upgrade.

6.0.9

Commits viewable in compare view.

Pinned System.IdentityModel.Tokens.Jwt at 6.34.0.

Updated System.IdentityModel.Tokens.Jwt from 6.27.0 to 6.34.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.