Skip to content

Bump Confluent.Kafka and 10 others - #52

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/samples/Shop.Tests/develop/dotnet-routine-14fe1c1f51
Closed

Bump Confluent.Kafka and 10 others#52
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/samples/Shop.Tests/develop/dotnet-routine-14fe1c1f51

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Confluent.Kafka from 2.15.1 to 2.16.0.

Release notes

Sourced from Confluent.Kafka's releases.

2.16.0

New experimental features

  • Serializers and deserializers can now be supplied to a producer, dependent
    producer or consumer as a builder, which the client invokes during its own
    construction and then owns, disposing it (and any Schema Registry client it
    created) when the client itself is disposed. See the AvroGeneric example (#​2661)
  • Schema Registry serde builders are now available for each supported format,
    each configurable with a Schema Registry client you own or the
    configuration to build one from. See the AvroGeneric,
    JsonSerialization and Protobuf examples (#​2661)
  • Producers, consumers and admin clients can now report the id of the Kafka
    cluster they're connected to (#​2661)
  • The Kafka cluster id is now propagated to Schema Registry serializers and
    deserializers automatically, and resolved lazily on first use, so subject
    name strategies based on the cluster no longer need it configured by hand.
    See the AvroGenericAssociation example (#​2661)
  • The serializer and deserializer builder APIs (Set*SerializerBuilder and
    Set*DeserializerBuilder on the producer and consumer builders, the Schema
    Registry serde builders), IClusterIdAware, ISerdeDisposable, SerdeExtensions
    and the ClusterId client extension are experimental: they are subject to
    change or removal in a future release (#​2661)

Enhancements

  • References librdkafka.redist 2.16.0. Refer to the librdkafka v2.16.0 release notes for more information
  • Add support for saving Azure key version with DEK (#​2641)
  • Pass context when clients make KEK calls to DEK Registry (#​2642)
  • Add support for inline validation rules (#​2651)
  • Add Variant, Decimal, and Timestamp CEL functions (#​2653)
  • Add support for linux-s390x (IBM Z), with CI coverage on s390x (#​2646)
  • Add support for AliCloud KMS provider with CSFLE/CSPE (#​2648)
  • Schema Registry examples now use the serde builder API (#​2661)

Fixes

  • Fix the CSFLE ciphertext version field being written little-endian on big-endian
    platforms, which made encrypted fields unreadable across architectures
  • Fix message Timestamp.Type being read as NotAvailable on big-endian platforms
    (e.g. s390x): librdkafka's rd_kafka_timestamp_type_t out-parameter (a 32-bit enum)
    was marshalled as a pointer-sized IntPtr, so the value landed in the high word and
    was truncated to 0 on big-endian

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 8.0.31 to 8.0.33.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

8.0.32

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v8.0.31...v8.0.32

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.OpenIdConnect from 8.0.31 to 8.0.33.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.OpenIdConnect's releases.

8.0.32

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v8.0.31...v8.0.32

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 7.1.0 to 7.1.1.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.1.1

This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.

Package version alignment: The SqlClient family packages share the 7.1.1 version:

  • Microsoft.Data.SqlClient
  • Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
  • Microsoft.Data.SqlClient.Extensions.Azure
  • Microsoft.Data.SqlClient.Extensions.Abstractions
  • Microsoft.Data.SqlClient.Internal.Logging

Microsoft.SqlServer.Server is versioned independently and is not part of this release. Applications should use matching 7.1.1 versions of the driver and its companion packages. The aligned assemblies retain AssemblyVersion 7.0.0.0; upgrading from 7.1.0 does not require new .NET Framework strong-name binding redirects.

Companion package release notes

Changes Since 7.1.0

Fixed

  • Fixed an ArgumentException when sending zero-valued decimal or SqlDecimal parameters whose precision equals their scale. Nonzero precision validation and support for large decimal values are unchanged. (#​4715, #​4721, #​4732)

  • Fixed connection pool V2 handing out pooled connections with expired or nearly expired access tokens. The pool now checks token expiry before reuse, matching the default pool's behavior while preserving transaction-affine reuse. This affects only applications that opt in to connection pool V2. (#​4734, #​4739)

  • Fixed connection opens failing when ClearPool or ClearAllPools races with an in-flight open. Requests already admitted to the cleared pool can finish, and connections returned to the retired pool are discarded rather than reused. (#​4714, #​4718, #​4740)

Target Platform Support

  • .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
  • .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

  • Microsoft.Bcl.Cryptography 9.0.18
  • Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
  • Microsoft.Data.SqlClient.Internal.Logging 7.1.1
  • Microsoft.Data.SqlClient.SNI.runtime 7.1.0
  • Microsoft.Extensions.Caching.Memory 9.0.18
  • Microsoft.IdentityModel.JsonWebTokens 8.16.0
  • Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
  • Microsoft.SqlServer.Server 1.0.0
  • System.Configuration.ConfigurationManager 9.0.18
  • System.Security.Cryptography.Pkcs 9.0.18
  • System.Threading.RateLimiting 9.0.18

... (truncated)

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 8.0.31 to 8.0.33.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

8.0.32

Release

What's Changed

Full Changelog: dotnet/efcore@v8.0.31...v8.0.32

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 8.0.31 to 8.0.33.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

8.0.32

Release

What's Changed

Full Changelog: dotnet/efcore@v8.0.31...v8.0.32

Commits viewable in compare view.

Pinned Microsoft.Extensions.Diagnostics.HealthChecks at 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.HealthChecks's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Updated Newtonsoft.Json from 13.0.3 to 13.0.4.

Release notes

Sourced from Newtonsoft.Json's releases.

13.0.4

  • New feature - Annotated for trim/AOT (in)compatibility
  • New feature - Added support for using Index with JArray
  • Change - Avoid LINQ expression trees in .NET 6+ reflection
  • Fix - Fixed handling of empty constructor names
  • Fix - Fixed XML convert duplicate attribute error on nested arrays with writeArrayAttribute set to true
  • Fix - Fixed XML convert array attribute is not set for properties with special characters
  • Fix - Fixed TimeOnly deserialization to support more formats

Commits viewable in compare view.

Updated Quartz from 3.22.2 to 3.22.9.

Release notes

Sourced from Quartz's releases.

3.22.9

Two fixes for the 3.x line. There is no public API change and no schema change.

Fixed

  • Legacy time zone names resolve on a system without tzdata-legacy, such as Ubuntu 26.04. On .NET 8 and later, without the TimeZoneConverter plugin, seven Windows ids (FLE, India, Argentina, Greenland, Myanmar, Nepal and US Eastern Standard Time) and tzdata's legacy IANA names, such as Asia/Calcutta and Europe/Kiev, threw TimeZoneNotFoundException there. Quartz now maps a legacy name to its canonical zone through tzdata 2026e's backward links, and resolves it under the id asked for, so the id a store writes does not depend on the host. (#​4181, from #​4172)
  • A serial job's late trigger is not left BLOCKED by a custom driver delegate. With a delegate that implements IDriverDelegate but does not derive from StdAdoDelegate, the completion of a [DisallowConcurrentExecution] job could store a late trigger it let go of as BLOCKED. If that was the job's only trigger, it never fired again. Every delegate Quartz ships was unaffected. (#​4182, from #​4175)

Behaviour change

  • With the TimeZoneConverter plugin on such a host, 3.22.8 stored the canonical name (Europe/Kyiv for FLE Standard Time). 3.22.9 resolves the id before the plugin is asked, so it stores the id asked for. Rows already stored read back either way.

What's Changed

Full Changelog: quartznet/quartznet@v3.22.8...v3.22.9

3.22.8

Fixes for the 3.x line, including a regression in 3.22.7 that made TriggerJob slower the more triggers its job had stored. There is no public API change and no schema change.

Fixed

  • TriggerJob no longer slows down as its job's backlog grows (regression in 3.22.7). 3.22.7 gave a manual firing the execution group its job's triggers share (#​4110), and found that group by loading every stored trigger of the job, three statements per trigger. A queued manual firing is a stored trigger too, so each call cost more than the one before. The group is now read with one statement. (#​4170, from #​4167)
  • A [DisallowConcurrentExecution] job's completion reads only the triggers that misfired (since 3.17.0). Each completion loaded every remaining trigger of the job under TRIGGER_ACCESS to apply the misfire policy to the late ones, so draining a backlog was quadratic in statements, and ScheduleJob and TriggerJob waited behind the lock. The completion now asks the database only for the job's misfired triggers, with the misfire handler's predicate. (#​4168, from #​4167)
  • A restart keeps a declared trigger's fire count and an individual pause. A start re-applies every AddTrigger and ScheduleJob registration and every scheduling file through RescheduleJob. That reset TimesTriggered, so a finite WithRepeatCount ran again from the beginning, and it resumed a trigger an operator had paused on its own. Both are now kept while the declared schedule is unchanged; a changed schedule starts fresh. An application's own RescheduleJob still ends an individual pause. (#​4149, from #​4128)

The #​4167 workload on SQL Server: 400 queued triggers on one serial job with a 50 ms body, which would drain in 20 s with no scheduler overhead.

Version Drain time Misfire events TriggerJob median
3.16.1 58 s 0 58 ms
3.22.7 212 s 137 1.4 s
3.22.8 50 s 0 58 ms

Against a remote database every one of those statements is a round trip, so the difference grows with latency.

Behaviour changes

  • A serial job's completion no longer reports a late IgnoreMisfirePolicy trigger to ITriggerListener.TriggerMisfired, and no longer writes it back unchanged. Acquisition fires it, as the misfire handler and RAMJobStore already did. (#​4168)
  • The completion no longer calls the protected virtual JobStoreSupport.GetTriggersForJob(conn, …) and UpdateMisfiredTrigger(conn, key, …). A subclass that overrode either to change what a completion does is bypassed there; ResumeTrigger still calls UpdateMisfiredTrigger. (#​4168)

Thanks to @​kostekk88 for the report and the repro in #​4167.

What's Changed

Other changes

Full Changelog: quartznet/quartznet@v3.22.7...v3.22.8

3.22.7

Fixes for the 3.x line, ported from 4.6. There is no public API change and no schema change.

Fixed

  • A trigger re-applied at startup keeps its previous fire time. Creating a scheduler re-applies the triggers the configuration registers through RescheduleJob, which replaced the stored trigger with one that had none, so PreviousFireTimeUtc was lost on every restart. It is now carried over when the replacement has none. (#​4127, from #​4122)
  • A recovered trigger keeps its job's execution group. A firing replayed after a node failure, a shutdown hand-back or startup recovery was stored ungrouped and ran beside a live firing of the same group, whatever the group's limit. (#​4085)
  • A manual firing carries the execution group its job's triggers share. TriggerJob and the dashboard's Trigger now carried none, so they ignored the group's limit. (#​4110)
  • Names in IConfiguration keep their case. A hierarchical section camel-cased every path segment on its way to the flat quartz.* keys, names the user chose included, and StdSchedulerFactory looks names up ordinally: Quartz:DataSource:MyDS beside Quartz:JobStore:DataSource = MyDS failed with no data source found. Data source, listener, execution-limit and context names now keep their case, and a plugin's name stays camel-cased, so the XML plugin's stored file-scan job keeps its key. (#​4108)
  • The dashboard's cron preview uses the trigger's time zone and calendar, and previews the expression being edited. (#​4118)

Warnings

  • A clustered scheduler warns when every node would share the instance id NON_CLUSTERED, which makes each node read the other's fired triggers as its own. Set quartz.scheduler.instanceId to AUTO, or a distinct id per node. 4.6 generates the id instead; 3.x keeps the default, because changing it would re-key an existing deployment's rows. (#​4106)
  • A generated job or trigger identity in a persistent store logs a warning: a generated key is new on every start, so a persistent store keeps another copy each time, and every copy of a trigger fires. Give it a stable key with WithIdentity. (#​4114)

What's Changed

Other changes

Full Changelog: quartznet/quartznet@v3.22.6...v3.22.7

3.22.6

One dependency fix for the 3.x line, from Microsoft's October 13 security advisories. There is no public API change and no schema change, and no other package changes.

Fixed

  • Quartz.Dashboard depends on Microsoft.AspNetCore.SignalR.Client 8.0.32. 3.22.5 depended on 8.0.8, whose Microsoft.AspNetCore.SignalR.Common GHSA-334f-vvp4-7g6p (CVE-2026-70159) covers, and 8.0.32 is the fixed version on the 8.x line. The fixed client raises Microsoft.Extensions.DependencyInjection, DependencyInjection.Abstractions, Logging and Logging.Abstractions within 8.0.x (to 8.0.1, 8.0.2, 8.0.1 and 8.0.3). An application that pins one of those lower directly will get NU1605 and needs to raise the pin. (#​4073)

The same fix ships for 4.x's Quartz.Dashboard.Agent in 4.5.1.

What's Changed

Other changes

Full Changelog: quartznet/quartznet@v3.22.5...v3.22.6

3.22.5

One fix for the 3.x line, ported from Quartz.NET 4.5. There is no public API change and no schema change.

Fixed

  • A calendar replacement that throws leaves the in-memory store as it was. RAMJobStore.StoreCalendar(name, calendar, replaceExisting: true, updateTriggers: true) moved each trigger on the calendar to the replacement one at a time. If the replacement threw for a trigger, three things went wrong:

    • that trigger dropped out of the schedule for good;
    • the triggers before it had already moved on;
    • the replacement calendar was already stored.

    Now every trigger is recomputed on a copy first. If one throws, the call fails with JobPersistenceException("Couldn't store calendar: …"), worded and wrapped as the database stores do, and nothing changes: the old calendar stays, and every trigger keeps its fire time and its place in the schedule. The failure is the caller's, so it does not count toward MaxConsecutiveFireFailures. (#​4039, the port of #​4029 that fixed #​4026)

The same fix ships in Quartz.NET 4.5.

Full Changelog: quartznet/quartznet@v3.22.4...v3.22.5

3.22.4

Fixes for the 3.x line. The public API gains one property, and there is no schema change. These are ports of fixes found while building Quartz.NET 4.4.

Fixed

  • A trigger whose fire fails every time is stored ERROR instead of being acquired again forever. A trigger whose fire failed on each attempt was released and acquired again in a tight loop, and starved its [DisallowConcurrentExecution] job's other triggers. Five consecutive failed fires of the same occurrence now store it ERROR; ResetTriggerFromErrorState brings it back. (#​3963)

  • A calendar that throws fails only its own trigger. An ICalendar that threw used to strand everything around it:

    • in the in-memory store, the whole fire batch (#​3974);
    • in the in-memory store, the acquisition pass and a completion that unblocks a serial job's triggers (#​3985);
    • in the database stores, a completion: it was retried until shutdown, the job stayed BLOCKED and the worker thread never returned (#​4006). The misfire handler also logged the same trigger on every scan.

    Now the trigger whose calendar threw is left as it was and counted as a failure. The rest of the batch, pass or completion carries on, and a database error is still retried as before.

New

  • JobStoreSupport.MaxConsecutiveFireFailures and RAMJobStore.MaxConsecutiveFireFailures (flat key quartz.jobStore.maxConsecutiveFireFailures), default 5; 0 turns parking off.

Behaviour changes

  • A trigger is parked ERROR after 5 consecutive failed fires. A calendar that keeps throwing while a misfire is handled parks its trigger after 5 failures that are at least a misfire threshold apart, not after 5 quick passes. Set MaxConsecutiveFireFailures = 0 to keep the old behaviour.
  • ResumeTrigger, ResumeTriggers, ResumeJob, ResumeJobs and ResumeAll no longer throw a calendar's exception. They log it and resume the trigger, and its misfire is handled again later.
  • The protected JobStoreSupport.UpdateMisfiredTrigger returns false instead of throwing when a misfire policy throws. It returns true when that failure stored the trigger ERROR.

The same fixes ship in Quartz.NET 4.4.

Full Changelog: quartznet/quartznet@v3.22.3...v3.22.4

3.22.3

One fix for the 3.x line, additive: no public API change and no schema change. It is a port of a fix found while building Quartz.NET 4.3.

Fixed

  • A database error on one trigger of a fire batch no longer commits half of it. JobStoreSupport.TriggersFired recorded a non-transient error while firing one trigger as that trigger's failure, and committed the batch anyway. On SQL Server and MySQL the commit kept the failed trigger's partial writes, which could leave its [DisallowConcurrentExecution] job's other triggers BLOCKED for good. On PostgreSQL the error aborted the transaction, so the commit silently rolled back triggers already reported fired: their jobs ran while the store still held them as reserved, and could run again after recovery. The failing attempt now rolls back whole, and the batch fires again without that trigger, which is reported failed. Nothing changes when nothing fails. (#​3931, #​3944)

The same fix ships for 4.2 in 4.2.4.

Full Changelog: quartznet/quartznet@v3.22.2...v3.22.3

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.1

Release notes: https://xunit.net/releases/visualstudio/4.0.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump Confluent.Kafka and 10 others
d2f13c4 
Bumps Confluent.Kafka from 2.15.1 to 2.16.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 8.0.31 to 8.0.33
Bumps Microsoft.AspNetCore.Authentication.OpenIdConnect from 8.0.31 to 8.0.33
Bumps Microsoft.Data.SqlClient from 7.1.0 to 7.1.1
Bumps Microsoft.EntityFrameworkCore.Relational from 8.0.31 to 8.0.33
Bumps Microsoft.EntityFrameworkCore.SqlServer from 8.0.31 to 8.0.33
Bumps Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.12 to 10.0.14
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps Newtonsoft.Json from 13.0.3 to 13.0.4
Bumps Quartz from 3.22.2 to 3.22.9
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1

---
updated-dependencies:
- dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-routine
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.AspNetCore.Authentication.OpenIdConnect
  dependency-version: 8.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 8.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 8.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Confluent.Kafka
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-routine
- dependency-name: Newtonsoft.Json
  dependency-version: 13.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Quartz
  dependency-version: 3.22.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.Data.SqlClient
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 8.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-routine
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 12, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #55.

@dependabot dependabot Bot closed this Nov 12, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/samples/Shop.Tests/develop/dotnet-routine-14fe1c1f51 branch November 12, 2026 02:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants