Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10 #27

Forwarded Headers Middleware: Ignore X-Forwarded-Headers from Unknown Proxy (#61622)
The Forwarded Headers Middleware now ignores X-Forwarded-Headers sent from unknown proxies. This change improves security by ensuring that only trusted proxies can influence forwarded header values, preventing potential spoofing or misrouting issues.

Dependency Updates

Bump src/submodules/googletest from 52204f7 to 04ee1b4 (#61762)
Updates the GoogleTest submodule to a newer commit, bringing in the latest improvements and bug fixes from the upstream project.
Update dependencies from dotnet/arcade (#61714)
Updates internal build and infrastructure dependencies from the dotnet/arcade repository, ensuring compatibility and access to the latest build tools.
Update dependencies from dotnet/extensions (#61571)
Refreshes dependencies from the dotnet/extensions repository, incorporating the latest features and fixes from the extensions libraries.
Update dependencies from dotnet/extensions (#61877)
Further updates dependencies from dotnet/extensions, ensuring the project benefits from recent improvements and bug fixes.
Update dependencies from dotnet/arcade (#61892)
Additional updates to build and infrastructure dependencies from dotnet/arcade, maintaining up-to-date tooling and build processes.

Miscellaneous

Update branding to 9.0.6 (#61831)
Updates the project version and branding to 9.0.6, reflecting the new release and ensuring version consistency across the codebase.
Merging internal commits for release/9.0 (#61925)
Incorporates various internal commits into the release/9.0 branch, ensuring that all relevant changes are included in this release.

This summary is generated and may contain inaccuracies. For complete details, please review the linked pull requests.

Full Changelog: v9.0.5...v9.0.6

9.0.5

Release

What's Changed

Update branding to 9.0.5 by @vseanreesermsft in Update branding to 9.0.5 dotnet/aspnetcore#61284
[release/9.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 by @dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 dotnet/aspnetcore#61261
[release/9.0] Upgrade to Ubuntu 22 by @github-actions in [release/9.0] Upgrade to Ubuntu 22 dotnet/aspnetcore#61215
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60964
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60902
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61355
[release/9.0] Caching SERedis critical bugfix; defer HC metadata detection because of DI cycle by @github-actions in [release/9.0] Caching SERedis critical bugfix; defer HC metadata detection because of DI cycle dotnet/aspnetcore#60916
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61354
Merging internal commits for release/9.0 by @vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#61393
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61412
Revert "Revert "[release/9.0] Update remnants of azureedge.net"" by @wtgodbe in Revert "Revert "[release/9.0] Update remnants of azureedge.net"" dotnet/aspnetcore#60353
[release/9.0] Fix preserving messages for stateful reconnect with backplane by @github-actions in [release/9.0] Fix preserving messages for stateful reconnect with backplane dotnet/aspnetcore#61374
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61483
[Identity] Fix Identity UI asset definitions by @javiercn in [Identity] Fix Identity UI asset definitions dotnet/aspnetcore#59100

Full Changelog: dotnet/aspnetcore@v9.0.4...v9.0.5

9.0.4

Release

What's Changed

Update branding to 9.0.4 by @vseanreesermsft in Update branding to 9.0.4 dotnet/aspnetcore#60785
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60445
[release/9.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 by @dependabot in [release/9.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 dotnet/aspnetcore#60678
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60356
Fix OpenAPI server URLs for Aspire scenarios by @captainsafia in Fix OpenAPI server URLs for Aspire scenarios dotnet/aspnetcore#60673
Fix self-referential schema handling in collection schemas by @captainsafia in Fix self-referential schema handling in collection schemas dotnet/aspnetcore#60410
[release/9.0] [Blazor] Fix custom elements JS assets not being included in build output by @MackinnonBuck in [release/9.0] [Blazor] Fix custom elements JS assets not being included in build output dotnet/aspnetcore#60858
Merging internal commits for release/9.0 by @vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#60880

Full Changelog: dotnet/aspnetcore@v9.0.3...v9.0.4

9.0.3

Release

What's Changed

Update branding to 9.0.3 by @vseanreesermsft in Update branding to 9.0.3 dotnet/aspnetcore#60198
[release/9.0] Fix branding by @wtgodbe in [release/9.0] Fix branding dotnet/aspnetcore#60029
[release/9.0] Update to MacOS 15 in Helix by @github-actions in [release/9.0] Update to MacOS 15 in Helix dotnet/aspnetcore#60238
[release/9.0] Revert "Revert "Use the latest available jdk"" by @github-actions in [release/9.0] Revert "Revert "Use the latest available jdk"" dotnet/aspnetcore#60229
[release/9.0] Update HtmlAttributePropertyHelper to correctly follow the MetadataUpdateHandlerAttribute contract by @github-actions in [release/9.0] Update HtmlAttributePropertyHelper to correctly follow the MetadataUpdateHandlerAttribute contract dotnet/aspnetcore#59908
[release/9.0] Fix skip condition for java tests by @github-actions in [release/9.0] Fix skip condition for java tests dotnet/aspnetcore#60242
[release/9.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 by @dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 dotnet/aspnetcore#60151
[release/9.0] Readd DiagnosticSource to KestrelServerImpl by @github-actions in [release/9.0] Readd DiagnosticSource to KestrelServerImpl dotnet/aspnetcore#60202
[release/9.0] Redis distributed cache: add HybridCache usage signal by @github-actions in [release/9.0] Redis distributed cache: add HybridCache usage signal dotnet/aspnetcore#59886
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59952
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59951
[release/9.0] Update remnants of azureedge.net by @sebastienros in [release/9.0] Update remnants of azureedge.net dotnet/aspnetcore#60263
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60291
[release/9.0] Centralize on one docker container by @wtgodbe in [release/9.0] Centralize on one docker container dotnet/aspnetcore#60298
Revert "[release/9.0] Update remnants of azureedge.net" by @wtgodbe in Revert "[release/9.0] Update remnants of azureedge.net" dotnet/aspnetcore#60323
Merging internal commits for release/9.0 by @vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#60317

Full Changelog: dotnet/aspnetcore@v9.0.2...v9.0.3

9.0.2

Release

What's Changed

Update branding to 9.0.2 by @vseanreesermsft in Update branding to 9.0.2 dotnet/aspnetcore#59757
[release/9.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#59267
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59266
[release/9.0] Update OSX helix queue by @github-actions in [release/9.0] Update OSX helix queue dotnet/aspnetcore#59743
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59728
[release/9.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 by @dependabot in [release/9.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 dotnet/aspnetcore#59679
[release/9.0] Skip tests on internal queues too by @github-actions in [release/9.0] Skip tests on internal queues too dotnet/aspnetcore#59578
[release/9.0] Fix loading dotnet user-jwts config by @github-actions in [release/9.0] Fix loading dotnet user-jwts config dotnet/aspnetcore#59473
[release/9.0] Fix MultipartReaderStream synchronous read when using buffer offset by @github-actions in [release/9.0] Fix MultipartReaderStream synchronous read when using buffer offset dotnet/aspnetcore#59422
[release/9.0] Update dependencies from dotnet/xdt by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/xdt dotnet/aspnetcore#59419
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59611
[release/9.0] Fix Kestrel host header mismatch handling when port in Url by @github-actions in [release/9.0] Fix Kestrel host header mismatch handling when port in Url dotnet/aspnetcore#59362
Migrate off of Fedora 38 by @v-firzha in Migrate off of Fedora 38 dotnet/aspnetcore#59613
[release/9.0] [Blazor WASM standalone] Avoid caching index.html during development by @MackinnonBuck in [release/9.0] [Blazor WASM standalone] Avoid caching index.html during development dotnet/aspnetcore#59348
[release/9.0] Update to Fedora 41 by @github-actions in [release/9.0] Update to Fedora 41 dotnet/aspnetcore#59816
[release/9.0] Don't throw exception for parameters with custom binding source by @github-actions in [release/9.0] Don't throw exception for parameters with custom binding source dotnet/aspnetcore#59533
[release/9.0] Apply schema transformer to AdditionalProperties by @github-actions in [release/9.0] Apply schema transformer to AdditionalProperties dotnet/aspnetcore#59730
[release/9.0] Harden schema reference transformer for relative references by @captainsafia in [release/9.0] Harden schema reference transformer for relative references dotnet/aspnetcore#59779
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59847
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59848
[release/9.0] Return 206 Partial Content on Valid Range for Static Assets by @github-actions in [release/9.0] Return 206 Partial Content on Valid Range for Static Assets dotnet/aspnetcore#59325
Merging internal commits for release/9.0 by @vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#59871

Full Changelog: dotnet/aspnetcore@v9.0.1...v9.0.2

9.0.1

Release

What's Changed

Merging internal commits for release/9.0 by @vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#58900
[release/9.0] Prevent unnecessary debugger stops for user-unhandled exceptions in Blazor apps with Just My Code enabled by @halter73 in [release/9.0] Prevent unnecessary debugger stops for user-unhandled exceptions in Blazor apps with Just My Code enabled dotnet/aspnetcore#58573
Hot Reload agent improvements by @tmat in Hot Reload agent improvements dotnet/aspnetcore#58333
[release/9.0] Update dependencies from roslyn by @wtgodbe in [release/9.0] Update dependencies from roslyn dotnet/aspnetcore#59183
[release/9.0] Add direct reference to System.Drawing.Common in tools by @wtgodbe in [release/9.0] Add direct reference to System.Drawing.Common in tools dotnet/aspnetcore#59189
[release/9.0] Harden parsing of [Range] attribute values by @github-actions in [release/9.0] Harden parsing of [Range] attribute values dotnet/aspnetcore#59077
[release/9.0] Update dependencies from dotnet/source-build-externals by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#59143
[release/9.0] Update dependencies from dotnet/arcade by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59024
[release/9.0] (deps): Bump src/submodules/googletest from 6dae7eb to d144031 by @dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 6dae7eb to d144031 dotnet/aspnetcore#59032
[release/9.0] Update dependencies from dotnet/xdt by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/xdt dotnet/aspnetcore#58589
[release/9.0] Update dependencies from dotnet/extensions by @dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#58675
[release/9.0] Fix SignalR Java POM to include description by @github-actions in [release/9.0] Fix SignalR Java POM to include description dotnet/aspnetcore#58896
[release/9.0] Fix IIS outofprocess to remove WebSocket compression handshake by @github-actions in [release/9.0] Fix IIS outofprocess to remove WebSocket compression handshake dotnet/aspnetcore#58931

Full Changelog: dotnet/aspnetcore@v9.0.0...v9.0.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependabot · 2025-11-06T12:44:17Z

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2025-11-06T12:45:50Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 3e62059.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

nuget/Microsoft.AspNetCore.OpenApi

9.0.10

🟢 6.3

Details

Check	Score	Reason
Code-Review	🟢 9	Found 9/10 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Signed-Releases	⚠️ -1	no releases found
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6

Scanned Files

examples/AspNetCoreIntegrationExample/AspNetCoreIntegrationExample.csproj

github-actions · 2025-11-06T12:46:45Z

Test Results (ubuntu-latest - .NET 9.0.x)

452 tests ±0 452 ✅ ±0 9s ⏱️ -3s
1 suites ±0 0 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 3e62059. ± Comparison against base commit c3e8f89.

♻️ This comment has been updated with latest results.

--- updated-dependencies: - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 9.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Nov 6, 2025

Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10

3e62059

--- updated-dependencies: - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 9.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot force-pushed the dependabot/nuget/examples/AspNetCoreIntegrationExample/Microsoft.AspNetCore.OpenApi-9.0.10 branch from 31bec6d to 3e62059 Compare November 6, 2025 13:53

ldsenow merged commit 22cd7b0 into main Nov 6, 2025
11 of 13 checks passed

dependabot bot deleted the dependabot/nuget/examples/AspNetCoreIntegrationExample/Microsoft.AspNetCore.OpenApi-9.0.10 branch November 6, 2025 14:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10 #27

Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10 #27

Uh oh!

dependabot bot commented on behalf of github Nov 6, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Nov 6, 2025

Uh oh!

github-actions bot commented Nov 6, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 6, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10 #27

Bump Microsoft.AspNetCore.OpenApi from 9.0.0 to 9.0.10 #27

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

9.0.10

What's Changed

9.0.9

What's Changed

9.0.7

What's Changed

9.0.6

Bug Fixes

Dependency Updates

Miscellaneous

9.0.5

What's Changed

9.0.4

What's Changed

9.0.3

What's Changed

9.0.2

What's Changed

9.0.1

What's Changed

Uh oh!

dependabot bot commented on behalf of github Nov 6, 2025

Labels

Uh oh!

github-actions bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results (ubuntu-latest - .NET 9.0.x)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Nov 6, 2025 •

edited

Loading

github-actions bot commented Nov 6, 2025 •

edited

Loading

github-actions bot commented Nov 6, 2025 •

edited

Loading