You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#1089) even though the vulnerable API is not used by our library.
A big thank you to all NATS contributors and community members who helped make this release possible ❤️
// Option 1: Use the new extension methodawaitmsg.NakAsync(TimeSpan.FromSeconds(5));// Option 2: Use AckOpts with NakDelayawaitmsg.NakAsync(newAckOpts{NakDelay=TimeSpan.FromSeconds(5)});
Note: because we also have an extension method, recompiling your project is enough.
AckTerminateAsync now supports an optional termination reason. A new overload and a new TerminateReason property on AckOpts have been added to INatsJSMsg<T>. Implementors of this interface must add the new method.
// New overloadawaitmsg.AckTerminateAsync("processing failed permanently");// Or via AckOptsawaitmsg.AckTerminateAsync(newAckOpts{TerminateReason="processing failed permanently"});// Extension method shorthandawaitmsg.AckTerminateAsync("reason",cancellationToken);
Calling NextAsync(), FetchAsync(), or FetchNoWaitAsync() on a consumer with PriorityPolicy.PinnedClient now throws NatsJSException. Use ConsumeAsync() instead.
// This now throws NatsJSException:varmsg=awaitconsumer.NextAsync<string>();// Use ConsumeAsync instead:awaitforeach(varmsginconsumer.ConsumeAsync<string>()){// process message}
Consumer methods (ConsumeAsync, FetchAsync, NextAsync) now call cancellationToken.ThrowIfCancellationRequested() immediately at method entry. Previously cancelled tokens were checked later in the async pipeline.
StreamSnapshotRequest ChunkSize Type Change (#1088)
StreamSnapshotRequest.ChunkSize changed from long to int? with a narrower validation range (1KB–1MB). WindowSize (int?) was added as a new optional property.
// Before (v2.7.2)varreq=newStreamSnapshotRequest{ChunkSize=1024L};// After (v2.7.3)varreq=newStreamSnapshotRequest{ChunkSize=1024,// int? now, valid range: 1024–1048576WindowSize=8388608,// new optional, valid range: 1024–33554432};
The telemetry tag network.protocol.version (value: protocol version number) has been replaced with network.transport (value: "tcp") to align with OpenTelemetry semantic conventions. Update any dashboards or alerting rules that filter on the old tag name.
Default Parameter Values Changed from default to null (#1081)
All optional parameters on INatsJSMsg<T> methods (AckAsync, NakAsync, AckProgressAsync, AckTerminateAsync, ReplyAsync) changed from = default to = null. This is source-compatible but binary-breaking — existing compiled assemblies must be recompiled against v2.7.3.
What's Changed
Add more tests for JetStream consumer behavior by @mtmk in #1055
Fix error logs URI rewritten by OnConnectingAsync by @mtmk in #1067
Microsoft.Bcl.Memory is a transitive dependency for netstandard2.0 targets any app pulling in NATS.Client.Core gets it. Even though this library doesn't call the vulnerable Base64Url.Decode API, the consuming application (or another dependency in its graph) might. A CVSSv3 7.5 DoS from a malformed network input is not something you want sitting in your dependency tree. (Microsoft CVE )
If you are not upgrading to this new version of NATS .NET AND targeting NETStandard2.0, applications should add an explicit package reference to force the patched version:
You don't need to upgrade NATS.NET itself to get the fix if you need time. NuGet will happily resolve the newer patch version of Microsoft.Bcl.Memory since it's within the same major.minor range.
Here is a report generated by AI:
NAT .NET library implementation is not affected by the same bug. Different vulnerability, different code.
The CVE is about an out-of-bounds read in System.Buffers.Text.Base64Url's decode path when processing malformed
input — that's a SIMD-optimized native implementation with pointer arithmetic that can overrun its buffer.
Your custom Base64UrlEncoder (borrowed from Azure AD IdentityModel):
Decode path: Converts Base64Url chars back to standard Base64 chars (- → +, _ → /), pads with =, then delegates to
Convert.FromBase64String(). The actual decoding is done by the framework's well-tested Convert.FromBase64String,
which will throw FormatException on malformed input rather than reading out of bounds.
Validates input length: Rejects length % 4 == 1 upfront (line 164), which is always invalid.
Bounded loops: The unsafe code in UnsafeDecode only iterates up to str.Length and decodedLength (which is at most
str.Length + 3), and the output string is allocated to exactly decodedLength.
The implementation is sound. It's not pretty (mutating "immutable" strings via fixed pointers is a hack), but it's
not vulnerable to the same class of bug.
This release of the NUnit Analyzers improves NUnit1029 to account for TestCaseSource
support for params and optional arguments. It also introduces a new analyzer for incorrect
usage of Is.Not.Null.Or.Empty, fixes regressions in NUnit2005 and NUnit2055, and updates
NUnit package dependencies.
The release contains contributions from the following users (in alphabetical order):
Breaking change: Fixed tracestate parsing to reject keys that do not
begin with a lowercase letter, including keys beginning with digits, to
align with the W3C Trace Context specification.
Breaking change: Fixed an insecure disk retry default for OTLP export.
Disk retry now requires OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH
when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk is configured.
Improve efficiency of parsing of baggage and B3 propagation headers.
OtlpLogExporter now uses IHttpClientFactory on .NET 8+.
Fixed an issue in OTLP/gRPC retry handling where parsing gRPC status.
Fixed OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT not being applied.
Fixed baggage and trace headers not respecting the maximum length in some cases.
Fixed BaggagePropagator to trim optional whitespace (OWS) around =
separators when parsing the baggage header.
Fixed BaggagePropagator to strip baggage properties from values when
parsing the baggage header.
Fixed OTLP persistent storage clean-up handling for malformed filenames.
Fixed resource leak in batch and periodic exporting task workers for Blazor/WASM.
Fixed LogRecord.LogLevel to preserve LogLevel.None.
Fixed OTEL_TRACES_SAMPLER_ARG handling for out-of-range values.
Fixed an issue with OTLP disk retry storage where metrics and logs used the
traces storage directory.
Fixed full OTLP endpoint being logged by internal diagnostics.
Improve efficiency of parsing of baggage, B3 and Jaeger propagation headers.
Hardened Zipkin exporter memory usage for endpoint caching and array tag
serialization.
Limit how much of the response body is read by the OTLP exporter when
export fails and error logging is enabled.
Added Task-based worker support for BatchExportProcessor and PeriodicExportingMetricReader to enable the OpenTelemetry SDK to work
in single-threaded WebAssembly environments such as Blazor and
Uno Platform.
Breaking change: The Baggage API now disallows empty baggage names and
treats baggage names and values as case sensitive, aligning with the latest Baggage API specification.
Various bug fixes across OpenTelemetry.Api and OpenTelemetry SDK,
including fixes for thread-safety, sampler edge cases, metrics precision,
and observable instrument lifecycle handling.
When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed.
This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response.
Details
open-telemetry/opentelemetry-dotnet#6564 introduced a change to read the response body when a non-200 HTTP status code is received when exporting telemetry to aid debugging by operators so that the error response is included in the logs emitted by the exporter for both gRPC and HTTP/protobuf.
This vulnerability was surfaced during the investigation of GHSA-w8rr-5gcm-pp58.
Impact
If an application using the OTLP exporter is configured to use a back-end/collector endpoint that is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response the application could have its memory exhausted and create a denial-of-service condition.
Mitigation
The application's configured back-end/collector endpoint needs to behave maliciously. If the collector/back-end is a well-behaved implementation response bodies should not be excessively large if a request error occurs.
Workarounds
None known.
Remediation
#7017 updates the OTLP exporter for both gRPC and HTTP to:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate
Bot
force-pushed
the
renovate/nuget
branch
from
This PR contains the following updates:
2.5.1→2.5.23.7.500.80→3.7.500.963.7.510.6→3.7.511.63.7.502.39→3.7.502.553.7.504.32→3.7.504.485.2.0→5.3.03.32.0→3.33.08.0.24→8.0.2610.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.710.0.3→10.0.78.0.24→8.0.2610.0.3→10.0.718.0.1→18.4.02.7.2→2.7.32.7.2→2.7.34.4.0→4.5.14.11.2→4.12.06.1.0→6.2.01.15.0→1.15.31.15.0→1.15.32.11.0→2.12.148.0.0→8.0.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
Azure/amqpnetlite (AMQPNetLite.Core)
v2.5.2: Release 2.5.2Fixes and improvements:
aws/aws-sdk-net (AWSSDK.S3)
v3.7.511destructurama/attributed (Destructurama.Attributed)
v5.3.0Compare Source
New features
Changes for CI and tests
Full Changelog: destructurama/attributed@5.2.0...5.3.0
googleapis/google-cloud-dotnet (Google.Cloud.PubSub.V1)
v3.33.0: Google.Cloud.PubSub.V1 version 3.33.0Compare Source
New features
dotnet/dotnet (Microsoft.Bcl.AsyncInterfaces)
v10.0.7v10.0.6v10.0.5v10.0.4microsoft/vstest (Microsoft.NET.Test.Sdk)
v18.4.0What's Changed
Add LoongArch64 support by @stdmnpkg in #15359
Refactor Condition evaluation by @Youssef1313 in #15357
Adding info on extensions points part 1 by @nohwnd in #15360
Add option to ask for uploading code QL before the standard window ends by @nohwnd in #15373
Update runtime versions by @nohwnd in #15372
Fix .NET 10 regression for traits by @Youssef1313 in #15370
Update target frameworks to net10.0 and net11.0 by @dotnet-maestro[bot] in #15349
Fix names in pipeline matrix so we don't have to align them by @nohwnd in #15365
Update SECURITY.md by @Youssef1313 in #15342
New Contributors
Full Changelog: microsoft/vstest@v18.3.0...v18.4.0
v18.3.0What's Changed
Internal fixes and updates
New Contributors
nats-io/nats.net (NATS.Client.JetStream)
v2.7.3: NATS .NET v2.7.3Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#1089) even though the vulnerable API is not used by our library.
A big thank you to all NATS contributors and community members who helped make this release possible ❤️
Breaking Changes
NakAsync Signature Change (#1081)
The
TimeSpan delayparameter has been removed fromINatsJSMsg<T>.NakAsync(). The delay must now be passed viaAckOpts.NakDelay.Before (v2.7.2):
After (v2.7.3):
Note: because we also have an extension method, recompiling your project is enough.
AckTerminateAsync TermWithReason (#1048, #1081)
AckTerminateAsyncnow supports an optional termination reason. A new overload and a newTerminateReasonproperty onAckOptshave been added toINatsJSMsg<T>. Implementors of this interface must add the new method.Requires NATS Server 2.10.4+.
PinnedClient Validation (#1063)
Calling
NextAsync(),FetchAsync(), orFetchNoWaitAsync()on a consumer withPriorityPolicy.PinnedClientnow throwsNatsJSException. UseConsumeAsync()instead.Consumer Cancellation Handling (#1068)
Consumer methods (
ConsumeAsync,FetchAsync,NextAsync) now callcancellationToken.ThrowIfCancellationRequested()immediately at method entry. Previously cancelled tokens were checked later in the async pipeline.StreamSnapshotRequest ChunkSize Type Change (#1088)
StreamSnapshotRequest.ChunkSizechanged fromlongtoint?with a narrower validation range (1KB–1MB).WindowSize(int?) was added as a new optional property.WindowSizerequires NATS Server 2.12.5+.OpenTelemetry Tag Change (#1078)
The telemetry tag
network.protocol.version(value: protocol version number) has been replaced withnetwork.transport(value:"tcp") to align with OpenTelemetry semantic conventions. Update any dashboards or alerting rules that filter on the old tag name.Default Parameter Values Changed from
defaulttonull(#1081)All optional parameters on
INatsJSMsg<T>methods (AckAsync,NakAsync,AckProgressAsync,AckTerminateAsync,ReplyAsync) changed from= defaultto= null. This is source-compatible but binary-breaking — existing compiled assemblies must be recompiled against v2.7.3.What's Changed
PingCommandcancellation by @mtmk in #1086Full Changelog: nats-io/nats.net@v2.7.2...v2.7.3
CVE Update
Microsoft.Bcl.Memoryis a transitive dependency fornetstandard2.0targets any app pulling inNATS.Client.Coregets it. Even though this library doesn't call the vulnerableBase64Url.DecodeAPI, the consuming application (or another dependency in its graph) might. A CVSSv3 7.5 DoS from a malformed network input is not something you want sitting in your dependency tree. (Microsoft CVE )If you are not upgrading to this new version of NATS .NET AND targeting NETStandard2.0, applications should add an explicit package reference to force the patched version:
You don't need to upgrade NATS.NET itself to get the fix if you need time. NuGet will happily resolve the newer patch version of
Microsoft.Bcl.Memorysince it's within the samemajor.minorrange.Here is a report generated by AI:
Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.7.3
nunit/nunit (NUnit)
v4.5.1: V 4.5.1Compare Source
See release notes for details.
v4.5.0: V 4.5.0Compare Source
See release notes for details.
nunit/nunit.analyzers (NUnit.Analyzers)
v4.12.0: NUnit Analyzers 4.12 - March 3, 2026Compare Source
NUnit Analyzers 4.12 - March 3, 2026
This release of the NUnit Analyzers improves
NUnit1029to account forTestCaseSourcesupport for params and optional arguments. It also introduces a new analyzer for incorrect
usage of
Is.Not.Null.Or.Empty, fixes regressions inNUnit2005andNUnit2055, and updatesNUnit package dependencies.
The release contains contributions from the following users (in alphabetical order):
Issues Resolved
Features and Enhancements
Is.Not.Null.Or.EmptyusedBugs
NUnit2055can generate invalid code for classic assertsNUnit2005tries to useIs.Emptyconstraint on incompatible types.Tooling, Process, and Documentation
nunit/nunit3-vs-adapter (NUnit3TestAdapter)
v6.2.0: V 6.2.0See release notes
open-telemetry/opentelemetry-dotnet (OpenTelemetry)
v1.15.3Release details: 1.15.3
tracestateparsing to reject keys that do notbegin with a lowercase letter, including keys beginning with digits, to
align with the W3C Trace Context specification.
Disk retry now requires
OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATHwhen
OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=diskis configured.OtlpLogExporternow usesIHttpClientFactoryon .NET 8+.OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMITnot being applied.BaggagePropagatorto trim optional whitespace (OWS) around=separators when parsing the
baggageheader.BaggagePropagatorto strip baggage properties from values whenparsing the
baggageheader.LogRecord.LogLevelto preserveLogLevel.None.OTEL_TRACES_SAMPLER_ARGhandling for out-of-range values.traces storage directory.
serialization.
v1.15.2Release details: 1.15.2
export fails and error logging is enabled.
BatchExportProcessorandPeriodicExportingMetricReaderto enable the OpenTelemetry SDK to workin single-threaded WebAssembly environments such as Blazor and
Uno Platform.
v1.15.1Release details: 1.15.1
treats baggage names and values as case sensitive, aligning with the latest
Baggage API specification.
OpenTelemetry.ApiandOpenTelemetrySDK,including fixes for thread-safety, sampler edge cases, metrics precision,
and observable instrument lifecycle handling.
StackExchange/StackExchange.Redis (StackExchange.Redis)
v2.12.14Compare Source
What's Changed
Impact: "high" if using cluster and high-integrity-mode together (resolves an issue that can mis-report
-MOVEDresponses as integrity failures)NuGet link
New Contributors
Full Changelog: StackExchange/StackExchange.Redis@2.12.8...2.12.14
v2.12.8Compare Source
What's Changed
Full Changelog: StackExchange/StackExchange.Redis@2.12.4...2.12.8
v2.12.4Compare Source
What's Changed
Full Changelog: StackExchange/StackExchange.Redis@2.12.1...2.12.4
v2.12.1Compare Source
What's Changed
LCSoutputs and missingRedisType.VectorSet(#3028 by @mgravell)AsciiHash(#3028 by @mgravell)Full Changelog: StackExchange/StackExchange.Redis@2.11.8...2.12.1
v2.11.8Compare Source
What's Changed
-MOVEDerror pointing to same endpoint. by @barshaul in #3003HOTKEYSby @mgravell in #3017-MOVEDtest by @mgravell in #3020New Contributors
Full Changelog: StackExchange/StackExchange.Redis@2.11.3...2.11.8
v2.11.3Compare Source
What's Changed
Full Changelog: StackExchange/StackExchange.Redis@2.11.0...2.11.3
coverlet-coverage/coverlet (coverlet.collector)
v8.0.1Fixed
Improvements
Diff between 8.0.0 and 8.0.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.