v2.5.0 — Continuous integration: PR bot, project file, org dashboard

v2.5 is about what happens after you leave the workbench. The things Bowire already knew — your schemas, your recordings, your benchmarks, your contracts — now show up where the work actually gets judged: in CI, on a pull request, and in an editor panel next to the code.

215 commits since v2.4.0. Every workspace, collection, recording, mock and flow loads identically. Two changes are worth reading before you upgrade — see Breaking changes.

Highlights

The workbench, in VS Code (#101)

ext install kuestenlogik.bowire-vscode opens Bowire in an editor panel beside your code.

It does not bundle a CLI — it drives one. The extension uses a bowire you configured, one your repository pins in a tool manifest, or one on your PATH, and offers to fetch a verified copy when it finds none. That is the whole point: the workbench in your editor, the bowire in your terminal and the one in CI are the same binary reading the same collections.

Uninstalling the extension removes a CLI it downloaded. One you installed yourself is never touched.

Design-time lint — the review comments you keep writing (#189)

Most API design problems are caught in review if the reviewer is sharp — inconsistent naming, a field that returns a password, an unbounded list with no pagination, a missing version. That scales with reviewer attention, which does not scale.

bowire lint <snapshot|url> runs a typed rule engine over the schema and reports them without a reviewer having to be sharp that day:

bowire lint https://api.example.com --format markdown --fail-on high

Text for a terminal, markdown for a PR comment, JSON for whatever you build next. --fail-on gates the build — and none or an unrecognised level never fails, because a lint gate is advisory and a typo should not break a build that was passing.

Latency budgets as CI gates (#360, #232)

k6-style thresholds: a budget is either met or the run exits non-zero.

bowire bench run Weather/getCurrent --url rest@http://localhost:6000 --threshold "p95 < 200" --threshold "error-rate < 0.01"

Budgets are plain numbers — milliseconds for the latency metrics, a
fraction for error-rate. Metric spellings are forgiving (p(95),
error_rate and error-rate all land on the same metric), the budget is
not: a unit suffix is refused rather than guessed at, and every threshold
is parsed before the run starts so a typo in the fifth budget does not
surface after two minutes of load.

Benchmarks also gained a scheduled shape — a cron-driven run that survives a restart, with the schedule readable and pausable from the workbench. Deliberately no "create" button in the browser: a schedule carries a target URL the server will call unattended, so authoring one stays on the CLI where the operator is explicit about it.

Contract matrix in the workbench (#364)

Consumer × provider, pass/fail, in one grid. Each cell carries how many interactions backed the verdict — 11 of 12 and 0 of 12 are very different mornings — and a pair that was never run reads as a dash rather than a blank, which would look like "checked, nothing wrong".

One rollup over the artefacts you already write (#587)

Lint findings, contract results, benchmark envelopes, k6 summaries, SARIF, JUnit — Bowire already wrote all of it as structured files. bowire report rollup reads them into one portfolio view, available identically from the CLI, GET /api/report/rollup, and the bowire.report.rollup MCP tool.

Counts stay nullable on purpose: "no lint report was read" and "lint found nothing" are different statements, and flattening both to zero would let a missing report read as a clean bill of health.

A PR bot you can use (#183, #582)

The PR-report action moved to its own public repository and the Marketplace:

- uses: Kuestenlogik/bowire-action@v1

It posts one comment per PR — API-schema delta, test results, security findings, perf — and edits that comment on later runs instead of stacking new ones.

Secrets stay secret in CI output (#361)

Values marked secret are redacted in logs, reports, annotations and exported commands. Bowire's CI story previously printed resolved variables into all of them.

Your repo can own its Bowire configuration (#172, #616)

// .bowire/project.json
{ "version": 1, "storage": "project" }

Collections, environments and recordings then live beside the code and commit, diff and review like any other file. Opt-in — a manifest that says nothing keeps the machine-wide store, so nothing moves under you.

Underneath, one resolver now decides where anything is stored. Fourteen files across six assemblies used to build ~/.bowire/… by hand, which meant the project opt-in reached some stores and silently missed others — the plugin directory, the proxy CA, the vuln-db cache and the MCP stores among them.

Starting Bowire from another program (#615)

bowire --port 0 --port-file ./run/bowire.json

The OS picks a free port; Bowire writes the address it actually bound once it is listening, and deletes the file on shutdown. The file exists if and only if the workbench is bound, which makes it the address and the readiness signal.

Do not scrape the startup banner for this. It is a log line, so it disappears at a quieter log level — and it used to be printed before the bind was known to have worked, so it could announce a URL that never served. That is fixed too, but --port-file is the contract.

Faster REST discovery (#585)

OpenAPI discovery took 5–8 s and flaked near the 8 s probe timeout. It no longer does.

Security

• Path injection in the workspace-scoped endpoints (#617). ?workspaceId= and ?storageRoot= went from the query string into Path.Combine unchecked, across six endpoint files. A request could name any directory on the machine and have Bowire read or write there, reporting success. Both are now validated in one place: a workspace id must be a single segment from an allow-list; a storage root must be absolute, free of .., and name a directory that already exists.
• A reverse-proxy upstream must be http/https. Uri.TryCreate(s, UriKind.Absolute) returns true for an absolute file path on Unix, so /etc/passwd parsed as file:///etc/passwd and was accepted as an upstream — on Linux only, which is where this runs in production.

Breaking changes

BrowserUiHost.HostRunner gained a parameter. Embedded hosts that substituted the runner (a test seam) now receive an onListening callback and must invoke it with the bound URL. Everything downstream of the address — the banner, --port-file, auto-opening a browser — hangs off that call, because with --port 0 the port is not knowable before the bind.

Storage paths route through IBowirePathResolver. If you referenced DefaultBowireUserStore.UserProfileRoot or built ~/.bowire/… yourself, use BowirePaths.Resolve(BowireStorageScope.Data, …) or take IBowirePathResolver as a dependency. The old property still works; it is simply no longer the thing that knows where your data is. See Storage locations.

Fixes worth naming

• Workspace rows could act on the wrong workspace (#610). morphdom matched overview rows positionally because they carried no id, so after a delete a row kept the click handlers of the workspace that had just been removed while displaying the next one. The visible symptom was a delete button that did nothing; one step further it would have renamed or deleted the wrong workspace.
• Collections were not workspace-scoped (#612). Every workspace read and wrote the same file, so whichever saved last handed its collections to all the others.
• Streaming responses pushed the detail pane off screen with no scrollbar.
• The per-workspace disk purge never ran. DELETE /api/workspace/{id} anchored its containment check on the user root, which it asked for with an empty filename — and the store rejects that, so every call ended in an unhandled ArgumentException before a single byte was deleted. The check anchors on the workspaces folder now, which also closes a gap the old prefix test left open: a sibling directory whose name merely starts with the root's.
• bowire contract publish met a hand-edited recording with a stack trace. The catch around the recording loader listed IOException but not InvalidDataException, which lives in System.IO and derives from SystemException — so every rejection the loader makes (unsupported format version, an ambiguous --select, a store with no recordings) escaped as an unhandled exception instead of the intended message and exit 65.
• The release cascade waited for nuget.org indexing before dispatching to siblings (#236), so a sibling no longer builds against a version the feed has not published yet.

Acknowledgements

The competitive-research inputs behind the threshold gates (k6) and the redaction work (Hurl) came from a mid-2026 survey pass; both landed as table stakes rather than as differentiators, which is the right way round.

---

The full commit list, contributors, and compare-URL diff are auto-generated below.

Added

• storage — one resolver decides where Bowire stores things (#616) (9e8718e)
• site — give downloads a visual index of artefact kinds (5b75f0b)
• vscode — show which Bowire is resolved, and check cliPath when it changes (4423dcb)
• cli — report the bound workbench URL through --port-file (#615) (29f4d1c)
• release — generate the change list from commits, grouped, with the chore prefix stripped (536b853)
• response — the action cluster goes icon-only, keeping one labelled primary (95a41a0)
• vscode — log the version a tool manifest pins (#589) (78e4af3)
• vscode — offer a verified CLI download when none is installed (#590) (8430e90)
• vscode — CLI aus einem Workspace-Tool-Manifest aufloesen (#589) (1ab05e4)
• storage — Collections koennen im Repo liegen statt im Benutzerprofil (#591) (ef4ac90)
• cli — --url-file lesen (#604) + Ausgabepfade vereinheitlichen (77714fe)
• vscode — veroeffentlichungsreif machen — nur das Token fehlt noch (0d5e8ad)
• scan — Dogfooding-Workflow — und der SARIF-Ort war fest verdrahtet (062ffe4)
• vscode — bowire.cliPath und Versionsprüfung — PATH war eine Sackgasse (ef9a0a8)
• vscode — marketplace icon from the repo's existing logo (#101) (d86f781)
• vscode — host the workbench in VS Code (#101) (68884b8)
• report — rollup surfaces — CLI, endpoint, rail and MCP (#587) (7adef56)
• report — rollup reader over the artefacts Bowire already writes (#587) (6bdc543)
• bench — scheduled-runs panel in the Benchmarks rail (#232) (fbaa7bc)
• bench — schedule CLI + workbench schedule API (#232) (a71d4f1)
• bench — scheduled runs — persisted schedules + cron hosted service (#232) (1d62165)
• bench — bowire bench run with threshold gates and k6 export (#360) (29a8fb0)
• bench — threshold engine, stats and k6 summary for CI gates (#360) (7065467)
• pr-bot — the Perf section — per-test latency delta vs the base branch (#183) (d86566c)
• contracts — shared contract engine + consumer x provider matrix (#364) (047ca6b)
• lint — plugin SPI — discover IBowireLintRule from loaded assemblies (#189 T4) (d99496d)
• mcp — bowire.lint tool — design-time lint over MCP (#189) (d431b38)
• lint — workbench Lint rail + /api/lint endpoint (#189 T1) (348d6df)
• lint — .bowire/rules.json config — rule toggles + severity overrides (#189 slice 3) (32b096f)
• lint — pagination-cursor + PII + string-timestamp rules (#189 slice 2) (6711abd)
• cli — bowire lint — design-time schema linter (#189) (b0037e2)
• lint — design-time schema lint engine + first rules (#189) (2afd448)
• cli — bowire diff — base->head API schema delta (#183) (b9b0739)
• workbench — read .bowire/project.json on Open Folder (#172) (75fbe88)
• project — schema file + workspace migrate + CI-sample for .bowire/project.json (#172) (4ba20fc)
• project — .bowire/project.json convention — core slice (#172) (49fd7e4)
• coverage — emit real JS lcov and upload under a codecov javascript flag (#367) (c1f91fc)
• roadmap — bucket by a mandatory "Target release" board field (61f53e2)

Changed

• pr-bot — move the PR-report action to Kuestenlogik/bowire-action (4db3e60)
• project — Release ist eine Version oder nichts — Guard prueft den Uebergang (2cef9e8)
• scan — Dogfooding als Zusicherung statt als Meldung (7e32c2c)
• rest — probe well-known OpenAPI paths concurrently, not one 3s timeout at a time (aec1f42)
• roadmap — rename the board field "Product milestone" -> "Release" (65876e6)
• scan — ship bowire scan as a composite Action, retire the reusable workflow (82431e0)
• roadmap — rename board field to "Product milestone" + clarify the two-axis model (1ca1e2d)

Fixed

• discover — a plugin with no name took bowire discover down (397924b)
• workspace — the disk purge threw on every call (7f5c26e)
• contract — a hand-edited recording met the operator as a stack trace (6e7c132)
• endpoints — keep the wording the git-events test already asserts (8f1e199)
• endpoints — validate the workspace scope before it reaches a path (55b5217)
• workspaces — give overview rows a stable id so morphdom keeps their handlers (#610) (46d62f0)
• tools — a reverse-proxy upstream must be http, not merely absolute (8f0eef4)
• vscode — delete the managed CLI when the extension is uninstalled (06ae24b)
• vscode — stop trusting the console banner for the workbench URL (f98a3d1)
• vscode — wait until the workbench serves, not until it says it will (9a6fb90)
• vscode — pass --no-browser so the workbench does not also open a browser (a48d3cb)
• collections — scope them per workspace on disk, and stop an empty disk answer erasing local state (c159f33)
• streaming — the frame list scrolls again instead of pushing the detail pane off-screen (0ea922b)
• correlation — a weak step is never bridged, and corroboration never costs a bridge its rank (6365233)
• vscode — fall through to PATH when no SDK can honour a manifest pin (#589) (bb63290)
• project — Track / Priority / Kind aus Vorlagen und Skripten entfernen (fc2f36a)
• project — kind:*-Label raus — sie waren die Ursache leerer Release-Felder (7989554)
• otlp — Luecke zwischen Rueckschau und Abo schliessen (efee6c6)
• plugins — fehlende NuGet-Ressource benennen statt zu dereferenzieren (3a371bd)
• report — Rollup-Pfade auf den Workspace einschnueren — CodeQL hatte recht (309f905)
• vscode — Arbeitsverzeichnis anlegen — ohne geöffneten Ordner scheiterte der Start (b6919a0)
• bench — show scheduled runs on the empty Benchmarks pane too (#232) (f2410f0)
• bench — schedule endpoints must not depend on DI registration (#232) (472dbbb)
• rail — distinct Lint/Contracts glyphs, and stop clipping Settings (0df02d3)
• contracts — one canonical matrix wire shape across CLI, HTTP and MCP (42bd3b0)
• version — AssemblyVersion tracks Major.Minor from the tag, not MinVer's 2.0.0.0 default (574e6be)
• plugin — don't eager-load plugins for the plugin management group (2d5e74f)
• schema — rename Schema namespace to Schemas to avoid DotPulsar collision (964b39e)
• chocolatey — ASCII-only uninstall script so choco uninstall parses (8ec2884)

Documentation

• release — name the two fixes this cycle found (d342d73)
• release — the threshold syntax in the notes does not parse (46dc961)
• release — v2.5.0 notes (6d0177e)
• setup — the extension, and three install paths that did not exist (c33fac5)
• vscode — screenshot in the listing, and reachable docs (b201c76)
• vscode — move the detail into the docs, list the extension on the site (8ae88b7)
• vscode — replace the Mermaid flowchart — the Marketplace does not render it (2f2471f)
• vscode — drop the VS Code version from Requirements (5b785de)
• vscode — stop the requirements section contradicting the resolution chain (8ae1547)
• adr — introduce Architecture Decision Records, with the sidecar transport choice as the first two (d85ad66)
• release-notes — reset upcoming.md to 2.5 and move v2.4's breaking changes where they belong (c70d0f8)
• timeline — the harbor sample now reaches 8/8 (Bowire.Samples#54) (9c2c1d0)
• vscode — document how to move an existing store into a repo (#591) (de30772)
• report — document the rollup across CLI, workbench and MCP (#587) (9704513)
• contracts — the matrix across CLI, workbench, HTTP and MCP (#364) (fd7d0b0)
• setup — PR report bot page + sample workflow (#183) (fe4f4f7)
• install — promote Chocolatey to an available install option (79d4c2d)
• board — fix stale Bugs-view filter (kind:bug label gone -> issue Type=Bug) + track prose (eeb3b76)

Other

• downloads — 'On your machine' — the last group that named a verb (6b0a528)
• downloads — 'Hosted as a container' (8afda33)
• downloads — 'Container image' rather than 'In a container' (c5fda2d)
• downloads — use the same protocol marks as the main page (660896d)
• downloads — group by what you want to do, not by which package manager (77a032a)
• Update SECURITY.md (ed5b717)

Maintenance — 153 maintenance commits · 19 dependency updates

• cli — assert the exit-code rule, not the absence of test fixtures (9a5d500)
• mcp — the lint tool's gate and its envelope (74ad82e)
• workspace — which workspace the migration picks when nobody named one (1505486)
• tests — pass the test cancellation token to CallAsync (xUnit1051) (188c77c)
• cli — what discover, describe and call say when nothing is there (013411f)
• tests — WriteRaw is static (CA1822) (5d910c0)
• mcp — the typed-URL history, and what --allow-invoke does with it (92778b5)
• plugins — build the cache fixture from the record, not by hand (aca6b35)
• plugins — the cache fixture has to use the record's own field names (966684c)
• tests — the restart stub, top-level and owned (f3a5144)
• tests — BowireServiceInfo lives in Kuestenlogik.Bowire.Models (1ed67cb)
• lifecycle against a live plugin, the update badge, the flow capture (593df48)
• one serialised collection for the suites that move the storage root (bd7c2b4)
• mock — use the verification shape the endpoint actually reads (fbb69b2)
• mock — editing a mock that is actually running (84e2417)
• workspace — the identity that has to survive an export (5b5c7da)
• rest — the ad-hoc path, where nothing checks the request but this (876ac52)
• invoke,bench — the SSE stream, and the refusals before a load run (f99d3af)
• mcp — carry the auth-recording tools past the confirmation gate (656d1b8)
• workspace — the purge guard, from the outside (e17fd06)
• tests — three analyzer/compile errors CI caught (43fa62f)
• export — the decisions on either side of the discovery call (ef3147e)
• contract — publish writes files, matrix gates a build (89a9c32)
• parallel — the split, the stop rule, and the env slot (7c00f35)
• junit — the report a CI reporter reads instead of a person (6e94213)
• auth-recording — a credential surface that never prints the credential (89ee9b0)
• auth — the refusals that happen before a secret leaves the machine (e5379f6)
• security — what the fuzz endpoint refuses before anything leaves (0836232)
• invoke — serialise the suite that swaps the protocol registry (edf66df)
• report — the rollup gate a nightly job depends on (2e51bda)
• diff — the exit code a PR check gates on (060e201)
• mock — the runtime stub CRUD against a mock that stopped (3198c1e)
• mcp — the two tools that answer from disk, and a diagnostic (e7d0656)
• what /api/invoke hands the plugin, and three corrections (314df18)
• five surfaces that had no tests between them (50e9d70)
• oast — what oast serve refuses, and what its banner promises (946773d)
• the allowlist an agent inherits, and the broker URLs we publish to (d6a30c0)
• pin what the code does, not what I assumed (13bf75a)
• concrete return types on private helpers (CA1859) (72bb4f9)
• plugins — assert on the rows the test created, not the whole listing (a8b66d2)
• plugins — return the concrete enumerator (CA1859) (b5bfb57)
• plugins — cover the listing the plugin browser renders (14f7b09)
• contract — cover the matrix a reviewer reads and the names it writes (27b1f55)
• mock — the mock list is an envelope, not a bare array (fe00d19)
• exempt the path validator from CA3003, not the rule (8a7b1ae)
• roadmap — sync from Project board (2e001f3)
• roadmap — sync from Project board (9904072)
• roadmap — sync from Project board (e794236)
• bench — cover the parsing that happens before a request goes out (97232b0)
• tools — cover the reverse-proxy endpoints' refusals (418fe8f)
• cli — cover the lint gate and its two output formats (3f2e81a)
• scanner — cover what happens after a code: template starts running (a2171f2)
• cover the catalogue override and the benchmark-schedule contributions (c447034)
• cover the standalone help page and the rollup wire shape (0bf81e6)
• roadmap — sync from Project board (8365391)
• roadmap — sync from Project board (5873c2a)
• roadmap — sync from Project board (de2759f)
• remove the duplicate Dependabot auto-merge workflow (976e51d)
• rename scan-self to scan-smoke — it does not scan Bowire (d2a8e3f)
• dogfood — run the PR-report action on every push, and pin it to a SHA (b582bdc)
• roadmap — sync from Project board (209dc3c)
• roadmap — sync from Project board (378cd6f)
• roadmap — sync from Project board (1688b12)
• roadmap — sync from Project board (377b16d)
• roadmap — sync from Project board (f137fdd)
• e2e — park the REST-template spec on #612, the defect it found (f72d88a)
• roadmap — sync from Project board (9211649)
• e2e — revive six of the eight rotted Phase 1-3 specs (bd0b7b8)
• roadmap — sync from Project board (e55f9b0)
• roadmap — sync from Project board (d007551)
• roadmap — sync from Project board (20d878a)
• roadmap — sync from Project board (26f4c5c)
• roadmap — sync from Project board (d9e2688)
• roadmap — sync from Project board (5bc6674)
• e2e — gate CI on the browser suite and pin the streaming-layout regression (31dc3e4)
• roadmap — sync from Project board (a9e25b8)
• roadmap — sync from Project board (1fd1903)
• roadmap — sync from Project board (7231099)
• roadmap — sync from Project board (6a6a437)
• roadmap — sync from Project board (3c2bf7e)
• test — stop MonitoringTelemetryTests racing the rest of the assembly (a590059)
• vscode — prove the download is really cancellable (#590) (4c4f4b2)
• vscode — prove the executable bit on Linux instead of assuming it (#590) (48dde2a)
• roadmap — sync from Project board (9ce600f)
• release — publish SHA-256 checksums with every release (2c70744)
• roadmap — sync from Project board (0c27fc2)
• roadmap — sync from Project board (71e74a3)
• roadmap — sync from Project board (a6319a5)
• roadmap — sync from Project board (e2d83a6)
• roadmap — sync from Project board (3fe1412)
• test — Testlauf auf Microsoft.Testing.Platform umstellen (#601) (0e31b01)
• roadmap — sync from Project board (d96a1e7)
• test — Laufwerkspfad-Fall ist windowsspezifisch — CI auf ubuntu hatte recht (4fe60b1)
• roadmap — sync from Project board (8a31395)
• deps — xUnit1069 vorwegnehmen + OpenApi-Sperre wirksam machen (cffecec)
• vscode — Smoke-Test lauffähig machen — und dabei eine falsche Zusage im README gefunden (c63fa7f)
• roadmap — sync from Project board (8e38d4e)
• roadmap — sync from Project board (c390f4c)
• roadmap — sync from Project board (d808588)
• report — pin the Rollup rail's rendering and its path-input contract (#587) (4fd30b6)
• roadmap — sync from Project board (81b4494)
• roadmap — sync from Project board (e2a44d3)
• roadmap — sync from Project board (c1274ee)
• publish — a failed artefact publish now files a tracking issue (b97ce6d)
• roadmap — sync from Project board (1d7312c)
• winget — sync the fork before submitting, so the job stops needing a human (#237) (0e34883)
• roadmap — sync from Project board (53217c5)
• roadmap — sync from Project board (8a0956d)
• roadmap — sync from Project board (e99eec6)
• pr-bot — self-test the action on push, not only on PRs (f3ff2f0)
• roadmap — sync from Project board (eabb38c)
• build — say which projects belong on nuget.org, next to the pack default (622ec9a)
• version — CI drift-guard fails the build if AssemblyVersion stops tracking the tag (37ad256)
• roadmap — sync from Project board (c8d2cd4)
• test — CS0182 in plugin-load-guard theory — build args in the body, not the attribute (c839f35)
• roadmap — sync from Project board (8d7d1a2)
• roadmap — sync from Project board (bb7e8f1)
• roadmap — sync from Project board (8a691ec)
• roadmap — sync from Project board (ab62c70)
• test — disambiguate TestResult in SecretRedactorTests (#361) (223abd0)
• test — secret redaction across CI outputs (#361) (140c0a1)
• roadmap — sync from Project board (b90cda6)
• roadmap — sync from Project board (d1a766d)
• roadmap — sync from Project board (30c4b9c)
• roadmap — sync from Project board (fa45c6b)
• ci — resolve sample project.json manifests by absolute path in samples-smoke (aeae8be)
• ci — bowire-pr composite action prototype + self-test (#183) (10a8bf8)
• roadmap — sync from Project board (d1c483e)
• roadmap — sync from Project board (058f0d2)
• roadmap — sync from Project board (3d74a89)
• roadmap — sync from Project board (c387ed1)
• roadmap — sync from Project board (6bbdcbd)
• roadmap — sync from Project board (4ec5b2b)
• roadmap — sync from Project board (6965123)
• roadmap — sync from Project board (5f31ed8)
• mcp — retry discovery in the wire tests to kill the empty-list flake (234cb7c)
• version — derive versions from git tags via MinVer (420f8c1)
• ci — Auto-Merge wartet auf den Pflicht-Check — Bowire-main ist protected (7fa8726)
• ci — Dependabot-PRs mergen sich selbst — Trunk-Workflow ohne PR-Zeremonie (a870538)
• roadmap — sync from Project board (6c0ca0d)
• roadmap — sync from Project board (eca4cb5)
• roadmap — sync from Project board (26f7b2a)
• test — use synchronous HttpClient.Send in the readiness probe (97b6c3d)
• test — make RawJsonRpcMcpServer wait until it actually serves (aa94031)
• roadmap — sync from Project board (a1bb587)
• roadmap — sync from the board (Area/Type/Release backfill) (6d5a71b)
• board+site — consolidate Area/Track, refresh hero copy (454f1c8)
• roadmap — sync from Project board (a9a2957)
• roadmap — sync from Project board (28d9eb4)
• test — correct stale harness comments after #367 migration (396d80f)
• test — serialise CoverageTo95Tests with the OpenAPI-registry collection (ff9a766)
• ci — normalise workflow display names (63da899)
• bump floor to 2.4.0-dev after v2.4.0 (48b8529)

Dependency updates

• chore(deps): Bump OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0 (6e04f6b)
• chore(deps): Bump OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0 (517938f)
• chore(deps): Bump OpenTelemetry and OpenTelemetry.Exporter.OpenTelemetryProtocol (277bbc0)
• chore(deps): Bump Testcontainers.Pulsar from 4.13.0 to 4.14.0 (9e50de8)
• chore(deps): Bump NuGet.Protocol from 7.6.0 to 7.9.0 (145ba51)
• chore(deps): Bump the xunit group with 1 update (f7ec595)
• chore(deps): Bump System.CommandLine from 2.0.10 to 2.0.11 (8371002)
• chore(deps): Bump Microsoft.SourceLink.GitHub from 10.0.301 to 10.0.400 (f56a84c)
• chore(deps): Bump Testcontainers and Testcontainers.Nats (bee2811)
• chore(deps): Bump ModelContextProtocol.AspNetCore from 2.1.0 to 2.2.0 (cc0c33b)
• chore(deps): Bump Google.Protobuf from 3.35.1 to 3.36.0 (f1dd72d)
• chore(deps): xunit.v3 4.x sperren bis zur MTP-Migration (#601) (d5fffb4)
• chore(deps): Bump DotPulsar from 5.3.1 to 5.3.2 (d86da70)
• chore(deps): Bump HotChocolate.AspNetCore and HotChocolate.Subscriptions.InMemory (6a29a49)
• chore(deps): Bump the aspnetcore group with 6 updates (37a230a)
• chore(deps): Bump ModelContextProtocol.AspNetCore from 2.0.0 to 2.1.0 (112acb9)
• chore(deps): Bump HotChocolate.AspNetCore and HotChocolate.Subscriptions.InMemory (4b97386)
• chore(deps): Bump the grpc group with 5 updates (8aa2eb3)
• chore(npm): bump @playwright/test from 1.62.0 to 1.62.1 (6e6f670)

Contributors: Thomas Stegemann

Full diff: v2.4.0...v2.5.0