Cherry-pick dependency updates from main to dev#1734
Merged
Conversation
* Bump the nuget-deps group with 14 updates Bumps diskann-garnet from 1.0.23 to 1.0.25 Bumps Microsoft.CodeAnalysis from 5.0.0 to 5.3.0 Bumps Microsoft.Extensions.Configuration.Binder from 10.0.3 to 10.0.5 Bumps Microsoft.Extensions.Configuration.Json from 10.0.3 to 10.0.5 Bumps Microsoft.Extensions.Logging from 10.0.3 to 10.0.5 Bumps Microsoft.Extensions.Logging.Configuration from 10.0.3 to 10.0.5 Bumps Microsoft.Extensions.Logging.Console from 10.0.3 to 10.0.5 Bumps Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.16.0 to 8.17.0 Bumps Microsoft.IdentityModel.Validators from 8.16.0 to 8.17.0 Bumps NUnit from 4.5.0 to 4.5.1 Bumps NUnit3TestAdapter from 6.1.0 to 6.2.0 Bumps StackExchange.Redis from 2.11.8 to 2.12.8 Bumps System.IdentityModel.Tokens.Jwt from 8.16.0 to 8.17.0 Bumps System.Numerics.Tensors from 10.0.3 to 10.0.5 --- updated-dependencies: - dependency-name: diskann-garnet dependency-version: 1.0.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.CodeAnalysis dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Logging.Configuration dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.IdentityModel.Protocols.OpenIdConnect dependency-version: 8.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: System.IdentityModel.Tokens.Jwt dependency-version: 8.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Microsoft.IdentityModel.Validators dependency-version: 8.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: NUnit dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: NUnit3TestAdapter dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: StackExchange.Redis dependency-version: 2.12.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: System.Numerics.Tensors dependency-version: 10.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps ... Signed-off-by: dependabot[bot] <support@github.com> * Update other required dependencies Signed-off-by: Tiago Napoli <tiagonapoli@microsoft.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Tiago Napoli <tiagonapoli@microsoft.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tiago Napoli <tiagonapoli@microsoft.com>
Cherry-pick of dependabot security update from main. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Cherry-picks dependency/security updates from main into dev, aligning both the .NET centralized package versions and the website’s Yarn lockfile with the latest patched versions.
Changes:
- Updated multiple centrally-managed NuGet package versions in
Directory.Packages.props. - Bumped
follow-redirectsto1.16.0inwebsite/yarn.lock.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Directory.Packages.props | Updates centrally pinned NuGet package versions (NUnit, Microsoft.Extensions.*, IdentityModel, StackExchange.Redis, etc.). |
| website/yarn.lock | Updates the locked follow-redirects version to 1.16.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Bump dompurify resolution 3.3.3 → 3.4.0 to fix: - CVE-2026-41239: SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode - CVE-2026-41240: FORBID_TAGS bypassed by function-based ADD_TAGS - CVE-2026-41238: Prototype Pollution to XSS Bypass - GHSA: ADD_TAGS function form bypasses FORBID_TAGS Add uuid resolution → 14.0.0 to fix: - GHSA: Missing buffer bounds check in v3/v5/v6 when buf is provided uuid 14.0.0 is ESM-only but Node.js 22+ (required by engines) supports require() of ESM modules, so CJS consumers like sockjs work correctly. Verified: yarn build succeeds and docusaurus start launches cleanly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-picks dependabot/security dependency updates from main that were missing on dev.
Included updates
Already on dev (skipped)