Bump Microsoft.Extensions.Hosting and 8 others

[dependabot]

Pinned Microsoft.Extensions.Hosting at 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Hosting.WindowsServices at 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Hosting.WindowsServices's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Logging.Abstractions at 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Logging.Abstractions at 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.9.0

What's Changed

• Fix tilde/exclamation characters corrupted in TerminalLogger test output by @​nohwnd in [fix] Fix tilde/exclamation characters corrupted in TerminalLogger test output microsoft/vstest#16046
• Make TranslationLayer Native AOT-compatible by @​drewnoakes in Make TranslationLayer Native AOT-compatible microsoft/vstest#16045
• Guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order by @​nohwnd in [fix] fix: guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order microsoft/vstest#16072
• Add RequestingAssembly to AssemblyResolveEventArgs for binary compat by @​nohwnd in [fix] fix: add RequestingAssembly to AssemblyResolveEventArgs for binary compat microsoft/vstest#16076
• Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector by @​Evangelink in Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector microsoft/vstest#16082
• Fix TRX attachment paths when LogFileName contains a subdirectory by @​nohwnd in [fix] Fix TRX attachment paths when LogFileName contains a subdirectory microsoft/vstest#15791
• Fix missing dumps for .NET Framework child processes in NetClientHangDumper by @​nohwnd in [fix] Fix missing dumps for .NET Framework child processes in NetClientHangDumper microsoft/vstest#16098
• Fix data collection channels to use negotiated protocol version instead of V1 by @​nohwnd in [fix] Fix data collection channels to use negotiated protocol version instead of V1 microsoft/vstest#16096
• Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet by @​nohwnd in [fix] Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet microsoft/vstest#16065
• Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files by @​nohwnd in [fix] Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files microsoft/vstest#16101
• Include testhost process path in crash error messages by @​nohwnd in [fix] Include testhost process path in crash error messages microsoft/vstest#16108
• Fix DataDriven test results being double-counted in TRX logger totals by @​nohwnd in [fix] Fix DataDriven test results being double-counted in TRX logger totals microsoft/vstest#15766
• Fix datacollector crash visibility: replace Assert with throwable exceptions by @​nohwnd in [fix] Fix datacollector crash visibility: replace Assert with throwable exceptions microsoft/vstest#16048
• Add TreatErrorMessagesAsWarnings parameter to TRX logger by @​nohwnd in [fix] Add TreatErrorMessagesAsWarnings parameter to TRX logger microsoft/vstest#16106
• Wait for testhost stderr to drain before reading its crash output by @​nohwnd in Wait for testhost stderr to drain before reading its crash output microsoft/vstest#16128
• Handle runtimeconfig.dev.json without additionalProbingPaths by @​tmat in Handle runtimeconfig.dev.json without additionalProbingPaths microsoft/vstest#16166
• Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost by @​nohwnd in Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost microsoft/vstest#16169
• Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#​16151) by @​azat-msft in Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#16151) microsoft/vstest#16156
• Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests by @​nohwnd in [fix] Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests microsoft/vstest#16167

New Contributors

• @​drewnoakes made their first contribution in Make TranslationLayer Native AOT-compatible microsoft/vstest#16045

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in compare view.

Pinned ModelContextProtocol at 2.2.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

• Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #​1796 by @​saicharanpardhu (co-authored by @​Copilot @​jeffhandley)
• Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #​1805 by @​latent-9

Test Improvements

• Fix duplicated word in test comment #​1809 by @​latent-9

Repository Infrastructure Updates

• Enable package validation for the MCP extension packages #​1793 by @​jeffhandley (co-authored by @​Copilot)
• Add a release-manager agent that orchestrates the release skills #​1794 by @​jeffhandley (co-authored by @​Copilot)
• Bump Anthropic from 12.39.0 to 12.40.0 #​1808
• Bump @​hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #​1812
• Fix dead relative link to versioning docs in bump-version skill #​1807 by @​latent-9

Acknowledgements

• @​latent-9 made their first contribution in #​1807
• @​saicharanpardhu made their first contribution in #​1796
• @​saicharanpardhu submitted issue #​1777 (resolved by #​1796)
• @​jeffhandley @​tarekgh @​halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

Commits viewable in compare view.

Pinned ModelContextProtocol.AspNetCore at 2.2.0.

Release notes

Sourced from ModelContextProtocol.AspNetCore's releases.

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

• Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #​1796 by @​saicharanpardhu (co-authored by @​Copilot @​jeffhandley)
• Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #​1805 by @​latent-9

Test Improvements

• Fix duplicated word in test comment #​1809 by @​latent-9

Repository Infrastructure Updates

• Enable package validation for the MCP extension packages #​1793 by @​jeffhandley (co-authored by @​Copilot)
• Add a release-manager agent that orchestrates the release skills #​1794 by @​jeffhandley (co-authored by @​Copilot)
• Bump Anthropic from 12.39.0 to 12.40.0 #​1808
• Bump @​hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #​1812
• Fix dead relative link to versioning docs in bump-version skill #​1807 by @​latent-9

Acknowledgements

• @​latent-9 made their first contribution in #​1807
• @​saicharanpardhu made their first contribution in #​1796
• @​saicharanpardhu submitted issue #​1777 (resolved by #​1796)
• @​jeffhandley @​tarekgh @​halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

Commits viewable in compare view.

Pinned System.Security.Cryptography.ProtectedData at 10.0.11.

Release notes

Sourced from System.Security.Cryptography.ProtectedData's releases.

10.0.0-preview.6.25358.103

You can build .NET 10.0 Preview 6 from the repository by cloning the release tag v10.0.0-preview.6.25358.103 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.0-preview.5.25277.114

You can build .NET 10.0 Preview 5 from the repository by cloning the release tag v10.0.0-preview.5.25277.114 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.0-preview.4.25258.110

You can build .NET 10.0 Preview 4 from the repository by cloning the release tag v10.0.0-preview.4.25258.110 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.0-preview.3.25171.5

You can build .NET 10.0 Preview 3 from the repository by cloning the release tag v10.0.0-preview.3.25171.5 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.0-preview.2.25163.2

You can build .NET 10.0 Preview 2 from the repository by cloning the release tag v10.0.0-preview.2.25163.2 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.0-preview.1.25080.5

You can build .NET 10.0 Preview 1 from the repository by cloning the release tag v10.0.0-preview.1.25080.5 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.120

You can build .NET 9.0 from the repository by cloning the release tag v9.0.120 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached is a PGP signature for the GitHub generated tarball. You can find the public key at https://dot.net/release-key-2023

9.0.119

You can build .NET 9.0 from the repository by cloning the release tag v9.0.119 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.118

You can build .NET 9.0 from the repository by cloning the release tag v9.0.118 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached is a PGP signature for the GitHub generated tarball. You can find the public key at https://dot.net/release-key-2023

9.0.117

You can build .NET 9.0 from the repository by cloning the release tag v9.0.117 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.116

You can build .NET 9.0 from the repository by cloning the release tag v9.0.116 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.115

You can build .NET 9.0 from the repository by cloning the release tag v9.0.115 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.114

You can build .NET 9.0 from the repository by cloning the release tag v9.0.114 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached is the PGP signature for the GitHub generated tarball. You can find the public key at https://dot.net/release-key-2023

9.0.113

You can build .NET 9.0 from the repository by cloning the release tag v9.0.113 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.112

You can build .NET 9.0 from the repository by cloning the release tag v9.0.112 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.111

You can build .NET 9.0 from the repository by cloning the release tag v9.0.111 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.110

You can build .NET 9.0 from the repository by cloning the release tag v9.0.110 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.109

You can build .NET 9.0 from the repository by cloning the release tag v9.0.109 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

9.0.101

You can build .NET 9.0 from the repository by cloning the release tag v9.0.101 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated System.Security.Cryptography.ProtectedData from 10.0.10 to 10.0.11.

Release notes

Sourced from System.Security.Cryptography.ProtectedData's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.5 to 4.0.0.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.0

Release notes: https://xunit.net/releases/visualstudio/4.0.0

4.0.0-pre.5

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.5

4.0.0-pre.4

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.4

4.0.0-pre.3

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.3

Commits viewable in compare view.

Updated xunit.v3 from 3.2.2 to 4.0.0.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

[erikdarlingdata]

Dependabot group bump: 9 NuGet packages, base is dev ✓. Lock files (~10k lines) look mechanically regenerated. Non-lock changes are Directory.Packages.props and two .csproj files — the .csproj edits are where the interesting things are.

What's good

• Base branch is dev, not main.
• Central package management is respected in Directory.Packages.props — one line per bump.
• No PlanAnalyzer.cs / schema / install-script / build.yml touches, so the CRITICAL focus items don't apply.

Needs attention (inline comments left on each)

1. Darling.Analysis.csproj:20 — a new <PackageReference Include="ModelContextProtocol" /> was added; dependabot doesn't normally introduce new package references. Common.csproj already declares it and flows transitively. Please explain why this is needed or drop it.
2. Darling.Analysis.csproj:21 and PlanAnalysis.csproj:25 — new VersionOverride="10.0.11" entries for System.Security.Cryptography.ProtectedData that match the central pin. Directory.Packages.props explicitly reserves VersionOverride for divergence (only tools/CompactionRepro). These are redundant and re-introduce the misalignment class #2100 was meant to prevent.
3. Directory.Packages.props:15 — Microsoft.Extensions.Logging stays at 10.0.10 while its Hosting / Hosting.WindowsServices / Logging.Abstractions siblings all move to 10.0.11. Same-cadence packages; worth aligning manually so the runtime graph doesn't rely on transitive unification.

Other things worth noting

• Major version bump for xunit (v3 3.2.2 → 4.0.0; runner 3.1.5 → 4.0.0). Verify the full test suite actually runs — xunit v3→v4 breaking changes tend to hit runners, discovery, and any custom fixture code.
• Line-ending noise on the .csproj/props diffs: +43/-41, +37/-36, +34/-34 for what should be a handful of substantive changes each. .gitattributes says * text=auto eol=crlf, so dependabot likely wrote LF into files that were CRLF at rest. Nothing broken, but it pollutes git blame for those files. Consider normalizing before merge (or a .gitattributes re-normalization pass in a separate commit).

Comments only — no approval / request changes / merge, per the review policy for this repo.

---

Generated by Claude Code

[erikdarlingdata]

Microsoft.Extensions.Logging is still 10.0.10 while its siblings Microsoft.Extensions.Hosting (line 12), Microsoft.Extensions.Hosting.WindowsServices (line 13), and Microsoft.Extensions.Logging.Abstractions (line 15 → 10.0.11) all moved to 10.0.11. These ship on the same Microsoft.Extensions.* cadence — worth manually bumping so the runtime graph resolves to one aligned patch level instead of NuGet unifying transitively. Microsoft.Extensions.Configuration / Microsoft.Extensions.Configuration.Json at 10.0.10 are the same story if 10.0.11 exists for them.

---

Generated by Claude Code

[erikdarlingdata]

New <PackageReference Include="ModelContextProtocol" /> here — this project didn't reference MCP before this PR, and a dependabot version bump shouldn't be adding new package references. PerformanceMonitor.Common (line 20 of Common.csproj) already declares it, and Darling.Analysis references Analysis/Collectors which flow through Common, so it should already be available transitively.

If dependabot added this to satisfy a resolution warning, that's a symptom worth chasing (probably a NU1605/NU1608 downgrade) rather than a fix to keep. If it's intentional because Darling.Analysis directly consumes an MCP surface, the comment block just above (which explains what Sql/Npgsql/Logging come from) should say why. Either way I'd drop this line and re-run restore to confirm nothing complains.

---

Generated by Claude Code

[erikdarlingdata]

VersionOverride="10.0.11" here matches the central pin in Directory.Packages.props line 22 (also 10.0.11), so it doesn't diverge — it just duplicates it. The comment at the top of Directory.Packages.props explicitly reserves VersionOverride for divergence ("A project that must diverge pins with VersionOverride at its own reference (only tools/CompactionRepro does…)"). Adding a non-diverging override contradicts that pattern and creates the same misalignment risk #2100 was written to prevent — next time the central version bumps, this line silently pins the old one.

Drop the VersionOverride attribute (or drop the whole line if the reference isn't needed directly; the package flows in transitively through SqlClient / Logging). Same on PlanAnalysis.csproj line 25.

---

Generated by Claude Code

[erikdarlingdata]

Same issue as Darling.Analysis.csproj:21 — the VersionOverride="10.0.11" matches the central pin so it's not diverging, and central package management is supposed to be the single source. Also worth noting the comment on line 21 above still says "Version matches Lite/Dashboard/the Darling service (7.0.1)" but the central pin is Microsoft.Data.SqlClient 7.0.2 — a pre-existing stale comment, not this PR's fault, but this is the moment to fix it since you're editing the file.

---

Generated by Claude Code