Bump DependencyInjection.Lifetime.Analyzers and 3 others

[dependabot]

Updated DependencyInjection.Lifetime.Analyzers from 2.11.42 to 2.18.0.

Release notes

Sourced from DependencyInjection.Lifetime.Analyzers's releases.

2.18.0

DependencyInjection.Lifetime.Analyzers 2.18.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI027: Rx subscription-leak rule (Warning) — the Rx twin of DI025. IObservable<T>.Subscribe(...) returns an IDisposable subscription token instead of needing a -=, so the event-leak proof inverts: where DI025 proves a missing unsubscription, DI027 proves the returned token is discarded. A transient- or scoped-registered service that subscribes an instance-capturing handler (method group, this-capturing lambda, or stored delegate) to an observable exposed by a longer-lived publisher — an injected singleton dependency, or a scoped publisher shared by a transient subscriber — and throws the token away roots every subscriber instance the container creates in the publisher, leaking memory on each resolution and firing stale observers against released state, the same accumulation DI025 catches for events. v1 stays conservative and detects only the highest-confidence discard shapes: an ignored expression statement (obs.Subscribe(H);), a discard assignment (_ = obs.Subscribe(H)), and a local initialized with the token that is never referenced again in the method and is not a using declaration (a real disposal, return, or escape always references the local, so an unreferenced non-using local is provably dropped). The subscribe call is matched FQN-light — any method named Subscribe returning System.IDisposable on a System.IObservable<T> receiver — so System.Reactive, community Rx, and hand-rolled extensions all bind. Reuses DI025's proven infrastructure: EventReceiverClassification (injected-member proven-ctor-assigned, constructor-parameter, and stable chained-projection proofs such as _source.Ticks, via a new ClassifyReceiverExpression entry point that runs DI025's non-static receiver path without the event coupling — DI025's own behavior is byte-for-byte unchanged) and EventHandlerClassification (instance-capture proof), plus DI025's publisher-rank resolution (most conservative registration wins, closed registrations preferred over open-generic fallbacks, keyed-only registrations excluded). Single Warning tier for now — a scoped publisher above a transient subscriber reports Warning rather than an Info tier (scoped-publisher tiering is noted as future work). Documented false negatives, deferred to later passes: tokens stored in a field (dispose-path analysis), using/using var subscriptions, tokens later disposed/returned/passed as arguments, CompositeDisposable/DisposeWith/AddTo/SerialDisposable patterns, the BCL Subscribe(IObserver<T>) overload, and the static ObservableExtensions.Subscribe(source, handler) call form. No code fix this pass — the safe repair is registered-lifetime-dependent like DI025's tier-3 assist and is deferred.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.18.0

What changed

Added

• DI027: Rx subscription-leak rule (Warning) — the Rx twin of DI025. IObservable<T>.Subscribe(...) returns an IDisposable subscription token instead of needing a -=, so the event-leak proof inverts: where DI025 proves a missing unsubscription, DI027 proves the returned token is discarded. A transient- or scoped-registered service that subscribes an instance-capturing handler (method group, this-capturing lambda, or stored delegate) to an observable exposed by a longer-lived publisher — an injected singleton dependency, or a scoped publisher shared by a transient subscriber — and throws the token away roots every subscriber instance the container creates in the publisher, leaking memory on each resolution and firing stale observers against released state, the same accumulation DI025 catches for events. v1 stays conservative and detects only the highest-confidence discard shapes: an ignored expression statement (obs.Subscribe(H);), a discard assignment (_ = obs.Subscribe(H)), and a local initialized with the token that is never referenced again in the method and is not a using declaration (a real disposal, return, or escape always references the local, so an unreferenced non-using local is provably dropped). The subscribe call is matched FQN-light — any method named Subscribe returning System.IDisposable on a System.IObservable<T> receiver — so System.Reactive, community Rx, and hand-rolled extensions all bind. Reuses DI025's proven infrastructure: EventReceiverClassification (injected-member proven-ctor-assigned, constructor-parameter, and stable chained-projection proofs such as _source.Ticks, via a new ClassifyReceiverExpression entry point that runs DI025's non-static receiver path without the event coupling — DI025's own behavior is byte-for-byte unchanged) and EventHandlerClassification (instance-capture proof), plus DI025's publisher-rank resolution (most conservative registration wins, closed registrations preferred over open-generic fallbacks, keyed-only registrations excluded). Single Warning tier for now — a scoped publisher above a transient subscriber reports Warning rather than an Info tier (scoped-publisher tiering is noted as future work). Documented false negatives, deferred to later passes: tokens stored in a field (dispose-path analysis), using/using var subscriptions, tokens later disposed/returned/passed as arguments, CompositeDisposable/DisposeWith/AddTo/SerialDisposable patterns, the BCL Subscribe(IObserver<T>) overload, and the static ObservableExtensions.Subscribe(source, handler) call form. No code fix this pass — the safe repair is registered-lifetime-dependent like DI025's tier-3 assist and is deferred.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.17.0

DependencyInjection.Lifetime.Analyzers 2.17.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025/DI026 code fix now creates the disposal path, not just fills it — the fixer previously only inserted the mirrored -= into a Dispose method that already existed; it refused whenever the type had no dispose-shaped method. Two new tiers extend it, both still gated on a method-group handler whose receiver resolves inside Dispose. Tier 2 (inherited contract): when disposability comes from a base type that follows the standard virtual Dispose(bool) pattern, the fix adds a protected override void Dispose(bool disposing) that unsubscribes and chains to base.Dispose(disposing) — overriding the pattern is what guarantees the unsubscribe actually runs, through the base's Dispose() → Dispose(true) dispatch. Inherited shapes with no such hook (a non-virtual or explicitly-implemented base Dispose) are refused, because a method the container never calls would be a fake repair. Tier 3 (implement the interface): a subscriber registered scoped that implements neither disposal interface gets IDisposable added to its base list plus a public void Dispose() that unsubscribes; the owning scope disposes it deterministically, so no leak is introduced. To make tier 3 possible without re-running registration collection, the analyzer now stamps the subscriber's registered lifetime into the diagnostic's Properties bag (SubscriberLifetime = Transient/Scoped) — a purely additive change; all diagnostic messages are unchanged. Introducing IDisposable on a transient subscriber is deliberately refused: a disposable transient is exactly the DI008 disposable-transient-capture shape, so the fix must never trade a DI025 for a DI008. DI026 only ever fires for transient subscribers, so its code fix offers tiers 1 and 2 but never tier 3. Lambda hoisting stays refused because it changes capture semantics. Two fixer-output edges were hardened after Codex review: tier 2 now accepts only the NEAREST inherited Dispose(bool) when it is a non-abstract, non-sealed, protected virtual/override hook — a public/protected internal hook (accessibility mismatch, CS0507), an abstract hook (uncallable base.Dispose(disposing)), and a sealed override on an intermediate base are all refused; tier 3 emits a fully-qualified global::System.IDisposable base entry with Simplifier.Annotation so it binds correctly even without using System or against a namespace-local IDisposable, reducing to the shortest unambiguous form. A second Codex-review round hardened three more edges: the added Dispose(bool) override now guards its unsubscribe with if (disposing) so managed state is not touched on the finalizer path; tier 2 additionally verifies the base's parameterless Dispose() actually dispatches to the bool hook in source (a non-dispatching or metadata-only Dispose() is refused, since the override would never run); and the analyzer stamps SubscriberLifetime = Scoped only when the subscriber has a scoped registration and NO transient one, so a subscriber registered both transient and scoped stamps Transient and tier 3 refuses it (its live transient registration is the DI008 risk). A third Codex-review round tightened that dispatch check further: the base's Dispose() must call its OWN hook — a bare Dispose(true) or this.Dispose(true) in its executable body, not inside a nested lambda or local function — so a call that disposes another object (_inner.Dispose(true), base.Dispose(true)), passes false, or never actually runs no longer counts as dispatch and is refused. Finally, the batch fix-all provider is replaced by a custom sequential DocumentBasedFixAllProvider: batch-merging independent edits ran a synthesizing tier once per diagnostic and emitted a duplicate dispose member (or lost unsubscribes) when one type carried several leaks, so the fix-all now tags every subscription up front and re-evaluates each against the evolving document, merging the second leak onward into the member the first one created — one Dispose/override holding every -= (all under the if (disposing) guard for the override tier). A final round closed two more tier-2 fake-repair edges: the override is offered only when the subscriber actually implements System.IDisposable (a base with the dispose shape but no IDisposable contract is never disposed by the container), and the base Dispose() dispatch is now bound with the semantic model and required to resolve to the very hook being overridden — a Dispose(true) that binds to a different Dispose(bool) (for example a grandparent's private hook the container's dispose path actually reaches) no longer counts.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.17.0

What changed

Added

• DI025/DI026 code fix now creates the disposal path, not just fills it — the fixer previously only inserted the mirrored -= into a Dispose method that already existed; it refused whenever the type had no dispose-shaped method. Two new tiers extend it, both still gated on a method-group handler whose receiver resolves inside Dispose. Tier 2 (inherited contract): when disposability comes from a base type that follows the standard virtual Dispose(bool) pattern, the fix adds a protected override void Dispose(bool disposing) that unsubscribes and chains to base.Dispose(disposing) — overriding the pattern is what guarantees the unsubscribe actually runs, through the base's Dispose() → Dispose(true) dispatch. Inherited shapes with no such hook (a non-virtual or explicitly-implemented base Dispose) are refused, because a method the container never calls would be a fake repair. Tier 3 (implement the interface): a subscriber registered scoped that implements neither disposal interface gets IDisposable added to its base list plus a public void Dispose() that unsubscribes; the owning scope disposes it deterministically, so no leak is introduced. To make tier 3 possible without re-running registration collection, the analyzer now stamps the subscriber's registered lifetime into the diagnostic's Properties bag (SubscriberLifetime = Transient/Scoped) — a purely additive change; all diagnostic messages are unchanged. Introducing IDisposable on a transient subscriber is deliberately refused: a disposable transient is exactly the DI008 disposable-transient-capture shape, so the fix must never trade a DI025 for a DI008. DI026 only ever fires for transient subscribers, so its code fix offers tiers 1 and 2 but never tier 3. Lambda hoisting stays refused because it changes capture semantics. Two fixer-output edges were hardened after Codex review: tier 2 now accepts only the NEAREST inherited Dispose(bool) when it is a non-abstract, non-sealed, protected virtual/override hook — a public/protected internal hook (accessibility mismatch, CS0507), an abstract hook (uncallable base.Dispose(disposing)), and a sealed override on an intermediate base are all refused; tier 3 emits a fully-qualified global::System.IDisposable base entry with Simplifier.Annotation so it binds correctly even without using System or against a namespace-local IDisposable, reducing to the shortest unambiguous form. A second Codex-review round hardened three more edges: the added Dispose(bool) override now guards its unsubscribe with if (disposing) so managed state is not touched on the finalizer path; tier 2 additionally verifies the base's parameterless Dispose() actually dispatches to the bool hook in source (a non-dispatching or metadata-only Dispose() is refused, since the override would never run); and the analyzer stamps SubscriberLifetime = Scoped only when the subscriber has a scoped registration and NO transient one, so a subscriber registered both transient and scoped stamps Transient and tier 3 refuses it (its live transient registration is the DI008 risk). A third Codex-review round tightened that dispatch check further: the base's Dispose() must call its OWN hook — a bare Dispose(true) or this.Dispose(true) in its executable body, not inside a nested lambda or local function — so a call that disposes another object (_inner.Dispose(true), base.Dispose(true)), passes false, or never actually runs no longer counts as dispatch and is refused. Finally, the batch fix-all provider is replaced by a custom sequential DocumentBasedFixAllProvider: batch-merging independent edits ran a synthesizing tier once per diagnostic and emitted a duplicate dispose member (or lost unsubscribes) when one type carried several leaks, so the fix-all now tags every subscription up front and re-evaluates each against the evolving document, merging the second leak onward into the member the first one created — one Dispose/override holding every -= (all under the if (disposing) guard for the override tier). A final round closed two more tier-2 fake-repair edges: the override is offered only when the subscriber actually implements System.IDisposable (a base with the dispose shape but no IDisposable contract is never disposed by the container), and the base Dispose() dispatch is now bound with the semantic model and required to resolve to the very hook being overridden — a Dispose(true) that binds to a different Dispose(bool) (for example a grandparent's private hook the container's dispose path actually reaches) no longer counts.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.16.0

DependencyInjection.Lifetime.Analyzers 2.16.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025/DI026 delegate-field subscriptions — closes a false negative the docs previously half-attributed to events. C# forbids assigning another type's field-like event, so the cross-type delegate leak actually lives on a public delegate-typed field or property of the publisher: _bus.Handlers += OnMessage and the equivalent self-assignment _bus.Handlers = (EventHandler)Delegate.Combine(_bus.Handlers, OnMessage) now report identically to an event += (singleton publisher → DI025 Warning, scoped publisher → DI026 Info), with a mirrored Delegate.Remove self-assignment recognized as the matching unsubscription. Only the trivially-provable self-assignment form is reported — the first Delegate.Combine argument must be the same member the result is assigned back to, reached through the same receiver — so indirect shapes (result stored in a local or a different member) stay silent. This required generalizing the subscription record's member from IEventSymbol to ISymbol and teaching the handler classifier to resolve the single unambiguous method-group candidate that a bare Delegate.Combine argument leaves with a null symbol (no single target delegate type). It matters because event-style delegate accumulation on a long-lived publisher roots every subscriber the container creates, exactly like an event +=, and was invisible before.
• DI025 guardrail pins — five behaviors are now regression-pinned: a weak-event helper method call (WeakEventManager.AddHandler(...)) stays silent (not a +=/Combine), a static-event -= in Dispose suppresses, a scoped subscriber on a static (process-lifetime) event reports DI025 at Warning and never the DI026 Info tier, a branch-conditional -= (if (_attached) { _bus.E -= H; }) suppresses unconditionally, and a self-unsubscribing handler (_bus.E -= OnMessage inside the handler body) stays silent. The branch-conditional suppression is a deliberate, documented false negative that favours FP-safety over proving the guard always runs.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.16.0

What changed

Added

• DI025/DI026 delegate-field subscriptions — closes a false negative the docs previously half-attributed to events. C# forbids assigning another type's field-like event, so the cross-type delegate leak actually lives on a public delegate-typed field or property of the publisher: _bus.Handlers += OnMessage and the equivalent self-assignment _bus.Handlers = (EventHandler)Delegate.Combine(_bus.Handlers, OnMessage) now report identically to an event += (singleton publisher → DI025 Warning, scoped publisher → DI026 Info), with a mirrored Delegate.Remove self-assignment recognized as the matching unsubscription. Only the trivially-provable self-assignment form is reported — the first Delegate.Combine argument must be the same member the result is assigned back to, reached through the same receiver — so indirect shapes (result stored in a local or a different member) stay silent. This required generalizing the subscription record's member from IEventSymbol to ISymbol and teaching the handler classifier to resolve the single unambiguous method-group candidate that a bare Delegate.Combine argument leaves with a null symbol (no single target delegate type). It matters because event-style delegate accumulation on a long-lived publisher roots every subscriber the container creates, exactly like an event +=, and was invisible before.

Changed

• DI025 guardrail pins — five behaviors are now regression-pinned: a weak-event helper method call (WeakEventManager.AddHandler(...)) stays silent (not a +=/Combine), a static-event -= in Dispose suppresses, a scoped subscriber on a static (process-lifetime) event reports DI025 at Warning and never the DI026 Info tier, a branch-conditional -= (if (_attached) { _bus.E -= H; }) suppresses unconditionally, and a self-unsubscribing handler (_bus.E -= OnMessage inside the handler body) stays silent. The branch-conditional suppression is a deliberate, documented false negative that favours FP-safety over proving the guard always runs.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.15.0

DependencyInjection.Lifetime.Analyzers 2.15.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025/DI026 internals: receiver/handler classification extracted into shared infrastructure — no behavior change (the full 1964-test suite is byte-identical). The analyzer had grown to 2.6x the 500-line structural budget with ReportLeakedSubscriptions at cyclomatic complexity 28; receiver classification (chain walking, stable-projection proofs, canonicalization, injection provenance) now lives in Infrastructure/EventReceiverClassification.cs and handler classification (capture analysis, identity matching) in Infrastructure/EventHandlerClassification.cs, with the reporting pass decomposed into single-purpose gates. The extraction also positions the planned Rx subscription-leak rule (DI027) to reuse receiver classification instead of duplicating it.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.15.0

What changed

Changed

• DI025/DI026 internals: receiver/handler classification extracted into shared infrastructure — no behavior change (the full 1964-test suite is byte-identical). The analyzer had grown to 2.6x the 500-line structural budget with ReportLeakedSubscriptions at cyclomatic complexity 28; receiver classification (chain walking, stable-projection proofs, canonicalization, injection provenance) now lives in Infrastructure/EventReceiverClassification.cs and handler classification (capture analysis, identity matching) in Infrastructure/EventHandlerClassification.cs, with the reporting pass decomposed into single-purpose gates. The extraction also positions the planned Rx subscription-leak rule (DI027) to reuse receiver classification instead of duplicating it.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.14.0

DependencyInjection.Lifetime.Analyzers 2.14.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025/DI026 chained receivers — closes the rules' top documented false negative. _host.Bus.Changed += OnChanged now reports when the publisher is a stable projection of an injected chain root: the lifetime proof anchors on the chain root's registration (singleton root → DI025 Warning, scoped root → DI026 Info), and every intermediate segment must provably return the same instance for the root's whole lifetime — a readonly field, a get-only auto-property, or a getter returning one, with interface segments proven through the root's registered implementation types. Settable, computed, metadata-only, and virtual segments keep the chain silent (a _factory.Bus computed getter handing out a fresh bus per access must not warn), as do factory registrations with no visible implementation type and chain roots that are not provably injected. Unsubscription matching is path-aware: a -= through the same chain suppresses (constructor-parameter roots unify with the field they are stored into), while a -= through a different root still reports.
• DI025/DI026 code fix for chained receivers: the mirrored--= Dispose insertion now covers field/property-rooted chains — the cloned chain re-resolves verbatim inside Dispose. Constructor-parameter-rooted chains are refused (the cloned statement would not compile), matching the existing direct-receiver gate.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.14.0

What changed

Added

• DI025/DI026 chained receivers — closes the rules' top documented false negative. _host.Bus.Changed += OnChanged now reports when the publisher is a stable projection of an injected chain root: the lifetime proof anchors on the chain root's registration (singleton root → DI025 Warning, scoped root → DI026 Info), and every intermediate segment must provably return the same instance for the root's whole lifetime — a readonly field, a get-only auto-property, or a getter returning one, with interface segments proven through the root's registered implementation types. Settable, computed, metadata-only, and virtual segments keep the chain silent (a _factory.Bus computed getter handing out a fresh bus per access must not warn), as do factory registrations with no visible implementation type and chain roots that are not provably injected. Unsubscription matching is path-aware: a -= through the same chain suppresses (constructor-parameter roots unify with the field they are stored into), while a -= through a different root still reports.
• DI025/DI026 code fix for chained receivers: the mirrored--= Dispose insertion now covers field/property-rooted chains — the cloned chain re-resolves verbatim inside Dispose. Constructor-parameter-rooted chains are refused (the cloned statement would not compile), matching the existing direct-receiver gate.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.13.0

DependencyInjection.Lifetime.Analyzers 2.13.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI026 (new rule): event subscription on scoped publisher without unsubscribe — the scope-bounded Info tier of DI025, sharing its analyzer (the DI021/DI022 precedent). A transient service that subscribes an instance-capturing handler to an event on a scoped registered publisher, with no matching -= anywhere in the type, now reports at Info: every transient the scope resolves stays rooted in the publisher's delegate list until the scope is disposed, and the event keeps invoking handlers on released instances — mostly benign in per-request scopes, a real accumulation in long-lived ones (SignalR connections, Blazor circuits, hosted-service loop scopes). Raise per team policy with dotnet_diagnostic.DI026.severity = warning. All DI025 receiver/handler/unsubscription proofs, guardrails, and the three message arms carry over unchanged; scoped subscribers on scoped publishers stay silent (equal lifetimes are torn down together). Three previously-silent cells now report DI026: the plain scoped-publisher/transient-subscriber pairing, open-generic scoped publishers injected as constructed closures, and — because the most conservative registration wins — publishers registered both scoped and singleton, including a closed scoped registration overriding an open-generic singleton.
• DI026 code fix: the DI025 mirrored--= Dispose insertion now also fixes DI026 diagnostics, with the same method-group, disposal-contract, and receiver-availability gates.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.13.0

What changed

Added

• DI026 (new rule): event subscription on scoped publisher without unsubscribe — the scope-bounded Info tier of DI025, sharing its analyzer (the DI021/DI022 precedent). A transient service that subscribes an instance-capturing handler to an event on a scoped registered publisher, with no matching -= anywhere in the type, now reports at Info: every transient the scope resolves stays rooted in the publisher's delegate list until the scope is disposed, and the event keeps invoking handlers on released instances — mostly benign in per-request scopes, a real accumulation in long-lived ones (SignalR connections, Blazor circuits, hosted-service loop scopes). Raise per team policy with dotnet_diagnostic.DI026.severity = warning. All DI025 receiver/handler/unsubscription proofs, guardrails, and the three message arms carry over unchanged; scoped subscribers on scoped publishers stay silent (equal lifetimes are torn down together). Three previously-silent cells now report DI026: the plain scoped-publisher/transient-subscriber pairing, open-generic scoped publishers injected as constructed closures, and — because the most conservative registration wins — publishers registered both scoped and singleton, including a closed scoped registration overriding an open-generic singleton.
• DI026 code fix: the DI025 mirrored--= Dispose insertion now also fixes DI026 diagnostics, with the same method-group, disposal-contract, and receiver-availability gates.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.12.0

DependencyInjection.Lifetime.Analyzers 2.12.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI025 (new rule): event subscription on longer-lived publisher without unsubscribe — a transient/scoped service that subscribes an instance-capturing handler to an event on an injected singleton dependency or a static event, with no matching -= anywhere in the type, now reports. The publisher's delegate list roots every subscriber instance the container ever creates — the classic .NET event-handler memory leak, caught lifetime-aware. Handler identity is symbol-based, so the no-op unsubscribe bug (-= with a distinct but textually identical lambda) still reports and points at the ineffective -=; override chains are normalized so a base-class -= pairs with a derived-class +=. Singleton subscribers, matching unsubscriptions, static/this-free handlers, non-injected publishers, and unknown shapes all stay silent.
• DI025 code fix: when the handler is a method group whose receiver resolves inside Dispose and the type already declares a block-bodied Dispose()/Dispose(bool)/DisposeAsync() implementing the matching disposal interface, the fix inserts the mirrored -= at the top of that method. Introducing IDisposable is intentionally not offered (it would change container disposal tracking and trip DI008 on transients).

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.12.0

What changed

Added

• DI025 (new rule): event subscription on longer-lived publisher without unsubscribe — a transient/scoped service that subscribes an instance-capturing handler to an event on an injected singleton dependency or a static event, with no matching -= anywhere in the type, now reports. The publisher's delegate list roots every subscriber instance the container ever creates — the classic .NET event-handler memory leak, caught lifetime-aware. Handler identity is symbol-based, so the no-op unsubscribe bug (-= with a distinct but textually identical lambda) still reports and points at the ineffective -=; override chains are normalized so a base-class -= pairs with a derived-class +=. Singleton subscribers, matching unsubscriptions, static/this-free handlers, non-injected publishers, and unknown shapes all stay silent.
• DI025 code fix: when the handler is a method group whose receiver resolves inside Dispose and the type already declares a block-bodied Dispose()/Dispose(bool)/DisposeAsync() implementing the matching disposal interface, the fix inserts the mirrored -= at the top of that method. Introducing IDisposable is intentionally not offered (it would change container disposal tracking and trip DI008 on transients).

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

2.11.43

DependencyInjection.Lifetime.Analyzers 2.11.43

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

• DI014 Dispose(bool) pattern: root providers stored on fields or properties are now recognized as disposed when the standard Dispose() method calls Dispose(true) and the Dispose(bool) overload disposes the provider.
• DI013 implicit conversion audit: pinned a regression test proving user-defined implicit conversion registrations already report as implementation mismatches instead of being treated as DI-compatible.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.11.43

What changed

Fixed

• DI014 Dispose(bool) pattern: root providers stored on fields or properties are now recognized as disposed when the standard Dispose() method calls Dispose(true) and the Dispose(bool) overload disposes the provider.
• DI013 implicit conversion audit: pinned a regression test proving user-defined implicit conversion registrations already report as implementation mismatches instead of being treated as DI-compatible.

Learn more

• Searchable docs site: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/
• Rule index: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/rules/
• Problem guides: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/problems/
• Adoption guide: https://georgepwall1991.github.io/DependencyInjection.Lifetime.Analyzers/adoption/
• NuGet package: https://www.nuget.org/packages/DependencyInjection.Lifetime.Analyzers

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.17.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.17

Release

What's Changed

• Update branding to 9.0.17 by @​vseanreesermsft in Update branding to 9.0.17 dotnet/aspnetcore#66590
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#66482
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#66371
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#66661

Full Changelog: dotnet/aspnetcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

• [release/9.0] Update branding to 9.0.16 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.16 dotnet/aspnetcore#66206
• [release/9.0] Update NPM dependencies by @​wtgodbe in [release/9.0] Update NPM dependencies dotnet/aspnetcore#66051
• [release/9.0] Move off of dead-lettered Windows preview helix queue by @​wtgodbe in [release/9.0] Move off of dead-lettered Windows preview helix queue dotnet/aspnetcore#66219
• [release/9.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 73a63ea to d72f9c8 dotnet/aspnetcore#66088
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65906
• [release/9.0] Fix lodash CVE by adding npm override for >=4.18.0 by @​wtgodbe in [release/9.0] Fix lodash CVE by adding npm override for >=4.18.0 dotnet/aspnetcore#66224
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65907
• [release/9.0] Update azure/msal-browser by @​github-actions[bot] in [release/9.0] Update azure/msal-browser dotnet/aspnetcore#66234
• [release/9.0] Stop overwriting Arcade default MicrosoftTemplateEngineAuthoringTasks… by @​wtgodbe in [release/9.0] Stop overwriting Arcade default MicrosoftTemplateEngineAuthoringTasks… dotnet/aspnetcore#66235
• [release/9.0] Use source-build-assets repo by @​NikolaMilosavljevic in [release/9.0] Use source-build-assets repo dotnet/aspnetcore#66278
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#66288
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#66316

Full Changelog: dotnet/aspnetcore@v9.0.15...v9.0.16

9.0.15

Release

What's Changed

• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/aspnetcore#65634
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65439
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65438
• [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea dotnet/aspnetcore#65587
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65706
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65731

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/aspnetcore#65294
• [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 dotnet/aspnetcore#65290
• [release/9.0] Remove package baseline by @​Copilot in [release/9.0] Remove package baseline dotnet/aspnetcore#65208
• [release/9.0] Set network isolation policy for aspnetcore-ci by @​github-actions[bot] in [release/9.0] Set network isolation policy for aspnetcore-ci dotnet/aspnetcore#65172
• [release/9.0] Package dotnet-getdocument from current TFM into top-level by @​wtgodbe in [release/9.0] Package dotnet-getdocument from current TFM into top-level dotnet/aspnetcore#65164
• [release/9.0] Fix URL format for JDK download on linux by @​github-actions[bot] in [release/9.0] Fix URL format for JDK download on linux dotnet/aspnetcore#65075
• [release/9.0] Disable parallel restore for Grpc JsonTranscoding by @​github-actions[bot] in [release/9.0] Disable parallel restore for Grpc JsonTranscoding dotnet/aspnetcore#65072
• [release/9.0] Update Ubuntu queue to 22.04 by @​wtgodbe in [release/9.0] Update Ubuntu queue to 22.04 dotnet/aspnetcore#65298
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65117
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65089
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65365
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65364
• [release/9.0] Disable parallel restore for linker tests by @​github-actions[bot] in [release/9.0] Disable parallel restore for linker tests dotnet/aspnetcore#65374
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65381
• [release/9.0] Switch to non-preview 2022 queue by @​github-actions[bot] in [release/9.0] Switch to non-preview 2022 queue dotnet/aspnetcore#65412

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

• Update branding to 9.0.13 by @​vseanreesermsft in Update branding to 9.0.13 dotnet/aspnetcore#64938
• [release/9.0] (deps): Bump src/submodules/googletest from 1b96fa1 to 9156d4c by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 1b96fa1 to 9156d4c dotnet/aspnetcore#64908
• [release/9.0] Pass container image correctly for source-build job in official build by @​akoeplinger in [release/9.0] Pass container image correctly for source-build job in official build dotnet/aspnetcore#64781
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64686
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64685
• [release/9.0] Update gradle by @​github-actions[bot] in [release/9.0] Update gradle dotnet/aspnetcore#64980
• Backport #​64657: Use shallow clones for CI jobs by @​Copilot in Backport #64657: Use shallow clones for CI jobs dotnet/aspnetcore#64677
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65012
• [release/9.0] Add .slnx fallback for TestHost content root discovery by @​Copilot in [release/9.0] Add .slnx fallback for TestHost content root discovery dotnet/aspnetcore#64953
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65046

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

• Update branding to 9.0.12 by @​vseanreesermsft in Update branding to 9.0.12 dotnet/aspnetcore#64248
• Update Microsoft.Build versions to 17.8.43 by @​MackinnonBuck in Update Microsoft.Build versions to 17.8.43 dotnet/aspnetcore#64277
• [release/9.0] (deps): Bump src/submodules/googletest from 9706f75 to 6ec14df by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9706f75 to 6ec14df dotnet/aspnetcore#64230
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64111
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64065
• [release/9.0] Upgrade to MacOS 15 for CI by @​wtgodbe in [release/9.0] Upgrade to MacOS 15 for CI dotnet/aspnetcore#64310
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#64312
• [release/9.0] Don't use netcoreapp2.1 in dotnet-get-document by @​wtgodbe in [release/9.0] Don't use netcoreapp2.1 in dotnet-get-document dotnet/aspnetcore#64351
• [release/9.0] AppContext for HttpSys CBT hardening by @​BrennanConroy in [release/9.0] AppContext for HttpSys CBT hardening dotnet/aspnetcore#64297
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#64350
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64388
• [release/9.0] Delete signalr-daily-tests.yml by @​github-actions[bot] in [release/9.0] Delete signalr-daily-tests.yml dotnet/aspnetcore#64589
• [release/9.0] (deps): Bump src/submodules/googletest from 6ec14df to 1b96fa1 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 6ec14df to 1b96fa1 dotnet/aspnetcore#64580
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#64503

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

• Update branding to 9.0.11 by @​vseanreesermsft in Update branding to 9.0.11 dotnet/aspnetcore#63950
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63677
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63678
• [release/9.0] (deps): Bump src/submodules/googletest from eb2d85e to 9706f75 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from eb2d85e to 9706f75 dotnet/aspnetcore#63894
• [release/9.0] Fixed devtools url used for debug with chrome and edge by @​github-actions[bot] in [release/9.0] Fixed devtools url used for debug with chrome and edge dotnet/aspnetcore#61948
• [release/9.0] (http2): Lower WINDOWS_UPDATE received on (half)closed stream to stream abortion by @​DeagleGross in [release/9.0] (http2): Lower WINDOWS_UPDATE received on (half)closed stream to stream abortion dotnet/aspnetcore#63934
• [release/9.0] Re-quarantine ServerRoutingTest.NavigationLock_OverlappingNavigationsCancelExistingNavigations_HistoryNavigation by @​github-actions[bot] in [release/9.0] Re-quarantine ServerRoutingTest.NavigationLock_OverlappingNavigationsCancelExistingNavigations_HistoryNavigation dotnet/aspnetcore#63956
• [release/9.0] Fix nginx install on mac, linux by @​wtgodbe in [release/9.0] Fix nginx install on mac, linux dotnet/aspnetcore#63966
• [Hot Reload] Do not attempt to apply empty deltas. by @​tmat in [Hot Reload] Do not attempt to apply empty deltas. dotnet/aspnetcore#63979
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#64036
• Revert log level severity for unknown proxy in ForwardedHeadersMiddleware by @​BrennanConroy in Revert log level severity for unknown proxy in ForwardedHeadersMiddleware dotnet/aspnetcore#64091
• Set timeoutInMinutes to 0 for Windows build job by @​vseanreesermsft in Set timeoutInMinutes to 0 for Windows build job dotnet/aspnetcore#64126

Full Changelog: dotnet/aspnetcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

• Update branding to 9.0.10 by @​vseanreesermsft in Update branding to 9.0.10 dotnet/aspnetcore#63510
• [9.0] Make duplicate deb/rpm packages so we can sign them with the new PMC key by @​jkoritzinsky in [9.0] Make duplicate deb/rpm packages so we can sign them with the new PMC key dotnet/aspnetcore#63249
• [release/9.0] Extend Unofficial 1ES template in IdentityModel nightly tests job by @​github-actions[bot] in [release/9.0] Extend Unofficial 1ES template in IdentityModel nightly tests job dotnet/aspnetcore#63465
• [release/9.0] (deps): Bump src/submodules/googletest from 373af2e to eb2d85e by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 373af2e to eb2d85e dotnet/aspnetcore#63501
• [release/9.0] Quarantine ResponseBody_WriteContentLength_PassedThrough by @​wtgodbe in [release/9.0] Quarantine ResponseBody_WriteContentLength_PassedThrough dotnet/aspnetcore#63533
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63304
• [release/9.0] [OpenAPI] Use invariant culture for TextWriter by @​martincostello in [release/9.0] [OpenAPI] Use invariant culture for TextWriter dotnet/aspnetcore#62239
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63303
• Unquarantine RadioButtonGetsResetAfterSubmittingEnhancedForm by @​ilonatommy in Unquarantine RadioButtonGetsResetAfterSubmittingEnhancedForm dotnet/aspnetcore#63556
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63577
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#63604
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63648
• backport(9.0): Fix runtime architecture detection logic in ANCM. by @​DeagleGross in backport(9.0): Fix runtime architecture detection logic in ANCM. dotnet/aspnetcore#63707

Full Changelog: dotnet/aspnetcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

• Update branding to 9.0.9 by @​vseanreesermsft in Update branding to 9.0.9 dotnet/aspnetcore#63107
• [release/9.0] (deps): Bump src/submodules/googletest from c67de11 to 373af2e by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from c67de11 to 373af2e dotnet/aspnetcore#63035
• [release/9.0] Dispose the certificate chain elements with the chain by @​github-actions[bot] in [release/9.0] Dispose the certificate chain elements with the chain dotnet/aspnetcore#62992
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#62702
• [release/9.0] Update Microsoft.Build versions by @​wtgodbe in [release/9.0] Update Microsoft.Build versions dotnet/aspnetcore#62505
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#62832
• [release/9.0] Update SignalR Redis tests to use internal Docker Hub mirror by @​github-actions[bot] in [release/9.0] Update SignalR Redis tests to use internal Docker Hub mirror dotnet/aspnetcore#63116
• [release/9.0] [SignalR] Don't throw for message headers in Java client by @​github-actions[bot] in [release/9.0] [SignalR] Don't throw for message headers in Java client dotnet/aspnetcore#62783
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#63151
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#63190
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#63214

Full Changelog: dotnet/aspnetcore@v9.0.8...v9.0.9

9.0.7

Release

What's Changed

• Update branding to 9.0.7 by @​vseanreesermsft in Update branding to 9.0.7 dotnet/aspnetcore#62242
• [release/9.0] (deps): Bump src/submodules/googletest from 04ee1b4 to e9092b1 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 04ee1b4 to e9092b1 dotnet/aspnetcore#62199
• Fix OpenApiJsonSchema array parsing (#​62051) by @​BrennanConroy in Fix OpenApiJsonSchema array parsing (#62051) dotnet/aspnetcore#62118
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61986
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61945
• [release/9.0] Update Alpine helix references by @​wtgodbe in [release/9.0] Update Alpine helix references dotnet/aspnetcore#62240
• [Backport 9.0] [IIS] Manually parse exe bitness (#​61894) by @​BrennanConroy in [Backport 9.0] [IIS] Manually parse exe bitness (#61894) dotnet/aspnetcore#62038
• [release/9.0] Associate tagged keys with entries so replacements are not evicted by @​github-actions in [release/9.0] Associate tagged keys with entries so replacements are not evicted dotnet/aspnetcore#62248
• [release/9.0] Block test that is failing after switching to latest-chrome by @​github-actions in [release/9.0] Block test that is failing after switching to latest-chrome dotnet/aspnetcore#62283
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#62281
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#62282
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#62303

Full Changelog: dotnet/aspnetcore@v9.0.6...v9.0.7

9.0.6

Bug Fixes

• Forwarded Headers Middleware: Ignore X-Forwarded-Headers from Unknown Proxy (#​61622)
  The Forwarded Headers Middleware now ignores X-Forwarded-Headers sent from unknown proxies. This change improves security by ensuring that only trusted proxies can influence forwarded header values, preventing potential spoofing or misrouting issues.

Dependency Updates

• Bump src/submodules/googletest from 52204f7 to 04ee1b4 (#​61762)
  Updates the GoogleTest submodule to a newer commit, bringing in the latest improvements and bug fixes from the upstream project.
• Update dependencies from dotnet/arcade (#​61714)
  Updates internal build and infrastructure dependencies from the dotnet/arcade repository, ensuring compatibility and access to the latest build tools.
• Update dependencies from dotnet/extensions (#​61571)
  Refreshes dependencies from the dotnet/extensions repository, incorporating the latest features and fixes from the extensions libraries.
• Update dependencies from dotnet/extensions (#​61877)
  Further updates dependencies from dotnet/extensions, ensuring the project benefits from recent improvements and bug fixes.
• Update dependencies from dotnet/arcade (#​61892)
  Additional updates to build and infrastructure dependencies from dotnet/arcade, maintaining up-to-date tooling and build processes.

Miscellaneous

• Update branding to 9.0.6 (#​61831)
  Updates the project version and branding to 9.0.6, reflecting the new release and ensuring version consistency across the codebase.
• Merging internal commits for release/9.0 (#​61925)
  Incorporates various internal commits into the release/9.0 branch, ensuring that all relevant changes are included in this release.

---

This summary is generated and may contain inaccuracies. For complete details, please review the linked pull requests.

Full Changelog: v9.0.5...v9.0.6

9.0.5

Release

What's Changed

• Update branding to 9.0.5 by @​vseanreesermsft in Update branding to 9.0.5 dotnet/aspnetcore#61284
• [release/9.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 24a9e94 to 52204f7 dotnet/aspnetcore#61261
• [release/9.0] Upgrade to Ubuntu 22 by @​github-actions in [release/9.0] Upgrade to Ubuntu 22 dotnet/aspnetcore#61215
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60964
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60902
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61355
• [release/9.0] Caching SERedis critical bugfix; defer HC metadata detection because of DI cycle by @​github-actions in [release/9.0] Caching SERedis critical bugfix; defer HC metadata detection because of DI cycle dotnet/aspnetcore#60916
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61354
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#61393
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#61412
• Revert "Revert "[release/9.0] Update remnants of azureedge.net"" by @​wtgodbe in Revert "Revert "[release/9.0] Update remnants of azureedge.net"" dotnet/aspnetcore#60353
• [release/9.0] Fix preserving messages for stateful reconnect with backplane by @​github-actions in [release/9.0] Fix preserving messages for stateful reconnect with backplane dotnet/aspnetcore#61374
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#61483
• [Identity] Fix Identity UI asset definitions by @​javiercn in [Identity] Fix Identity UI asset definitions dotnet/aspnetcore#59100

Full Changelog: dotnet/aspnetcore@v9.0.4...v9.0.5

9.0.4

Release

What's Changed

• Update branding to 9.0.4 by @​vseanreesermsft in Update branding to 9.0.4 dotnet/aspnetcore#60785
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60445
• [release/9.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from e235eb3 to 24a9e94 dotnet/aspnetcore#60678
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#60356
• Fix OpenAPI server URLs for Aspire scenarios by @​captainsafia in Fix OpenAPI server URLs for Aspire scenarios dotnet/aspnetcore#60673
• Fix self-referential schema handling in collection schemas by @​captainsafia in Fix self-referential schema handling in collection schemas dotnet/aspnetcore#60410
• [release/9.0] [Blazor] Fix custom elements JS assets not being included in build output by @​MackinnonBuck in [release/9.0] [Blazor] Fix custom elements JS assets not being included in build output dotnet/aspnetcore#60858
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#60880

Full Changelog: dotnet/aspnetcore@v9.0.3...v9.0.4

9.0.3

Release

What's Changed

• Update branding to 9.0.3 by @​vseanreesermsft in Update branding to 9.0.3 dotnet/aspnetcore#60198
• [release/9.0] Fix branding by @​wtgodbe in [release/9.0] Fix branding dotnet/aspnetcore#60029
• [release/9.0] Update to MacOS 15 in Helix by @​github-actions in [release/9.0] Update to MacOS 15 in Helix dotnet/aspnetcore#60238
• [release/9.0] Revert "Revert "Use the latest available jdk"" by @​github-actions in [release/9.0] Revert "Revert "Use the latest available jdk"" dotnet/aspnetcore#60229
• [release/9.0] Update HtmlAttributePropertyHelper to correctly follow the MetadataUpdateHandlerAttribute contract by @​github-actions in [release/9.0] Update HtmlAttributePropertyHelper to correctly follow the MetadataUpdateHandlerAttribute contract dotnet/aspnetcore#59908
• [release/9.0] Fix skip condition for java tests by @​github-actions in [release/9.0] Fix skip condition for java tests dotnet/aspnetcore#60242
• [release/9.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from 7d76a23 to e235eb3 dotnet/aspnetcore#60151
• [release/9.0] Readd DiagnosticSource to KestrelServerImpl by @​github-actions in [release/9.0] Readd DiagnosticSource to KestrelServerImpl dotnet/aspnetcore#60202
• [release/9.0] Redis distributed cache: add HybridCache usage signal by @​github-actions in [release/9.0] Redis distributed cache: add HybridCache usage signal dotnet/aspnetcore#59886
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59952
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59951
• [release/9.0] Update remnants of azureedge.net by @​sebastienros in [release/9.0] Update remnants of azureedge.net dotnet/aspnetcore#60263
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#60291
• [release/9.0] Centralize on one docker container by @​wtgodbe in [release/9.0] Centralize on one docker container dotnet/aspnetcore#60298
• Revert "[release/9.0] Update remnants of azureedge.net" by @​wtgodbe in Revert "[release/9.0] Update remnants of azureedge.net" dotnet/aspnetcore#60323
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#60317

Full Changelog: dotnet/aspnetcore@v9.0.2...v9.0.3

9.0.2

Release

What's Changed

• Update branding to 9.0.2 by @​vseanreesermsft in Update branding to 9.0.2 dotnet/aspnetcore#59757
• [release/9.0] Update dependencies from dotnet/source-build-externals by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#59267
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59266
• [release/9.0] Update OSX helix queue by @​github-actions in [release/9.0] Update OSX helix queue dotnet/aspnetcore#59743
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59728
• [release/9.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 by @​dependabot in [release/9.0] (deps): Bump src/submodules/googletest from d144031 to 7d76a23 dotnet/aspnetcore#59679
• [release/9.0] Skip tests on internal queues too by @​github-actions in [release/9.0] Skip tests on internal queues too dotnet/aspnetcore#59578
• [release/9.0] Fix loading dotnet user-jwts config by @​github-actions in [release/9.0] Fix loading dotnet user-jwts config dotnet/aspnetcore#59473
• [release/9.0] Fix MultipartReaderStream synchronous read when using buffer offset by @​github-actions in [release/9.0] Fix MultipartReaderStream synchronous read when using buffer offset dotnet/aspnetcore#59422
• [release/9.0] Update dependencies from dotnet/xdt by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/xdt dotnet/aspnetcore#59419
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59611
• [release/9.0] Fix Kestrel host header mismatch handling when port in Url by @​github-actions in [release/9.0] Fix Kestrel host header mismatch handling when port in Url dotnet/aspnetcore#59362
• Migrate off of Fedora 38 by @​v-firzha in Migrate off of Fedora 38 dotnet/aspnetcore#59613
• [release/9.0] [Blazor WASM standalone] Avoid caching index.html during development by @​MackinnonBuck in [release/9.0] [Blazor WASM standalone] Avoid caching index.html during development dotnet/aspnetcore#59348
• [release/9.0] Update to Fedora 41 by @​github-actions in [release/9.0] Update to Fedora 41 dotnet/aspnetcore#59816
• [release/9.0] Don't throw exception for parameters with custom binding source by @​github-actions in [release/9.0] Don't throw exception for parameters with custom binding source dotnet/aspnetcore#59533
• [release/9.0] Apply schema transformer to AdditionalProperties by @​github-actions in [release/9.0] Apply schema transformer to AdditionalProperties dotnet/aspnetcore#59730
• [release/9.0] Harden schema reference transformer for relative references by @​captainsafia in [release/9.0] Harden schema reference transformer for relative references dotnet/aspnetcore#59779
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#59847
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59848
• [release/9.0] Return 206 Partial Content on Valid Range for Static Assets by @​github-actions in [release/9.0] Return 206 Partial Content on Valid Range for Static Assets dotnet/aspnetcore#59325
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#59871

Full Changelog: dotnet/aspnetcore@v9.0.1...v9.0.2

9.0.1

Release

What's Changed

• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#58900
• [release/9.0] Prevent unnecessary debugger stops for user-unhandled exceptions in Blazor apps with Just My Code enabled by @​halter73 in [release/9.0] Prevent unnecessary debugger stops for user-unhandled exceptions in Blazor apps with Just My Code enabled dotnet/aspnetcore#58573
• Hot Reload agent improvements by @​tmat in Hot Reload agent improvements dotnet/aspnetcore#58333
• [release/9.0] Update dependencies from roslyn by @​wtgodbe in [release/9.0] Update dependencies from roslyn dotnet/aspnetcore#59183
• [release/9.0] Add direct reference to System.Drawing.Common in tools by @​wtgodbe in [release/9.0] Add direct reference to System.Drawing.Common in tools dotnet/aspnetcore#59189
• [release/9.0] Harden parsing of [Range] attribute values by @​github-actions in [release/9.0] Harden parsing of [Range] attribute values dotnet/aspnetcore#59077
• [release/9.0] Update dependencies from dotnet/source-build-externals by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#59143
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#59024
• [release/9.0] (deps): B...

Description has been truncated

[dependabot]

Superseded by #292.