chore(deps): update nuget packages (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

Motivation

Automated dependency update by Renovate bot.

Description

This PR contains the following updates:

Package	Change	Age	Confidence
AWSSDK.Core	3.7.500.80 → 4.0.100.9
AWSSDK.S3	3.7.510.6 → 4.0.101.6
AWSSDK.SQS	3.7.502.39 → 4.0.100.7
AWSSDK.SecurityToken	3.7.504.32 → 4.0.100.7
AspNetCore.HealthChecks.MongoDb	8.1.0 → 9.0.0
Calzolari.Grpc.AspNetCore.Validation	9.0.0 → 10.1.0
JetBrains.Annotations (source)	2025.2.4 → 2026.2.0
Microsoft.AspNetCore.TestHost (source)	8.0.24 → 10.0.10
Microsoft.Extensions.Diagnostics.HealthChecks (source)	8.0.24 → 10.0.10
NATS.Client.JetStream	2.7.2 → 3.1.0
NATS.Net	2.7.2 → 3.1.0
Npgsql	9.0.3 → 10.0.3
StackExchange.Redis (source)	2.11.0 → 3.1.3
coverlet.collector	8.0.0 → 10.0.1
dbup-postgresql (source)	6.1.2 → 7.0.1

Testing

This is an automated dependency update. No functional changes are expected.

Impact

---

Release Notes

aws/aws-sdk-net (AWSSDK.Core)

v4.0.100

v4.0.9

v4.0.8

v4.0.7

v4.0.6

Compare Source

v4.0.5

Compare Source

v4.0.4

v4.0.3

Compare Source

v4.0.2

v4.0.1

v4.0.0

JetBrains/JetBrains.Annotations (JetBrains.Annotations)

v2026.2.0

Compare Source

dotnet/dotnet (Microsoft.AspNetCore.TestHost)

v10.0.10

v10.0.9

v10.0.8

v10.0.7

v10.0.6

v10.0.5

v10.0.4

v10.0.3

v10.0.2

v10.0.1

v9.0.7: .NET 9.0.7

You can build .NET 9.0 from the repository by cloning the release tag v9.0.7 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.6: .NET 9.0.6

You can build .NET 9.0 from the repository by cloning the release tag v9.0.6 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.5: .NET 9.0.5

You can build .NET 9.0 from the repository by cloning the release tag v9.0.5 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.4: .NET 9.0.4

You can build .NET 9.0 from the repository by cloning the release tag v9.0.4 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.3: .NET 9.0.3

You can build .NET 9.0 from the repository by cloning the release tag v9.0.3 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.2: .NET 9.0.2

You can build .NET 9.0 from the repository by cloning the release tag v9.0.2 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.1: .NET 9.0.1

You can build .NET 9.0 from the repository by cloning the release tag v9.0.1 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

v9.0.0: .NET 9.0.0

You can build .NET 9.0 from the repository by cloning the release tag v9.0.0 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

nats-io/nats.net (NATS.Client.JetStream)

v3.1.0: NATS .NET v3.1.0

Minor release on top of 3.0.1. Adds subscription events with an OnSubscribed callback, enables full-graph NuGet dependency auditing, and adds documentation examples.

• Add subscription events with OnSubscribed callback (#​1217)
• Audit transitive dependencies (#​1220)
• Add subject-dispatch serialization example (#​1218)
• Add docs.nats.io examples to main (#​1216)

The async enumerable returned by SubscribeAsync does not establish the subscription until it is iterated. When the enumerable is handed off to another task, the new OnSubscribed callback signals when it is safe to publish messages the subscription must observe:

var subscribed = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);

var opts = new NatsSubOpts
{
    Events = new NatsSubEvents
    {
        OnSubscribed = _ =>
        {
            subscribed.TrySetResult();
            return default;
        },
    },
};

var consumer = Task.Run(async () =>
{
    await foreach (var msg in nats.SubscribeAsync<string>("greet", opts: opts))
    {
        // process messages
    }
});

await subscribed.Task;
await nats.PublishAsync("greet", "hello"); // subscription is established

OnSubscribed fires once the SUB protocol message has been queued on the subscribing connection, which is enough when publishing on the same connection. If the publisher uses a different connection, add a PingAsync round-trip on the subscribing connection after the callback to be sure the server has processed the subscription:

await subscribed.Task;
await nats.PingAsync(); // server has processed the SUB
await otherConnection.PublishAsync("greet", "hello");

Thanks

• @​btzdnl for reporting the SubscribeAsync early-return issue and helping with the design (#​1178)

v3.0.1: NATS .NET v3.0.1

Patch release on top of 3.0.0. Fixes a JetStream list enumeration cancellation bug and adds opt-in W3C Baggage propagation to the OpenTelemetry integration.

• Fix silent completion when JetStream list enumeration is cancelled (#​1214)
• OpenTelemetry: opt-in W3C Baggage propagation (#​1208)
• Add explicit permissions to CI workflows (#​1213)
• Update README for 3.0 release (#​1212)

Thanks

• @​paagamelo2 for reporting the JetStream list cancellation issue (#​1193)
• @​iamadamreed for the opt-in W3C Baggage propagation support (#​1208)

v3.0.0: NATS .NET v3.0.0

NATS .NET 3.0 is now stable. This release has been in the works since early this year and brings OpenTelemetry tracing and metrics, .NET 10 target, and a number of API and behavior changes refined over the preview series. Thanks to everyone who tried the previews and reported issues along the way. There are no changes since 3.0.0-preview.11.

.NET 10 Target

3.0 targets netstandard2.0, netstandard2.1, net8.0, and net10.0. net6.0 has been dropped.

OpenTelemetry

• Add OTel metrics support #​1154
• Add OpenTelemetry package (tracing) #​1172
• Add custom span destination name formatter #​1201
• Add OTel ack/dropped metrics and collapse inbox trace tags #​1194
• Exclude NATS status frames from consumed metrics #​1195
• Fix server.port type and trace tag source #​1175
• Fix null-key tag in OpenTelemetry receive fallback #​1205
• Match OpenTelemetry subject filters without per-message allocation #​1206
• Make shared OpenTelemetry instrumentation options thread-visible #​1207

API and behavior changes

• Add message context to serialization interfaces #​1082
• Move socket connection interfaces to NATS.Client.Abstractions #​1192
• Default request-reply to Direct mode #​1182
• Add explicit subscription and consumer drain #​1177
• Deprecate SkipSubjectValidation #​1180
• Unify subscription channel overflow defaults #​1181
• Use System.Threading.Lock on NET9_0_OR_GREATER #​1118
• Clean up NET6 and optimize NETSTANDARD #​1072
• Update DI package dependencies and documentation #​1075

Performance and internals

• Optimize header handling with SearchValues #​1203
• Simplify object store base64url encoder #​1199

Tests and docs

• Add abstractions package boundary test #​1197
• Gate positive-path test connections with ConnectRetryAsync #​1198
• Fix flaky CI tests #​1179
• Remove stale net6.0 references #​1196
• Clarify AddNats vs AddNatsClient #​1210

Thanks

Thanks to the community for the contributions and issue reports behind this release:

• @​colprog for the header handling optimization (#​1203), the custom span destination name formatter (#​1201), and requesting the explicit drain API (#​1176)
• @​to11mtm for the object store base64url encoding work (#​557, #​565) behind the encoder simplification (#​1199)
• @​thompson-tomo for the abstractions and package consolidation proposals (#​851, #​866) behind moving the socket interfaces to NATS.Client.Abstractions (#​1192)

Upgrade notes

Details of the API and behavior changes, with the preview each first shipped in.

Target frameworks (since preview.1)

net6.0 is dropped and net10.0 added; the full set is netstandard2.0, netstandard2.1, net8.0, net10.0. Apps targeting .NET 6 or 7 keep working through the netstandard2.1 build, whose encoding hot paths were optimized in 3.0 (#​1072), but .NET 8+ gets the fastest code paths.

Request-reply defaults to Direct mode (since preview.9)

NatsOpts.RequestReplyMode now defaults to NatsRequestReplyMode.Direct: replies are correlated through the connection's existing inbox subscription instead of setting up a subscription and channel per request. Semantics are unchanged, including ThrowIfNoResponders. To restore the previous behavior:

var opts = new NatsOpts { RequestReplyMode = NatsRequestReplyMode.SharedInbox };

Subscription channel overflow defaults unified (since preview.9)

All entry points (NatsConnection, NatsClient, DI builders) now share the NatsOpts defaults: pending channel capacity 16384 (up from 1024) and BoundedChannelFullMode.DropNewest. Previously NatsClient and the DI builders forced Wait, which can stall the socket read loop and get the client disconnected as a slow consumer. If a subscriber now falls behind by more than 16K messages, the newest messages are dropped and surfaced through MessageDropped instead of blocking. To restore blocking, accepting the slow consumer risk:

var opts = new NatsOpts { SubPendingChannelFullMode = BoundedChannelFullMode.Wait };

SkipSubjectValidation is obsolete (since preview.9)

The option still works but produces a compiler warning. Validation costs 0-5% on a publish microbenchmark and prevents silently misrouted messages: a subject containing a space splits into subject and reply-to tokens on the wire with no error.

Serializers can opt into message context (since preview.3)

New opt-in INatsSerializeWithContext<T>, INatsDeserializeWithContext<T>, and INatsSerializerWithContext<T> interfaces receive a NatsMsgContext (subject, reply-to, headers) during (de)serialization. Existing serializers work unchanged. One side effect: NatsHeaders no longer becomes read-only after publish, so a single NatsHeaders instance should not be shared across concurrent publishes.

Socket interfaces moved to NATS.Client.Abstractions (since preview.11)

INatsSocketConnection and INatsTlsUpgradeableSocketConnection moved to the NATS.Client.Abstractions package so custom transports can implement them without referencing Core. The namespace is unchanged and the types are forwarded, so existing code is source and binary compatible.

OpenTelemetry package (metrics since preview.8, package since preview.11)

The new NATS.Client.OpenTelemetry package adds AddNatsClientInstrumentation() extensions for both TracerProviderBuilder and MeterProviderBuilder, with options for subject filtering and custom span destination names.

using NATS.Client.OpenTelemetry;

services.AddOpenTelemetry()
    .WithTracing(tracing => tracing
        .AddNatsClientInstrumentation(opts => opts.FilterSubjects(exclude: ["_INBOX.>"])))
    .WithMetrics(metrics => metrics
        .AddNatsClientInstrumentation());

Explicit drain (since preview.9)

INatsSub<T>.DrainAsync() drains a single subscription without disposing the connection: no new deliveries, in-flight messages fenced with a PING/PONG, channel completed.

var sub = await nats.SubscribeCoreAsync<Order>("orders.>");
// ... read from sub.Msgs ...
await sub.DrainAsync(); // in-flight messages still delivered, connection stays open

For JetStream consume loops, the opt-in DrainOnCancel consume option delivers buffered messages after cancellation so handlers can still ack; the default keeps the previous stop-immediately behavior.

var opts = new NatsJSConsumeOpts { DrainOnCancel = true };
await foreach (var msg in consumer.ConsumeAsync<Order>(opts: opts, cancellationToken: ct))
{
    await msg.AckAsync();
}
// on cancellation the loop drains: stops pulling, delivers buffered messages, then completes

DI package dependencies (since preview.2)

NATS.Extensions.Microsoft.DependencyInjection now depends on NATS.Client.Simplified instead of the all-inclusive NATS.Net, and NATS.Net now includes the DI package. If you referenced only the DI package and used JetStream, Key-Value, Object Store, or Services through its transitive dependency, add a direct NATS.Net reference (or the specific packages you use).

Full Changelog: nats-io/nats.net@v2.8.2...v3.0.0

v2.8.2: NATS .NET v2.8.2

Patch release on the 2.8 line. Fixes ordered push consumer subscription teardown. Thanks to @​haoguanjun for the fix.

What's Changed

• Bump MessagePack from 3.1.1 to 3.1.7 #​1183
• Clarify DI package descriptions #​1163
• Fix ordered push consumer subscription leak on teardown #​1188
• Simplify ordered push consumer sub teardown #​1191
• Release 2.8.2 #​1189

Full Changelog: nats-io/nats.net@v2.8.1...v2.8.2

v2.8.1: NATS .NET v2.8.1

Patch release on the 2.8 line. Bug fixes across JetStream, KV, subscriptions, and connection logging, plus a small Services helper for handling error responses on the requester side.

What's Changed

• Add helpers to detect Nats-Service-Error on responses (#​1152)
• Fix durable consumer create when only DurableName is set (#​1150)
• kv: cap duplicate_window at max_age (#​1149)
• Quiet recoverable server-error logs (#​1148) (thanks @​garrett-sutton)
• Fix subscription timeout overflow (#​1134) (thanks @​Prochy)
• test: fix Windows CI flaps (#​1147)
• docs: add JetStream basic example (#​1138)

New Services Extensions

Detect service errors on responses (#​1152)

Services signal failures using Nats-Service-Error / Nats-Service-Error-Code response headers. The requester side previously had to read those headers by hand. New extensions on NatsMsg<T> (in the NATS.Net namespace) cover the common patterns:

var reply = await nats.RequestAsync<MyReq, MyResp>("svc.echo", req);

if (reply.IsServiceSuccess())
{
    // use reply.Data
}

// or throw on error
reply.EnsureServiceSuccess();

// or inspect the status
var status = reply.GetServiceStatus();
// status.IsSuccess, status.Code, status.Message, status.HasNoResponders

Full Changelog: nats-io/nats.net@v2.8.0...v2.8.1

Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.8.1

v2.8.0: NATS .NET v2.8.0

Happy to announce the NATS .NET 2.8.0 stable release of the 2.8 line. It picks up the NATS Server v2.14 client surface (consumer reset, $JS.FC.* flow-control replies, Consumer field on stream source/mirror, AllowBatchPublish on stream config), ships two breaking changes that landed in the preview cycle, and fixes in-flight message loss on consumer/connection dispose behind an opt-in drain.

A big thank you to all NATS contributors and community members who helped make this release possible. <3

NATS Server v2.14 Features

• ResetConsumerAsync on INatsJSContext and INatsJSConsumer (ADR-60), to reset a pinned consumer's state (#​1126).
• $JS.FC.* flow-control replies are parsed by the JS metadata layer, for streams that publish with the js_ack_fc_v2 flag (#​1127).
• Consumer field on StreamSource and stream mirror config, for pre-created mirror/source consumers (#​1128).
• AllowBatchPublish on StreamConfig (JSON allow_batched), required by streams that opt into fast-ingest batch publishing per ADR-50 (#​1120). The fast-ingest publisher itself lives in orbit.net alongside the existing atomic batch publisher.

Breaking Changes

Subject Validation On By Default (#​1093)

Subjects containing whitespace (space, tab, CR, LF) now throw NatsException. This closes a class of CRLF injection issues from malformed subjects.

Opt out if you rely on legacy subjects that contain whitespace:

var opts = NatsOpts.Default with { SkipSubjectValidation = true };

NKeyPair Removed From NATS.Client.Core (#​1101)

NATS.Client.Core.NKeys and NKeyPair are removed. Signing now goes through the NATS.NKeys package, which lets the nkey/Ed25519 code be versioned independently of the client.

For typical users this is transparent: keep using NatsAuthOpts.NKeyFile, CredsFile, Jwt + Seed, or AuthCredCallback and the client wires up the new signer automatically.

Only direct callers of NATS.Client.Core.NKeyPair need to switch:

// Before
using NATS.Client.Core;
var kp = NKeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

// After
using NATS.NKeys;
var kp = KeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

Other Notable Changes

• Server error event (#​745): a new event on NatsConnection surfaces server-side errors to client code.
• Message loss on consumer dispose (#​1085): opt-in drain keeps in-flight messages from being dropped when a consumer or connection is disposed. Enable with:

  var opts = NatsOpts.Default with
  {
      DrainSubscriptionsOnDispose = true,
      ConsumerDrainOnDisposeTimeout = TimeSpan.FromSeconds(10),
  };

• Auth signs the server nonce regardless of auth_required advertisement (#​1109), so NKey/credential clients respond to the challenge even when the server doesn't advertise auth_required.
• Connection state resets cleanly on credential loading failure (#​1107).
• Duplicate status headers no longer leak an incorrect Pin ID (#​1116); other Pin ID handling improvements (#​1099).
• KV watcher cancellation behavior fix (#​1084).
• Protocol size checks: 64MB incoming payload cap, matching nats.js (#​1095).
• Range attribute fix on MaxBytes (#​1096).
• ArrayPool buffers are cleared before return to pool (#​1097).

What's Changed

Since 2.8.0-preview.3:

• Add server error event (#​745)
• Add Client and Orbit section to README (#​1133)
• Add Example Docs (#​1119)
• Migrate solution to slnx format (#​1131)

2.8.0-preview.3:

• Fix message loss on consumer dispose (#​1085)
• Add consumer reset API (#​1126) [server 2.14]
• Add consumer field on stream source/mirror (#​1128) [server 2.14]
• Add $JS.FC support to JS metadata parser (#​1127) [server 2.14]

2.8.0-preview.2:

• Add AllowBatchPublish stream config field (#​1120) [server 2.14]
• Bump OpenTelemetry and OpenTelemetry.Exporter.OpenTelemetryProtocol (#​1121)
• Fix setting wrong pin id from status header (#​1116) (thanks @​colprog)
• Fix slow-consumer test first-ping RTT flap (#​1115)
• Fix net481 TLS test flakes (#​1111)
• Rewrite README intro (#​1114)

2.8.0-preview.1:

• auth: sign nonce regardless of auth_required (#​1109) (thanks @​Lionel-Zieminski)
• auth: use NATS.NKeys package for nkey signing (#​1101) [breaking]
• conn: reset state on credential loading failure (#​1107) (thanks @​Prochy)
• Improve package metadata and README (#​1103)
• tests: fix TlsPreferTest flap on net481 (#​1108)
• Fix release workflow (#​1106)
• Fix test flaps (#​1083)
• ci: add contents and actions read permissions to Claude workflow (#​1102)
• tls: document Prefer mode plaintext behavior (#​1094)
• tests: increase NuidTests thread join timeouts (#​1100)
• Improve Pin ID handling (#​1099) (thanks @​colprog)
• Fix KV watcher cancellation behavior (#​1084)
• Clear ArrayPool buffers before returning to pool (#​1097)
• Enable subject validation by default (#​1093) [breaking]
• Add protocol size checks (#​1095)
• Fix Range attribute for MaxBytes property (#​1096) (thanks @​partnerRuiSilva)
• Add CC reviews (#​1092)

Full Changelog: nats-io/nats.net@v2.7.3...v2.8.0

Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.8.0

v2.7.3: NATS .NET v2.7.3

Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#​1089) even though the vulnerable API is not used by our library.

A big thank you to all NATS contributors and community members who helped make this release possible ❤️

Breaking Changes

NakAsync Signature Change (#​1081)

The TimeSpan delay parameter has been removed from INatsJSMsg<T>.NakAsync(). The delay must now be passed via AckOpts.NakDelay.

Before (v2.7.2):

await msg.NakAsync(delay: TimeSpan.FromSeconds(5));
await msg.NakAsync(opts, TimeSpan.FromSeconds(5));

After (v2.7.3):

// Option 1: Use the new extension method
await msg.NakAsync(TimeSpan.FromSeconds(5));

// Option 2: Use AckOpts with NakDelay
await msg.NakAsync(new AckOpts { NakDelay = TimeSpan.FromSeconds(5) });

Note: because we also have an extension method, recompiling your project is enough.

AckTerminateAsync TermWithReason (#​1048, #​1081)

AckTerminateAsync now supports an optional termination reason. A new overload and a new TerminateReason property on AckOpts have been added to INatsJSMsg<T>. Implementors of this interface must add the new method.

// New overload
await msg.AckTerminateAsync("processing failed permanently");

// Or via AckOpts
await msg.AckTerminateAsync(new AckOpts { TerminateReason = "processing failed permanently" });

// Extension method shorthand
await msg.AckTerminateAsync("reason", cancellationToken);

Requires NATS Server 2.10.4+.

PinnedClient Validation (#​1063)

Calling NextAsync(), FetchAsync(), or FetchNoWaitAsync() on a consumer with PriorityPolicy.PinnedClient now throws NatsJSException. Use ConsumeAsync() instead.

// This now throws NatsJSException:
var msg = await consumer.NextAsync<string>();

// Use ConsumeAsync instead:
await foreach (var msg in consumer.ConsumeAsync<string>())
{
    // process message
}

Consumer Cancellation Handling (#​1068)

Consumer methods (ConsumeAsync, FetchAsync, NextAsync) now call cancellationToken.ThrowIfCancellationRequested() immediately at method entry. Previously cancelled tokens were checked later in the async pipeline.

var cts = new CancellationTokenSource();
cts.Cancel();

// v2.7.2: exception thrown sometime during async operation
// v2.7.3: OperationCanceledException thrown immediately
await consumer.FetchAsync<string>(cancellationToken: cts.Token);

StreamSnapshotRequest ChunkSize Type Change (#​1088)

StreamSnapshotRequest.ChunkSize changed from long to int? with a narrower validation range (1KB–1MB). WindowSize (int?) was added as a new optional property.

// Before (v2.7.2)
var req = new StreamSnapshotRequest { ChunkSize = 1024L };

// After (v2.7.3)
var req = new StreamSnapshotRequest
{
    ChunkSize = 1024,          // int? now, valid range: 1024–1048576
    WindowSize = 8388608,      // new optional, valid range: 1024–33554432
};

WindowSize requires NATS Server 2.12.5+.

OpenTelemetry Tag Change (#​1078)

The telemetry tag network.protocol.version (value: protocol version number) has been replaced with network.transport (value: "tcp") to align with OpenTelemetry semantic conventions. Update any dashboards or alerting rules that filter on the old tag name.

Default Parameter Values Changed from default to null (#​1081)

All optional parameters on INatsJSMsg<T> methods (AckAsync, NakAsync, AckProgressAsync, AckTerminateAsync, ReplyAsync) changed from = default to = null. This is source-compatible but binary-breaking — existing compiled assemblies must be recompiled against v2.7.3.

What's Changed

• Add more tests for JetStream consumer behavior by @​mtmk in #​1055
• Fix error logs URI rewritten by OnConnectingAsync by @​mtmk in #​1067
• Add slow consumer docs by @​mtmk in #​1073
• Add Synadia.Orbit.Testing.NatsServerProcessManager by @​mtmk in #​1065
• Add see-also references to Orbit packages by @​mtmk in #​1077
• Add validation for unsupported PinnedClient calls by @​mtmk in #​1063
• Add cancelled token handling for consumers by @​mtmk in #​1068
• Fix code analyzer warning by @​mtmk in #​1076
• Add TermWithReason support to AckTerminateAsync by @​mtmk in #​1048
• Add consumer info usage warnings by @​mtmk in #​1079
• Fix OTel network telemetry tags by @​mtmk in #​1078
• Rework TermWithReason by @​rickdotnet in #​1081
• Fix PingCommand cancellation by @​mtmk in #​1086
• Bump Microsoft.Bcl.Memory from 9.0.0 to 9.0.14 by @​dependabot[bot] in #​1089
• Add optional window_size parameter to StreamSnapshotRequest by @​darkwatchuk in #​1088
• Release 2.7.3 by @​mtmk in #​1090

Full Changelog: nats-io/nats.net@v2.7.2...v2.7.3

CVE Update

Microsoft.Bcl.Memory is a transitive dependency for netstandard2.0 targets any app pulling in NATS.Client.Core gets it. Even though this library doesn't call the vulnerable Base64Url.Decode API, the consuming application (or another dependency in its graph) might. A CVSSv3 7.5 DoS from a malformed network input is not something you want sitting in your dependency tree. (Microsoft CVE )

If you are not upgrading to this new version of NATS .NET AND targeting NETStandard2.0, applications should add an explicit package reference to force the patched version:

  <PackageReference Include="Microsoft.Bcl.Memory" Version="9.0.14" />

You don't need to upgrade NATS.NET itself to get the fix if you need time. NuGet will happily resolve the newer patch version of Microsoft.Bcl.Memory since it's within the same major.minor range.

Here is a report generated by AI:

NAT .NET library implementation is not affected by the same bug. Different vulnerability, different code.

The CVE is about an out-of-bounds read in System.Buffers.Text.Base64Url's decode path when processing malformed
input — that's a SIMD-optimized native implementation with pointer arithmetic that can overrun its buffer.

Your custom Base64UrlEncoder (borrowed from Azure AD IdentityModel):

• Decode path: Converts Base64Url chars back to standard Base64 chars (- → +, _ → /), pads with =, then delegates to
  Convert.FromBase64String(). The actual decoding is done by the framework's well-tested Convert.FromBase64String,
  which will throw FormatException on malformed input rather than reading out of bounds.
• Validates input length: Rejects length % 4 == 1 upfront (line 164), which is always invalid.
• Bounded loops: The unsafe code in UnsafeDecode only iterates up to str.Length and decodedLength (which is at most
  str.Length + 3), and the output string is allocated to exactly decodedLength.

The implementation is sound. It's not pretty (mutating "immutable" strings via fixed pointers is a hack), but it's
not vulnerable to the same class of bug.

Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.7.3

npgsql/npgsql (Npgsql)

v10.0.3

Release milestone

Full Changelog: npgsql/npgsql@v10.0.2...v10.0.3

v10.0.2

v10.0.2 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v10.0.1...v10.0.2

v10.0.1

v9.0.4 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v10.0.0...v10.0.1

v10.0.0

See the release notes.

The full list of changes is available here.

What's Changed

• STJ 9.0 alternative approach by @​NinoFloris in #​5941
• Remove support for net6.0 by @​roji in #​5947
• Some leftover cleanup for removing net6.0 by @​roji in #​5949
• Map date/time to DateOnly/TimeOnly by default by @​roji in #​5948
• Make the cidr<->IPNetwork mapping the default by @​roji in #​5950
• Fix connecting with VerifyCA and VerifyFull by @​vonzshik in #​5944
• Remove stopwatch allocations by @​vonzshik in #​5977
• Bump actions/setup-dotnet from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​5983
• Use exception convenience methods by @​bbowyersmyth in #​5982
• Bump actions/setup-dotnet from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6007
• Add support for postgresql type names with dots by @​dvas-hash in #​5971
• Send close_notify TLS alert on connection shutdown by @​vonzshik in #​5995
• Remove DisplayClass struct creation in PgReader by @​bbowyersmyth in #​6014
• Always dispose RemoteCertificate on SslStream by @​vonzshik in #​6022
• Remove LongRunningConnection field from NpgsqlConnector by @​vonzshik in #​6024
• Tighten SCRAM-SHA-256 SASL check by @​vonzshik in #​6023
• Add SHA3 hash algorithms for SASL authentication by @​vonzshik in #​6028
• Remove dotnet SDK version from CI (use global.json) by @​roji in #​6037
• Add support for specifying allowed auth methods by @​vonzshik in #​6036
• Migrate to SLNX by @​roji in #​6053
• Switch to Ubuntu 24.04 in CI by @​roji in #​6054
• Bump actions/setup-dotnet from 4.3.0 to 4.3.1 by @​dependabot[bot] in #​6059
• Add basic testing for tracing by @​vonzshik in #​6051
• parameter-collection Clone() should set correct collection instance by @​mgravell in #​6066
• Fix brew on mac CI by @​NinoFloris in #​6071
• Fix adding to hash lookup while renaming an unnamed parameter by @​vonzshik in #​6073
• Update LICENSE date (2024 -> 2025) by @​kurnakovv in #​6082
• Add tracing for physical connection open by @​vonzshik in #​6091
• Start testing on .NET 9 by @​vonzshik in #​5945
• Turn on by @​roji in #​6097
• Reenable public API analyzer by @​roji in #​6101
• Update Npgsql to .NET 9 by @​vonzshik in #​6099
• Ignore system CA store if root certificate is provided by @​vonzshik in #​6102
• Fix reading columns asynchronously via JsonNet plugin by @​vonzshik in #​6109
• Fixes #​6107 missed should buffer in biginteger numeric converter by @​NinoFloris in #​6117
• Fix logging parameters with batches by @​vonzshik in #​6079
• Implement GSSAPI session encryption by @​vonzshik in #​6131
• feat: add support for PGAPPNAME to set application name by @​michael-todorovic in #​6139
• Fix returning null from KerberosUsernameProvider.GetUsername with concurrent calls by @​vonzshik in #​6137
• Add NpgsqlTsVector.Empty by @​roji in #​6145
• Add assert to NpgsqlCommand.Transaction if it's completed by @​vonzshik in #​6151
• Compare normalized type names by @​0MG-DEN in #​6011
• Do CI testing for PG18 (beta) by @​roji in #​6155
• Fix infinite consume on error with connection break by @​vonzshik in #​6161
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​6174
• Fix concurrent NpgsqlDataSource.Dispose and Bootstrap by @​vonzshik in #​6116
• Set socket options before connecting to postgres by [@​vonzshik](https://redirect.github.co

✂ Note

PR body was truncated to here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud