deps: Bump the dotnet-microsoft group with 5 updates

[dependabot]

Updated Aspire.Hosting.AppHost from 13.4.5 to 13.4.6.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.4.6

What's New in Aspire 13.4.6

Patch release for Aspire 13.4 fixing polyglot AppHost code generation binding when CLI and SDK versions diverge, resource service port collision in --isolated mode, and a MongoDB.Driver dependency update.

🐛 Fixes

• 🔗 Polyglot AppHost code generation silently failed when CLI and SDK versions diverged — Aspire.TypeSystem used a floating strong-name AssemblyVersion that changed with every build. When the installed Aspire CLI was built at a different version than the AppHost's SDK, the CLR couldn't satisfy the strong-name bind and every code generator (TypeScript, Python, Java, Go, Rust) was silently dropped, surfacing as No code generator found for language: <lang>. The AssemblyVersion is now frozen at a stable constant so any compatible CLI/SDK pair on 13.4 binds successfully. Relates to #​18110 and #​17910. (#​18160, @​sebastienros)

• 🔌 Multiple AppHosts started with --isolated collided on the resource service port — Both instances tried to bind to the same fixed port from ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL, causing an "address already in use" error on the second instance. DashboardServiceHost now binds to port 0 on loopback when RandomizePorts is true (set by --isolated), letting the OS assign a unique port per instance. (#​18341, @​JamesNK)

• 🍃 MongoDB.Driver updated to 3.9.0 — Removes a wrongly pinned SharpCompress transitive dependency and uses the corrected Snappier transitive. Fixes #​17981. (#​18279, @​Falco20019)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.4.6 (#​18343)

---

Full Changelog: v13.4.5...v13.4.6

Full commit: 87fe259e4fc244c599019a7b1304c85a1488f248

Generated by Generate release notes for a new stable Aspire release · 131 AIC · ⌖ 13.5 AIC · ⊞ 37.4K

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 7.0.1 to 7.0.2.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.0.2

This update brings the following changes since the 7.0.1 release:

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.2
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.2
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2

Fixed

• Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
  (#​4372,#​4373)

• Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
  (#​4159,#​4206)

• Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
  (#​4339,#​4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#​4340,#​4358)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:
... (truncated)

Commits viewable in compare view.

Updated Microsoft.Identity.Client from 4.85.0 to 4.85.2.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.85.2

What's Changed

• Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) by @​Robbie-Microsoft in Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) AzureAD/microsoft-authentication-library-for-dotnet#6070
• Enforce mTLS PoP minimum binding strength for Managed Identity (#​6049 Phase 2) by @​Robbie-Microsoft in Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) AzureAD/microsoft-authentication-library-for-dotnet#6059
• Add refresh token cache partitioning support by @​iNinja in Add refresh token cache partitioning support AzureAD/microsoft-authentication-library-for-dotnet#6077
• Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) by @​Robbie-Microsoft in Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) AzureAD/microsoft-authentication-library-for-dotnet#6089

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.1...4.85.2

4.85.1

What's Changed

• Migrate OBO tests from old lab to ID4SLAB1 by @​RyAuld in Migrate OBO tests from old lab to ID4SLAB1 AzureAD/microsoft-authentication-library-for-dotnet#6021
• Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade by @​neha-bhargava in Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade AzureAD/microsoft-authentication-library-for-dotnet#6084
• Expose canonical tag names per-metric by @​ssmelov in Expose canonical tag names per-metric AzureAD/microsoft-authentication-library-for-dotnet#6076

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.0...4.85.1

Commits viewable in compare view.

Updated Microsoft.Identity.Client.Extensions.Msal from 4.85.0 to 4.85.2.

Release notes

Sourced from Microsoft.Identity.Client.Extensions.Msal's releases.

4.85.2

What's Changed

• Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) by @​Robbie-Microsoft in Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) AzureAD/microsoft-authentication-library-for-dotnet#6070
• Enforce mTLS PoP minimum binding strength for Managed Identity (#​6049 Phase 2) by @​Robbie-Microsoft in Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) AzureAD/microsoft-authentication-library-for-dotnet#6059
• Add refresh token cache partitioning support by @​iNinja in Add refresh token cache partitioning support AzureAD/microsoft-authentication-library-for-dotnet#6077
• Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) by @​Robbie-Microsoft in Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) AzureAD/microsoft-authentication-library-for-dotnet#6089

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.1...4.85.2

4.85.1

What's Changed

• Migrate OBO tests from old lab to ID4SLAB1 by @​RyAuld in Migrate OBO tests from old lab to ID4SLAB1 AzureAD/microsoft-authentication-library-for-dotnet#6021
• Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade by @​neha-bhargava in Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade AzureAD/microsoft-authentication-library-for-dotnet#6084
• Expose canonical tag names per-metric by @​ssmelov in Expose canonical tag names per-metric AzureAD/microsoft-authentication-library-for-dotnet#6076

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.0...4.85.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!