Skip to content

[build] setup trusted publishing from Github to npmrc#17445

Merged
titusfortner merged 1 commit into
trunkfrom
trusted_npms
May 13, 2026
Merged

[build] setup trusted publishing from Github to npmrc#17445
titusfortner merged 1 commit into
trunkfrom
trusted_npms

Conversation

@titusfortner

Copy link
Copy Markdown
Member

NPMJS tokens have max expiration of 90 days which isn't useful in CI.

💥 What does this PR do?

  • Implements trusted publishing for npmjs
  • removes everything not needed any more

🔧 Implementation Notes

Most of the work actually done in npmjs.com our process should "just work" assuming id-token is set to write, which it is.

For verifying credentials, oidc uses ACTIONS_ID_TOKEN_REQUEST_URL which is injected by GitHub into a job when that job has been granted id-token: write permissions

@qodo-code-review

Copy link
Copy Markdown
Contributor

Review Summary by Qodo

Migrate npm publishing to OIDC trusted publishing

✨ Enhancement 📦 Other

Grey Divider

Walkthroughs

Description
• Removes token-based npm authentication in favor of OIDC trusted publishing
• Eliminates setup_npm_auth function and NODE_AUTH_TOKEN environment variable
• Updates credential validation to check for ACTIONS_ID_TOKEN_REQUEST_URL instead
• Simplifies release task by removing manual token setup for standard releases
Diagram
flowchart LR
  A["Token-based Auth<br/>NODE_AUTH_TOKEN"] -->|Remove| B["OIDC Trusted Publishing<br/>ACTIONS_ID_TOKEN_REQUEST_URL"]
  C["setup_npm_auth<br/>Function"] -->|Delete| D["Simplified Release Flow"]
  E["check_credentials<br/>Task"] -->|Update| F["Validate OIDC or .npmrc"]
Loading

Grey Divider

File Changes

1. rake_tasks/node.rake ✨ Enhancement +4/-20

Replace token auth with OIDC trusted publishing

• Removes setup_npm_auth function that handled token-based authentication
• Updates check_credentials task to validate ACTIONS_ID_TOKEN_REQUEST_URL instead of
 NODE_AUTH_TOKEN
• Removes setup_npm_auth call from release task for non-nightly releases
• Simplifies error message to reference npm trusted publishing

rake_tasks/node.rake


2. .github/workflows/bazel.yml ⚙️ Configuration changes +0/-1

Remove NODE_AUTH_TOKEN from workflow

• Removes NODE_AUTH_TOKEN secret from environment variables
• Keeps other authentication tokens for Maven, Python, Ruby, and NuGet

.github/workflows/bazel.yml


Grey Divider

Qodo Logo

@qodo-code-review

qodo-code-review Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (1)

Grey Divider


Action required

1. NODE_AUTH_TOKEN removed without deprecation 📘 Rule violation ⚙ Maintainability
Description
Support for publishing with NODE_AUTH_TOKEN was removed from the Node stable release flow
(including the prior setup_npm_auth/workflow-env style path) without any deprecation period or
warning pointing users to alternatives. This breaking behavior change can cause existing non-OIDC
release automation to fail credential validation unless it already uses GitHub OIDC trusted
publishing or a preconfigured ~/.npmrc.
Code

rake_tasks/node.rake[R61-66]

  npmrc = File.join(Dir.home, '.npmrc')
  has_file = File.exist?(npmrc) && File.read(npmrc).include?('//registry.npmjs.org/:_authToken=')
-  has_env = ENV.fetch('NODE_AUTH_TOKEN', nil) && !ENV['NODE_AUTH_TOKEN'].empty?
-  raise 'Missing npm credentials: set NODE_AUTH_TOKEN or configure ~/.npmrc' unless has_file || has_env
+  has_oidc = ENV.fetch('ACTIONS_ID_TOKEN_REQUEST_URL', nil) && !ENV['ACTIONS_ID_TOKEN_REQUEST_URL'].empty?
+  unless has_file || has_oidc
+    raise 'Missing npm credentials: configure ~/.npmrc via `npm login` or run via npm trusted publishing'
+  end
Evidence
PR Compliance ID 7 requires deprecating public functionality before removal and including a message
pointing to alternatives, but the updated node:check_credentials logic in rake_tasks/node.rake
no longer references or accepts NODE_AUTH_TOKEN, instead only recognizing credentials via a local
~/.npmrc or GitHub OIDC signals (for trusted publishing). In addition, the shared Bazel GitHub
Actions workflow no longer exports NODE_AUTH_TOKEN in the job environment, reinforcing that the
token-based path was removed from both the code and CI without a deprecation/migration phase;
together these citations show why callers relying on NODE_AUTH_TOKEN will now fail.

AGENTS.md
rake_tasks/node.rake[61-66]
.github/workflows/bazel.yml[89-97]
rake_tasks/node.rake[56-67]
rake_tasks/node.rake[69-88]
.github/workflows/bazel.yml[85-97]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Node stable release credential validation and CI workflow removed support for npm authentication via `NODE_AUTH_TOKEN`, but did not include a deprecation period or any explicit warning/guidance pointing users to the supported alternatives (GitHub OIDC trusted publishing or a preconfigured `~/.npmrc`). This is a breaking behavioral change for non-OIDC automation and for callers that previously relied on `NODE_AUTH_TOKEN` via workflow env or the removed `setup_npm_auth` path.

## Issue Context
Previously, release automation could authenticate to npm using `NODE_AUTH_TOKEN`. The current `node:check_credentials` logic now only accepts credentials from `~/.npmrc` or GitHub OIDC (presence of `ACTIONS_ID_TOKEN_REQUEST_URL`), and the reusable Bazel workflow no longer exports `NODE_AUTH_TOKEN` into the job env. PR Compliance ID 7 requires deprecating public functionality before removal and including a message pointing to alternatives, so the change needs either (a) a clear deprecation/migration message and documentation updates, or (b) a backwards-compatible credential fallback if the removal was unintended.

## Fix Focus Areas
- rake_tasks/node.rake[56-67]
- rake_tasks/node.rake[69-88]
- rake_tasks/node.rake[61-66]
- .github/workflows/bazel.yml[85-97]
- .github/workflows/bazel.yml[89-97]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

2. OIDC validation incomplete 🐞 Bug ☼ Reliability
Description
node:check_credentials treats the presence of ACTIONS_ID_TOKEN_REQUEST_URL alone as sufficient
to proceed, so credential validation can pass even when the OIDC environment is not actually usable,
deferring failure until the publish step. This makes stable JS releases fail later with
harder-to-diagnose npm auth errors.
Code

rake_tasks/node.rake[R61-66]

  npmrc = File.join(Dir.home, '.npmrc')
  has_file = File.exist?(npmrc) && File.read(npmrc).include?('//registry.npmjs.org/:_authToken=')
-  has_env = ENV.fetch('NODE_AUTH_TOKEN', nil) && !ENV['NODE_AUTH_TOKEN'].empty?
-  raise 'Missing npm credentials: set NODE_AUTH_TOKEN or configure ~/.npmrc' unless has_file || has_env
+  has_oidc = ENV.fetch('ACTIONS_ID_TOKEN_REQUEST_URL', nil) && !ENV['ACTIONS_ID_TOKEN_REQUEST_URL'].empty?
+  unless has_file || has_oidc
+    raise 'Missing npm credentials: configure ~/.npmrc via `npm login` or run via npm trusted publishing'
+  end
Evidence
The new credential check only looks for ACTIONS_ID_TOKEN_REQUEST_URL and uses that as the only
OIDC-based success condition for stable releases, without validating any other runtime
prerequisites.

rake_tasks/node.rake[56-67]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`node:check_credentials` currently considers OIDC available if `ACTIONS_ID_TOKEN_REQUEST_URL` is set. This is a weak signal and can lead to passing credential checks even when the runtime cannot actually mint/use an ID token, causing publish-time failures.

## Issue Context
Stable JS release uses `node:check_credentials` before running the Bazel publish target. With the PR’s changes, OIDC is now a primary/only non-file credential path.

## Fix Focus Areas
- Strengthen the OIDC detection by requiring all needed GitHub OIDC env vars (at minimum `ACTIONS_ID_TOKEN_REQUEST_URL` **and** `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) and optionally `GITHUB_ACTIONS == 'true'`.
- Improve the raised error message to explicitly state the requirement: either `~/.npmrc` has a registry token line **or** the workflow job must grant OIDC (e.g., `permissions: id-token: write`).

### Suggested code shape
- Compute `has_oidc_url = ENV['ACTIONS_ID_TOKEN_REQUEST_URL'].to_s != ''`
- Compute `has_oidc_token = ENV['ACTIONS_ID_TOKEN_REQUEST_TOKEN'].to_s != ''`
- Set `has_oidc = has_oidc_url && has_oidc_token`

## Fix Focus Areas (references)
- rake_tasks/node.rake[56-67]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

@selenium-ci selenium-ci added the B-build Includes scripting, bazel and CI integrations label May 13, 2026
Comment thread rake_tasks/node.rake
@titusfortner titusfortner merged commit fb062bc into trunk May 13, 2026
28 checks passed
@titusfortner titusfortner deleted the trusted_npms branch May 13, 2026 17:54
This was referenced Jun 16, 2026
PhilipWoulfe pushed a commit to PhilipWoulfe/F1Competition that referenced this pull request Jul 5, 2026
Updated
[coverlet.collector](https://github.com/coverlet-coverage/coverlet) from
10.0.0 to 10.0.1.

<details>
<summary>Release notes</summary>

_Sourced from [coverlet.collector's
releases](https://github.com/coverlet-coverage/coverlet/releases)._

## 10.0.1

### Improvements

- Coverlet with MTP 2 doesn't show test coverage statistic in console
[#​1907](https://github.com/coverlet-coverage/coverlet/issues/1907)
- Avoid unnecessary testhost restarts
[#​1912](https://github.com/coverlet-coverage/coverlet/issues/1912) by
<https://github.com/mawosoft>

### Fixed

- Fix inconsistent paths in cobertura reports
[#​1723](https://github.com/coverlet-coverage/coverlet/issues/1723)
- Fix when using "is" with "and" in pattern matching, branch coverage is
lower than normal
[#​1313](https://github.com/coverlet-coverage/coverlet/issues/1313)
- Fix Coverlet flagging a branch for an async functions finally block
where none exists
[#​1337](https://github.com/coverlet-coverage/coverlet/issues/1337)
- Fix Coverlet Tracker Missing CompilerGeneratedAttribute
[#​1828](https://github.com/coverlet-coverage/coverlet/issues/1828)

### Maintenance

- Add architecture docs and diagrams for all integrations
[#​1927](https://github.com/coverlet-coverage/coverlet/pull/1927)
- Update NuGet packages and .NET SDK versions
[#​1933](https://github.com/coverlet-coverage/coverlet/pull/1933)

[Diff between 10.0.0 and
10.0.1](https://github.com/coverlet-coverage/coverlet/compare/v10.0.0...v10.0.1)

Commits viewable in [compare
view](https://github.com/coverlet-coverage/coverlet/compare/v10.0.0...v10.0.1).
</details>

Updated
[coverlet.msbuild](https://github.com/coverlet-coverage/coverlet) from
10.0.0 to 10.0.1.

<details>
<summary>Release notes</summary>

_Sourced from [coverlet.msbuild's
releases](https://github.com/coverlet-coverage/coverlet/releases)._

## 10.0.1

### Improvements

- Coverlet with MTP 2 doesn't show test coverage statistic in console
[#​1907](https://github.com/coverlet-coverage/coverlet/issues/1907)
- Avoid unnecessary testhost restarts
[#​1912](https://github.com/coverlet-coverage/coverlet/issues/1912) by
<https://github.com/mawosoft>

### Fixed

- Fix inconsistent paths in cobertura reports
[#​1723](https://github.com/coverlet-coverage/coverlet/issues/1723)
- Fix when using "is" with "and" in pattern matching, branch coverage is
lower than normal
[#​1313](https://github.com/coverlet-coverage/coverlet/issues/1313)
- Fix Coverlet flagging a branch for an async functions finally block
where none exists
[#​1337](https://github.com/coverlet-coverage/coverlet/issues/1337)
- Fix Coverlet Tracker Missing CompilerGeneratedAttribute
[#​1828](https://github.com/coverlet-coverage/coverlet/issues/1828)

### Maintenance

- Add architecture docs and diagrams for all integrations
[#​1927](https://github.com/coverlet-coverage/coverlet/pull/1927)
- Update NuGet packages and .NET SDK versions
[#​1933](https://github.com/coverlet-coverage/coverlet/pull/1933)

[Diff between 10.0.0 and
10.0.1](https://github.com/coverlet-coverage/coverlet/compare/v10.0.0...v10.0.1)

Commits viewable in [compare
view](https://github.com/coverlet-coverage/coverlet/compare/v10.0.0...v10.0.1).
</details>

Updated
[Microsoft.AspNetCore.Components.Authorization](https://github.com/dotnet/aspnetcore)
from 8.0.27 to 8.0.28.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Components.Authorization's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 8.0.28

[Release](https://github.com/dotnet/core/releases/tag/v8.0.28)

## What's Changed
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66589
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66556
* [release/8.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66471
* [release/8.0] Update dependencies from dotnet/source-build-externals
by @​dotnet-maestro[bot] in
https://github.com/dotnet/aspnetcore/pull/66344
* [release/8.0] Strip UTF-8 BOM from template localization files and
remove version override by @​wtgodbe in
https://github.com/dotnet/aspnetcore/pull/66427
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66662


**Full Changelog**:
https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28).
</details>

Updated
[Microsoft.AspNetCore.Components.WebAssembly](https://github.com/dotnet/aspnetcore)
from 8.0.27 to 8.0.28.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Components.WebAssembly's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 8.0.28

[Release](https://github.com/dotnet/core/releases/tag/v8.0.28)

## What's Changed
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66589
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66556
* [release/8.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66471
* [release/8.0] Update dependencies from dotnet/source-build-externals
by @​dotnet-maestro[bot] in
https://github.com/dotnet/aspnetcore/pull/66344
* [release/8.0] Strip UTF-8 BOM from template localization files and
remove version override by @​wtgodbe in
https://github.com/dotnet/aspnetcore/pull/66427
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66662


**Full Changelog**:
https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28).
</details>

Updated
[Microsoft.AspNetCore.Components.WebAssembly.DevServer](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Components.WebAssembly.DevServer's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.AspNetCore.Http.Abstractions](https://github.com/dotnet/aspnetcore)
from 2.3.10 to 2.3.11.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Http.Abstractions's
releases](https://github.com/dotnet/aspnetcore/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/commits).
</details>

Updated
[Microsoft.AspNetCore.Mvc.Testing](https://github.com/dotnet/aspnetcore)
from 8.0.27 to 8.0.28.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Mvc.Testing's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 8.0.28

[Release](https://github.com/dotnet/core/releases/tag/v8.0.28)

## What's Changed
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66589
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66556
* [release/8.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66471
* [release/8.0] Update dependencies from dotnet/source-build-externals
by @​dotnet-maestro[bot] in
https://github.com/dotnet/aspnetcore/pull/66344
* [release/8.0] Strip UTF-8 BOM from template localization files and
remove version override by @​wtgodbe in
https://github.com/dotnet/aspnetcore/pull/66427
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66662


**Full Changelog**:
https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28).
</details>

Updated
[Microsoft.AspNetCore.OpenApi](https://github.com/dotnet/aspnetcore)
from 8.0.27 to 8.0.28.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.OpenApi's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 8.0.28

[Release](https://github.com/dotnet/core/releases/tag/v8.0.28)

## What's Changed
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66589
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66556
* [release/8.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in https://github.com/dotnet/aspnetcore/pull/66471
* [release/8.0] Update dependencies from dotnet/source-build-externals
by @​dotnet-maestro[bot] in
https://github.com/dotnet/aspnetcore/pull/66344
* [release/8.0] Strip UTF-8 BOM from template localization files and
remove version override by @​wtgodbe in
https://github.com/dotnet/aspnetcore/pull/66427
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/aspnetcore/pull/66662


**Full Changelog**:
https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/compare/v8.0.27...v8.0.28).
</details>

Updated
[Microsoft.EntityFrameworkCore](https://github.com/dotnet/efcore) from
9.0.16 to 9.0.17.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.EntityFrameworkCore's
releases](https://github.com/dotnet/efcore/releases)._

## 9.0.17

[Release](https://github.com/dotnet/core/releases/tag/v9.0.17)

## What's Changed
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/efcore/pull/38204
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38227
* Update branding to 9.0.17 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38228
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38230
* Merging internal commits for release/9.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38262
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38263
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38266


**Full Changelog**:
https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17

Commits viewable in [compare
view](https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17).
</details>

Updated
[Microsoft.EntityFrameworkCore.Design](https://github.com/dotnet/efcore)
from 9.0.16 to 9.0.17.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.EntityFrameworkCore.Design's
releases](https://github.com/dotnet/efcore/releases)._

## 9.0.17

[Release](https://github.com/dotnet/core/releases/tag/v9.0.17)

## What's Changed
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/efcore/pull/38204
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38227
* Update branding to 9.0.17 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38228
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38230
* Merging internal commits for release/9.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38262
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38263
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38266


**Full Changelog**:
https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17

Commits viewable in [compare
view](https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17).
</details>

Updated
[Microsoft.EntityFrameworkCore.InMemory](https://github.com/dotnet/efcore)
from 9.0.16 to 9.0.17.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.EntityFrameworkCore.InMemory's
releases](https://github.com/dotnet/efcore/releases)._

## 9.0.17

[Release](https://github.com/dotnet/core/releases/tag/v9.0.17)

## What's Changed
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/efcore/pull/38204
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38227
* Update branding to 9.0.17 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38228
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38230
* Merging internal commits for release/9.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38262
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38263
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38266


**Full Changelog**:
https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17

Commits viewable in [compare
view](https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17).
</details>

Updated
[Microsoft.EntityFrameworkCore.Relational](https://github.com/dotnet/efcore)
from 9.0.16 to 9.0.17.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.EntityFrameworkCore.Relational's
releases](https://github.com/dotnet/efcore/releases)._

## 9.0.17

[Release](https://github.com/dotnet/core/releases/tag/v9.0.17)

## What's Changed
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in https://github.com/dotnet/efcore/pull/38204
* Update branding to 8.0.28 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38227
* Update branding to 9.0.17 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38228
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38230
* Merging internal commits for release/9.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38262
* Merging internal commits for release/8.0 by @​vseanreesermsft in
https://github.com/dotnet/efcore/pull/38263
* [automated] Merge branch 'release/8.0' => 'release/9.0' by
@​github-actions[bot] in https://github.com/dotnet/efcore/pull/38266


**Full Changelog**:
https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17

Commits viewable in [compare
view](https://github.com/dotnet/efcore/compare/v9.0.16...v9.0.17).
</details>

Updated
[Microsoft.Extensions.Caching.Abstractions](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Caching.Abstractions's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.Binder](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.Binder's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated [Microsoft.Extensions.Hosting](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Hosting's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated [Microsoft.Extensions.Http](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Http's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Options.DataAnnotations](https://github.com/dotnet/dotnet)
from 10.0.8 to 10.0.9.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Options.DataAnnotations's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.IdentityModel.Tokens](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet)
from 8.18.0 to 8.19.1.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.IdentityModel.Tokens's
releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)._

## 8.19.1

## Bug Fixes
- Update `JwtSecurityTokenHandler` for
`IssuerSigningKeyResolverUsingConfiguration` to take priority over
`IssuerSigningKeyResolver`, matching the documented contract and the
correct behavior already present in `JsonWebTokenHandler`. See [PR
#​3519](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3519).

## 8.19.0

## New Features
- Add ML-DSA (FIPS 204) post-quantum signature support. See [PR
#​3479](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3479).
- Cache custom crypto providers in CryptoProviderFactory. See [PR
#​3489](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3489).

## Bug Fixes
- Disable automatic redirects on default HttpClient for JKU retrieval.
See [PR
#​3494](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3494).
- Adjust rented buffer handling in claim set parsing. See [PR
#​3493](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3493).
- Tidy null handling in SAML conditions validation. See [PR
#​3491](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3491).
- Improve validation of `jku` claim. See [PR
#​3481](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3481).
- Limit telemetry algorithm dimension cardinality. See [PR
#​3490](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3490).
- Add defensive copy of collections in ValidationParameters. See [PR
#​3492](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3492).
- Update TokenValidationParameter copy constructor to make a deep copy.
See [PR
#​3488](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3488).
- Update to fail-closed when replay protection isn't configured and
other DPoP hardening. See [PR
#​3505](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3505).
- Apply RFC 3986 section 6.2.2 normalization to DPoP `htu` comparison.
See [PR
#​3509](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3509).

Commits viewable in [compare
view](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/compare/8.18.0...8.19.1).
</details>

Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest)
from 18.5.1 to 18.7.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.NET.Test.Sdk's
releases](https://github.com/microsoft/vstest/releases)._

## 18.7.0

## What's Changed
* Add ARM64 msdia140.dll support to test platform packages by
@​jamesmcroft in https://github.com/microsoft/vstest/pull/15689
* Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in
https://github.com/microsoft/vstest/pull/15706

## New Contributors
* @​jamesmcroft made their first contribution in
https://github.com/microsoft/vstest/pull/15689

**Full Changelog**:
https://github.com/microsoft/vstest/compare/v18.6.0...v18.7.0

## 18.6.0

## What's Changed
* Revert removal of Video Recorder by @​nohwnd in
https://github.com/microsoft/vstest/pull/15336
* Speed up blame by filtering non-.NET processes from dump collection by
@​nohwnd in https://github.com/microsoft/vstest/pull/15518
* Add README.md to NuGet packages by @​nohwnd in
https://github.com/microsoft/vstest/pull/15550
* Report child process info on connection timeout by @​nohwnd in
https://github.com/microsoft/vstest/pull/15603


### Changes to tests and infra
* Brand as 18.6 by @​nohwnd in
https://github.com/microsoft/vstest/pull/15423
* Upgrading code coverage version to 18.5.1, by @​fhnaseer in
https://github.com/microsoft/vstest/pull/15422
* Updating System.Collections.Immutable to 9.0.11 by @​MSLukeWest in
https://github.com/microsoft/vstest/pull/15425
* Fix attachVS when used for debugging integration tests by @​nohwnd in
https://github.com/microsoft/vstest/pull/15451
* Replace dotnet.config, with global.json by @​nohwnd in
https://github.com/microsoft/vstest/pull/15449
* Document debugging integration tests with AttachVS by @​Copilot in
https://github.com/microsoft/vstest/pull/15452
* Fix stack overflow tests by @​nohwnd in
https://github.com/microsoft/vstest/pull/15461
* Make TestAssets.sln buildable locally by @​Youssef1313 in
https://github.com/microsoft/vstest/pull/15466
* Try filtering out tests by @​nohwnd in
https://github.com/microsoft/vstest/pull/15463
* Build just once when tfms run in parallel by @​nohwnd in
https://github.com/microsoft/vstest/pull/15465
* Review simplify compatibility sources, deduplicate tests by @​nohwnd
in https://github.com/microsoft/vstest/pull/15472
* Cleanup dead TRX code by @​Youssef1313 in
https://github.com/microsoft/vstest/pull/15474
* Update .NET runtimes to 8.0.25, 9.0.14, and 10.0.4 by @​nohwnd in
https://github.com/microsoft/vstest/pull/15481
* Compat matrix checker by @​nohwnd in
https://github.com/microsoft/vstest/pull/15480
* Add trx analysis skill by @​nohwnd in
https://github.com/microsoft/vstest/pull/15486
* Split integration tests to single tfm and multi tfm project by
@​nohwnd in https://github.com/microsoft/vstest/pull/15484
* Update matrix by @​nohwnd in
https://github.com/microsoft/vstest/pull/15477
* Break infinite restore loop in VS by @​nohwnd in
https://github.com/microsoft/vstest/pull/15503
* Use global package cache for build, and local for running integration
tests by @​nohwnd in https://github.com/microsoft/vstest/pull/15500
* Update contributing by @​nohwnd in
https://github.com/microsoft/vstest/pull/15505
* Reduce test wall-clock time by increasing minThreads by @​drognanar in
https://github.com/microsoft/vstest/pull/15502
* Indicator flakiness by @​nohwnd in
https://github.com/microsoft/vstest/pull/15513
* Fix ci build by @​nohwnd in
https://github.com/microsoft/vstest/pull/15515
* Fix thread safety issues by @​Evangelink in
https://github.com/microsoft/vstest/pull/15512
* Optimize DotnetSDKSimulation_PostProcessing test (163s → 61s) by
@​nohwnd in https://github.com/microsoft/vstest/pull/15516
* Build isolated test assets for single TFM instead of 7 by @​nohwnd in
https://github.com/microsoft/vstest/pull/15517
* Remove unused dependencies from Library.IntegrationTests by @​nohwnd
in https://github.com/microsoft/vstest/pull/15527
* Remove printing _attachments content to console by @​nohwnd in
https://github.com/microsoft/vstest/pull/15520
* Add Linux/macOS test filtering guide to CONTRIBUTING.md by @​nohwnd in
https://github.com/microsoft/vstest/pull/15521
* Change integration test parallelization from ClassLevel to MethodLevel
by @​nohwnd in https://github.com/microsoft/vstest/pull/15526
* Unify target framework checks with IsNetFrameworkTarget/IsNetTarget by
@​nohwnd in https://github.com/microsoft/vstest/pull/15523
* Add unattended work instructions to copilot-instructions.md by
@​nohwnd in https://github.com/microsoft/vstest/pull/15531
* Reduce code style rule severity from warning to suggestion by @​nohwnd
in https://github.com/microsoft/vstest/pull/15522
* Remove Debug/Release line number branching from tests by @​nohwnd in
https://github.com/microsoft/vstest/pull/15519
* Revise unattended work instructions in copilot-instructions.md by
@​nohwnd in https://github.com/microsoft/vstest/pull/15532
* Improve CompatibilityRowsBuilder error message with diagnostic details
by @​nohwnd in https://github.com/microsoft/vstest/pull/15529
* docs: add git worktree and upstream sync workflow to
copilot-instructions.md by @​nohwnd in
https://github.com/microsoft/vstest/pull/15538
* Add VSIX runner to smoke tests by @​nohwnd in
https://github.com/microsoft/vstest/pull/15541
* Remove deprecated WebTest and TMI test methods by @​nohwnd in
https://github.com/microsoft/vstest/pull/15525
* Fix compatibility test failures for legacy vstest.console and MSTest
adapter by @​nohwnd in https://github.com/microsoft/vstest/pull/15534
* Convert TestPlatform.sln to slnx format by @​nohwnd in
https://github.com/microsoft/vstest/pull/15551
* Convert test/TestAssets .sln files to .slnx format by @​nohwnd in
https://github.com/microsoft/vstest/pull/15557
 ... (truncated)

Commits viewable in [compare
view](https://github.com/microsoft/vstest/compare/v18.5.1...v18.7.0).
</details>

Updated [Selenium.Support](https://github.com/SeleniumHQ/selenium) from
4.44.0 to 4.45.0.

<details>
<summary>Release notes</summary>

_Sourced from [Selenium.Support's
releases](https://github.com/SeleniumHQ/selenium/releases)._

## 4.45.0

## Detailed Changelogs by Component

<img src="https://www.selenium.dev/images/programming/java.svg"
width="20" height="20">
**[Java](https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/python.svg" width="20"
height="20">
**[Python](https://github.com/SeleniumHQ/selenium/blob/trunk/py/CHANGES)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/dotnet.svg" width="20"
height="20">
**[DotNet](https://github.com/SeleniumHQ/selenium/blob/trunk/dotnet/CHANGELOG)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/ruby.svg" width="20"
height="20">
**[Ruby](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/javascript.svg"
width="20" height="20">
**[JavaScript](https://github.com/SeleniumHQ/selenium/blob/trunk/javascript/selenium-webdriver/CHANGES.md)**
<br>


<!-- Release notes generated using configuration in .github/release.yml
at selenium-4.45.0 -->

## What's Changed
* [build] derive PR diff base from HEAD^1 instead of trunk tip by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17438
* [build] setup trusted publishing from Github to npmrc by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17445
* [build] generate release notes from previous minor release tag by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17449
* [build] fix when to update lock files during the release process by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17450
* [java] remove deprecated logging classes by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17453
* [grid] Close pre-handshake race in WebSocket proxy by @​shs96c in
https://github.com/SeleniumHQ/selenium/pull/17435
* [JavaScript] Correct handling for older browsers and missing casing by
@​AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17451
* Use pyproject for Python runtime deps lock input by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17452
* [rb] deprecate curb http client support by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17443
* [javascript] Migrate find-elements atom from Closure to TypeScript by
@​AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17458
* [py] replace rules_python sphinxdocs with local sphinx_docs rule by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17461
* [build] Configure Renovate dashboard approval by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17464
* [js] update vulnerable dependency with a range by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17466
* [build] remove duplicated grid ui tests by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17468
* [build] update java graphpql dependency by filtering out bad reference
by @​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17469
* [rb] upgrade to steep 2.0 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17470
* [rust] update dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17472
* [build] update GitHub Actions to latest major versions by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17475
* [dotnet] update dev dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17474
* [dotnet] fix template caching by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17476
* [dotnet] update system.text.json to 8.0.6 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17477
* [js] update dev dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17479
* [dotnet] upgrade paket from v9 to v10 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17481
* [build] bump bazel version to 9.1 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17480
* [rust] update zip to v8 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17485
* [js] update eslint to v10 with fixes by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17482
* [rb] Update ruby to 3.3.9 by @​aguspe in
https://github.com/SeleniumHQ/selenium/pull/17484
* [dotnet] include snupkg files when packaging things up and allow the
use of sourcelink by @​AutomatedTester in
https://github.com/SeleniumHQ/selenium/pull/17467
* [build] update download-artifact to v8 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17493
* [dotnet] run format against slnx instead of looping csproj by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17483
* [build] bump low-risk Bazel module dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17494
* [rust] update reqwest to 0.13 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17488
* [dotnet] [build] Fix remote linkage in SourceLink by @​nvborisenko in
https://github.com/SeleniumHQ/selenium/pull/17495
* [build] remove renovate update requests pending work done in #​17427
by @​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17498
* [dotnet] [build] Support deterministic build output by @​nvborisenko
in https://github.com/SeleniumHQ/selenium/pull/17497
* [build] bump ruby versions to latest patch releases by @​titusfortner
in https://github.com/SeleniumHQ/selenium/pull/17496
* [js] remove npm dependency by using bazel for everything by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17499
* [build] bump rules_jvm_external by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17501
* [build] bump rules_closure version by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17500
* [build] clarify dependency pin and update tasks by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17463
* [build] simplify commit-changes workflow by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17503
 ... (truncated)

Commits viewable in [compare
view](https://github.com/SeleniumHQ/selenium/compare/selenium-4.44.0...selenium-4.45.0).
</details>

Updated [Selenium.WebDriver](https://github.com/SeleniumHQ/selenium)
from 4.44.0 to 4.45.0.

<details>
<summary>Release notes</summary>

_Sourced from [Selenium.WebDriver's
releases](https://github.com/SeleniumHQ/selenium/releases)._

## 4.45.0

## Detailed Changelogs by Component

<img src="https://www.selenium.dev/images/programming/java.svg"
width="20" height="20">
**[Java](https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/python.svg" width="20"
height="20">
**[Python](https://github.com/SeleniumHQ/selenium/blob/trunk/py/CHANGES)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/dotnet.svg" width="20"
height="20">
**[DotNet](https://github.com/SeleniumHQ/selenium/blob/trunk/dotnet/CHANGELOG)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/ruby.svg" width="20"
height="20">
**[Ruby](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)**
&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp;&nbsp;<img
src="https://www.selenium.dev/images/programming/javascript.svg"
width="20" height="20">
**[JavaScript](https://github.com/SeleniumHQ/selenium/blob/trunk/javascript/selenium-webdriver/CHANGES.md)**
<br>


<!-- Release notes generated using configuration in .github/release.yml
at selenium-4.45.0 -->

## What's Changed
* [build] derive PR diff base from HEAD^1 instead of trunk tip by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17438
* [build] setup trusted publishing from Github to npmrc by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17445
* [build] generate release notes from previous minor release tag by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17449
* [build] fix when to update lock files during the release process by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17450
* [java] remove deprecated logging classes by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17453
* [grid] Close pre-handshake race in WebSocket proxy by @​shs96c in
https://github.com/SeleniumHQ/selenium/pull/17435
* [JavaScript] Correct handling for older browsers and missing casing by
@​AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17451
* Use pyproject for Python runtime deps lock input by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17452
* [rb] deprecate curb http client support by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17443
* [javascript] Migrate find-elements atom from Closure to TypeScript by
@​AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17458
* [py] replace rules_python sphinxdocs with local sphinx_docs rule by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17461
* [build] Configure Renovate dashboard approval by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17464
* [js] update vulnerable dependency with a range by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17466
* [build] remove duplicated grid ui tests by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17468
* [build] update java graphpql dependency by filtering out bad reference
by @​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17469
* [rb] upgrade to steep 2.0 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17470
* [rust] update dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17472
* [build] update GitHub Actions to latest major versions by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17475
* [dotnet] update dev dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17474
* [dotnet] fix template caching by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17476
* [dotnet] update system.text.json to 8.0.6 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17477
* [js] update dev dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17479
* [dotnet] upgrade paket from v9 to v10 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17481
* [build] bump bazel version to 9.1 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17480
* [rust] update zip to v8 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17485
* [js] update eslint to v10 with fixes by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17482
* [rb] Update ruby to 3.3.9 by @​aguspe in
https://github.com/SeleniumHQ/selenium/pull/17484
* [dotnet] include snupkg files when packaging things up and allow the
use of sourcelink by @​AutomatedTester in
https://github.com/SeleniumHQ/selenium/pull/17467
* [build] update download-artifact to v8 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17493
* [dotnet] run format against slnx instead of looping csproj by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17483
* [build] bump low-risk Bazel module dependencies by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17494
* [rust] update reqwest to 0.13 by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17488
* [dotnet] [build] Fix remote linkage in SourceLink by @​nvborisenko in
https://github.com/SeleniumHQ/selenium/pull/17495
* [build] remove renovate update requests pending work done in #​17427
by @​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17498
* [dotnet] [build] Support deterministic build output by @​nvborisenko
in https://github.com/SeleniumHQ/selenium/pull/17497
* [build] bump ruby versions to latest patch releases by @​titusfortner
in https://github.com/SeleniumHQ/selenium/pull/17496
* [js] remove npm dependency by using bazel for everything by
@​titusfortner in https://github.com/SeleniumHQ/selenium/pull/17499
* [build] bump rules_jvm_external by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17501
* [build] bump rules_closure version by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17500
* [build] clarify dependency pin and update tasks by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17463
* [build] simplify commit-changes workflow by @​titusfortner in
https://github.com/SeleniumHQ/selenium/pull/17503
 ... (truncated)

Commits viewable in [compare
view](https://github.com/SeleniumHQ/selenium/compare/selenium-4.44.0...selenium-4.45.0).
</details>

Updated
[Serilog.Settings.Configuration](https://github.com/serilog/serilog-settings-configuration)
from 10.0.0 to 10.0.1.

<details>
<summary>Release notes</summary>

_Sourced from [Serilog.Settings.Configuration's
releases](https://github.com/serilog/serilog-settings-configuration/releases)._

## 10.0.1

## What's Changed
* Support LevelAlias names in configuration parsing by @​mohammed-saalim
in https://github.com/serilog/serilog-settings-configuration/pull/465
* Fix: Update ConditionalSink expression syntax in sample app by
@​gyurebalint in
https://github.com/serilog/serilog-settings-configuration/pull/470
* issue-468: Fix empty/whitespace string converting to array type by
@​gyurebalint-CID in
https://github.com/serilog/serilog-settings-configuration/pull/469
* Add WriteTo.FallbackChain and WriteTo.Fallible support in
configuration by @​ArieGato in
https://github.com/serilog/serilog-settings-configuration/pull/474
* Fix/issue 441 by @​gyurebalint in
https://github.com/serilog/serilog-settings-configuration/pull/471
* Support C# 13 params collections (IEnumerable<T>, List<T>) by
@​gyurebalint in
https://github.com/serilog/serilog-settings-configuration/pull/478

## New Contributors
* @​mohammed-saalim made their first contribution in
https://github.com/serilog/serilog-settings-configuration/pull/465
* @​gyurebalint made their first contribution in
https://github.com/serilog/serilog-settings-configuration/pull/470
* @​gyurebalint-CID made their first contribution in
https://github.com/serilog/serilog-settings-configuration/pull/469
* @​ArieGato made their first contribution in
https://github.com/serilog/serilog-settings-configuration/pull/474

**Full Changelog**:
https://github.com/serilog/serilog-settings-configuration/compare/v10.0.0...v10.0.1

Commits viewable in [compare
view](https://github.com/serilog/serilog-settings-configuration/compare/v10.0.0...v10.0.1).
</details>

Updated
[Swashbuckle.AspNetCore](https://github.com/domaindrivendev/Swashbuckle.AspNetCore)
from 10.1.7 to 10.2.3.

<details>
<summary>Release notes</summary>

_Sourced from [Swashbuckle.AspNetCore's
releases](https://github.com/domaindrivendev/Swashbuckle.AspNetCore/releases)._

## 10.2.3

## What's Changed

* Bump swagger-ui-dist to 5.32.7 by @​dependabot in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/4015

**Full Changelog**:
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/compare/v10.2.2...v10.2.3

## 10.2.2

## What's Changed

* Update NuGet packages by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3990
* Set `SOURCE_DATE_EPOCH` by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3997
* Fix `InvalidOperationException` if no route matches by
@​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3999
* Fix empty parameter example not generated by @​dldl-cmd in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3932
* Map `[MinLength]`/`[MaxLength]` on dictionary properties to
`minProperties`/`maxProperties` by @​KitKeen in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3922
* Fix conflicting required+nullable schema when only NonNullableReferen…
by @​KitKeen in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3912
* Fix `ExposeSwaggerDocumentUrlsRoute` behaviour by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/4000
* Use `NUGET_API_KEY` by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/4006

## New Contributors

* @​KitKeen made their first contribution in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3922

**Full Changelog**:
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/compare/v10.2.1...v10.2.2


## 10.2.1

## What's Changed

* Update Microsoft.OpenApi to 2.7.5 to pick up fix for
GHSA-v5pm-xwqc-g5wc by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3974

**Full Changelog**:
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/compare/v10.2.0...v10.2.1


## 10.2.0

## What's Changed

* Add `MapSwaggerUI` and `MapReDoc` to support endpoint routing by
@​Strepto in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3822
* Bump version to 10.2.0 by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3872
* Bump swagger-ui-dist from 5.32.1 to 5.32.2 by @​dependabot in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3883
* Support `HEAD` requests by @​snebjorn in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3887
* Use `IAsyncSwaggerProvider` in CLI `tofile` command by @​bt-Knodel in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3910
* Pin runner images by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3944
* Disable npm install scripts by @​martincostello in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3946
* Bump redoc from 2.5.2 to 2.5.3 by @​dependabot in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3967

## New Contributors

* @​Strepto made their first contribution in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3822
* @​snebjorn made their first contribution in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3887
* @​bt-Knodel made their first contribution in
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/pull/3910

**Full Changelog**:
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/compare/v10.1.7...v10.2.0

Commits viewable in [compare
view](https://github.com/domaindrivendev/Swashbuckle.AspNetCore/compare/v10.1.7...v10.2.3).
</details>

Updated
[System.IdentityModel.Tokens.Jwt](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet)
from 8.18.0 to 8.19.1.

<details>
<summary>Release notes</summary>

_Sourced from [System.IdentityModel.Tokens.Jwt's
releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)._

## 8.19.1

## Bug Fixes
- Update `JwtSecurityTokenHandler` for
`IssuerSigningKeyResolverUsingConfiguration` to take priority over
`IssuerSigningKeyResolver`, matching the documented contract and the
correct behavior already present in `JsonWebTokenHandler`. See [PR
#​3519](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3519).

## 8.19.0

## New Features
- Add ML-DSA (FIPS 204) post-quantum signature support. See [PR
#​3479](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3479).
- Cache custom crypto providers in CryptoProviderFactory. See [PR
#​3489](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3489).

## Bug Fixes
- Disable automatic redirects on default HttpClient for JKU retrieval.
See [PR
#​3494](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3494).
- Adjust rented buffer handling in claim set parsing. See [PR
#​3493](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3493).
- Tidy null handling in SAML conditions validation. See [PR
#​3491](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3491).
- Improve validation of `jku` claim. See [PR
#​3481](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3481).
- Limit telemetry algorithm dimension cardinality. See [PR
#​3490](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3490).
- Add defensive copy of collections in ValidationParameters. See [PR
#​3492](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3492).
- Update TokenValidationParameter copy constructor to make a deep copy.
See [PR
#​3488](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3488).
- Update to fail-closed when replay protection isn't configured and
other DPoP hardening. See [PR
#​3505](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3505).
- Apply RFC 3986 section 6.2.2 normalization to DPoP `htu` comparison.
See [PR
#​3509](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3509).

Commits viewable in [compare
view](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/compare/8.18.0...8.19.1).
</details>

Updated
[Testcontainers.PostgreSql](https://github.com/testcontainers/testcontainers-dotnet)
from 4.11.0 to 4.13.0.

<details>
<summary>Release notes</summary>

_Sourced from [Testcontainers.PostgreSql's
releases](https://github.com/testcontainers/testcontainers-dotnet/releases)._

## 4.13.0

# What's Changed

Thank you to everyone who contributed and shared their feedback 🤜🤛.

The NuGet packages for this release have been attested for supply chain
security using [`actions/attest`](https://github.com/actions/attest).
This confirms the integrity and provenance of the artifacts and helps
ensure they can be trusted:
[#​33686956](https://github.com/testcontainers/testcontainers-dotnet/attestations/33686956).

## 🚀 Features

* feat: Add Aspire dashboard module (#​1194) @​NikiforovAll
* feat: Add image name substitution hook (#​1710) @​HofmeisterAn
* feat(CosmosDb): Add get method AccountEndpoint (#​1707) @​srollinet
* feat: Improve image build failure messages (#​1700) @​HofmeisterAn

## 🐛 Bug Fixes

* fix: Restore tar archive write performance regressed by padding trim
(#​1719) @​HofmeisterAn
* chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
* chore(AspireDashboard): Cover connection string provider (#​1713)
@​HofmeisterAn

## 📖 Documentation

* docs: Add missing TC languages and reorder docs navigation (#​1711)
@​mdelapenya
* docs: Add note about unsupported BuildKit Dockerfile features (#​1696)
@​HofmeisterAn
* docs: Explain immutable builder behavior (#​1693) @​HofmeisterAn

## 🧹 Housekeeping

* chore: Enable Dependabot cooldown (#​1716) @​HofmeisterAn
* chore: Add nuget.config (#​1715) @​Rob-Hague
* chore(AspireDashboard): Cover connection string provider (#​1713)
@​HofmeisterAn
* chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
* chore: Bump sshd-docker image from 1.3.0 to 1.4.0 (#​1709)
@​HofmeisterAn
* chore: Rename runtime label and add buildkit and stale labels (#​1703)
@​HofmeisterAn
* fix: Guard expensive argument evaluation when logging (#​1702)
@​HofmeisterAn
* chore: Defer container ID truncation in logging (#​1701)
@​HofmeisterAn
* chore: Migrate to LoggerMessageAttribute (#​1697) @​HofmeisterAn

## 📦 Dependency Updates

* chore(deps): Bump the actions group with 2 updates (#​1721)
@[dependabot[bot]](https://github.com/apps/dependabot)
* chore(deps): Bump the actions group with 7 updates (#​1717)
@[dependabot[bot]](https://github.com/apps/dependabot)
* chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
* chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
* chore(deps): Bump the actions group with 4 updates (#​1698)
@[dependabot[bot]](https://github.com/apps/dependabot)


## 4.12.0

# What's Changed

Thanks to all contributors 👏.

The NuGet packages for this release have been attested for supply chain
security using [`actions/attest`](https://github.com/actions/attest).
This confirms the integrity and provenance of the artifacts and helps
ensure they can be trusted:
[#​28009236](https://github.com/testcontainers/testcontainers-dotnet/attestations/28009236).

## ⚠️ Breaking Changes

* chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665)
@​HofmeisterAn

## 🚀 Features

* feat: Add Floci module (#​1690) @​object
* feat: Ignore port-forwarding extra host in reuse hash (#​1689)
@​HofmeisterAn
* feat: Allow devs to override the reuse hash calculation (#​1688)
@​HofmeisterAn
* feat: Add connect to network API (#​1672) @​HofmeisterAn
* feat(LocalStack): Require auth token for 4.15 and onwards (#​1667)
@​HofmeisterAn
* chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665)
@​HofmeisterAn

## 🐛 Bug Fixes

* fix: Trim tar record padding to avoid broken-pipe failure on Podman
(#​1684) @​artiomchi
* fix(Nats): Use healthz API for readiness probe (#​1679) @​eriblo01
* fix: Remove KeepAlive socket option (#​1671) @​Angelinsky7

## 📖 Documentation

* docs: Extend WithCommand(params string[]) documentation (#​1685)
@​HofmeisterAn

## 🧹 Housekeeping

* feat: Prepare next release cycle (4.12.0) (#​1664) @​HofmeisterAn

## 📦 Dependency Updates

* chore(deps): Bump the actions group with 5 updates (#​1687)
@[dependabot[bot]](https://github.com/apps/dependabot)
* chore(deps): Bump Docker.DotNet from 4.1.0 to 4.2.0 (#​1686)
@​HofmeisterAn
* chore(deps): Bump the actions group with 5 updates (#​1676)
@[dependabot[bot]](https://github.com/apps/dependabot)
* chore(deps): Bump Docker.DotNet from 4.0.2 to 4.1.0 (#​1674)
@​HofmeisterAn
* chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665)
@​HofmeisterAn


Commits viewable in [compare
view](https://github.com/testcontainers/testcontainers-dotnet/compare/4.11.0...4.13.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

B-build Includes scripting, bazel and CI integrations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants