Bump the nuget-minor group with 17 updates

[dependabot]

Updated dotnet-ef from 10.0.9 to 10.0.10.

Release notes

Sourced from dotnet-ef's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.OpenIdConnect from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.OpenIdConnect's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.DataProtection.StackExchangeRedis from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.DataProtection.StackExchangeRedis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Bcl.Cryptography from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Bcl.Cryptography's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Caching.StackExchangeRedis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.Protocols's releases.

8.19.2

What's Changed

• Improve serializer and JWE key unwrap handling by @​iNinja in Improve serializer and JWE key unwrap handling AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3544

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.19.2

What's Changed

• Improve serializer and JWE key unwrap handling by @​iNinja in Improve serializer and JWE key unwrap handling AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3544

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.19.2

What's Changed

• Improve serializer and JWE key unwrap handling by @​iNinja in Improve serializer and JWE key unwrap handling AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3544

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

• Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) by @​nohwnd in Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) microsoft/vstest#16281

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

• Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @​nohwnd in feat: migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) microsoft/vstest#15687
  • For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/
• Create source-only filter package by @​Youssef1313 in Create source-only filter package microsoft/vstest#15638
• Add ARM64 msdia140.dll support to test platform packages by @​nohwnd in Cherry-pick: Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15692
• Fix mutex cleanup crash on macOS/Linux by @​nohwnd in Fix mutex cleanup crash on macOS/Linux microsoft/vstest#15684
• Restrict artifact temp directory permissions on Unix by @​nohwnd in Restrict artifact temp directory permissions on Unix microsoft/vstest#15729
• Add support for filtering uncategorized tests with TestCategory=None by @​Evangelink in Add support for filtering uncategorized tests with TestCategory=None microsoft/vstest#15727
• Fix SCI binding failure in DTA hosts (main) by @​nohwnd in Fix SCI binding failure in DTA hosts (main) microsoft/vstest#15724
• Fix HTML logger parallel file collision by @​nohwnd in [fix] Fix HTML logger parallel file collision microsoft/vstest#15435
• Improve error message when testhost cannot be found by @​nohwnd in [fix] Improve error message when testhost cannot be found microsoft/vstest#16053
• Fix HTML logger exception on invalid XML chars in test display names by @​nohwnd in [fix] Fix HTML logger exception on invalid XML chars in test display names microsoft/vstest#16051

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

• NuGet: OpenTelemetry v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Console v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.InMemory v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Zipkin v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Extensions.Hosting v1.17.0

  No notable changes.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

• NuGet: OpenTelemetry v1.17.0-rc.1

  • Fixed a metric point reclaim data race on CPU ARM architectures.
    (#​7401)

  • The library is now marked as trim and AOT compatible.
    (#​7441)

  • Replaced the vendored copy of
    EnvironmentVariablesConfigurationProvider with a direct
    Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
    Consumers gain automatic pickup of upstream bug fixes and security patches;
    no public API or behavioural change.
    (#​7146)

  • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
    when an activity is dropped because its local (in-process) parent is not
    recorded.
    (#​7427)

  • Added support for a Schema URL on Resource instances.
    (#​7472)

  • Fixed a metric storage leak that occurred when meters and instruments were
    repeatedly created and disposed.
    (#​7466)

  • Added ExcludedTagKeys property to MetricStreamConfiguration to support
    excluding specific tag keys from metric streams.
    (#​7373)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.17.0-rc.1

  • Fixed TraceContextPropagator to normalize empty tracestate header values
    to null when extracting trace context.
    (#​7407,
    #​7433)

  • The library is now marked as trim and AOT compatible.
    (#​7441)

  • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
    to read only the normalized environment variable name, following the updated
    environment variable carrier specification.
    Non-normalized carrier keys are no longer matched, even when they would
    normalize to the requested key.
    ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

• NuGet: OpenTelemetry v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Console v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.InMemory v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Zipkin v1.17.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Extensions.Hosting v1.17.0

  No notable changes.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

• NuGet: OpenTelemetry v1.17.0-rc.1

  • Fixed a metric point reclaim data race on CPU ARM architectures.
    (#​7401)

  • The library is now marked as trim and AOT compatible.
    (#​7441)

  • Replaced the vendored copy of
    EnvironmentVariablesConfigurationProvider with a direct
    Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
    Consumers gain automatic pickup of upstream bug fixes and security patches;
    no public API or behavioural change.
    (#​7146)

  • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
    when an activity is dropped because its local (in-process) parent is not
    recorded.
    (#​7427)

  • Added support for a Schema URL on Resource instances.
    (#​7472)

  • Fixed a metric storage leak that occurred when meters and instruments were
    repeatedly created and disposed.
    (#​7466)

  • Added ExcludedTagKeys property to MetricStreamConfiguration to support
    excluding specific tag keys from metric streams.
    (#​7373)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.17.0-rc.1

  • Fixed TraceContextPropagator to normalize empty tracestate header values
    to null when extracting trace context.
    (#​7407,
    #​7433)

  • The library is now marked as trim and AOT compatible.
    (#​7441)

  • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
    to read only the normalized environment variable name, following the updated
    environment variable carrier specification.
    Non-normalized carrier keys are no longer matched, even when they would
    normalize to the requested key.
    ... (truncated)

Commits viewable in compare view.

Updated System.IO.Hashing from 10.0.9 to 10.0.10.

Release notes

Sourced from System.IO.Hashing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.94%. Comparing base (e0a8208) to head (d1af1a5).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #474   +/-   ##
=========================================
  Coverage     77.94%   77.94%           
  Complexity     2246     2246           
=========================================
  Files           983      983           
  Lines         44400    44400           
  Branches       4158     4158           
=========================================
  Hits          34609    34609           
  Misses         7953     7953           
  Partials       1838     1838           

Flag	Coverage Δ
backend-dotnet	63.82% <ø> (ø)
gateway-yarp	96.05% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
backend · dotnet	63.82% <ø> (ø)
backend · elixir-phoenix	86.96% <ø> (ø)
backend · go	72.51% <ø> (ø)
backend · go-echo	66.46% <ø> (ø)
backend · grails	66.21% <ø> (ø)
backend · ktor-kotlin	79.67% <ø> (ø)
backend · micronaut-java	81.29% <ø> (ø)
backend · node-nestjs	77.55% <ø> (ø)
backend · node-ts	35.21% <ø> (ø)
backend · open-liberty-java	84.62% <ø> (ø)
backend · php-laravel	92.16% <ø> (ø)
backend · play-scala	93.09% <ø> (ø)
backend · python-django	87.14% <ø> (ø)
backend · python-fastapi	91.63% <ø> (ø)
backend · quarkus-java	82.77% <ø> (ø)
backend · ruby-rails	99.26% <ø> (ø)
backend · rust-axum	83.59% <ø> (ø)
backend · scala-http4s	83.87% <ø> (ø)
backend · spring-java	55.20% <ø> (ø)
backend · spring-kotlin	94.63% <ø> (ø)
frontend · angular	91.08% <ø> (ø)
frontend · astro	83.87% <ø> (ø)
frontend · lit	57.86% <ø> (ø)
frontend · qwik	91.75% <ø> (ø)
frontend · react	86.46% <ø> (ø)
frontend · solid	88.99% <ø> (ø)
frontend · svelte	84.02% <ø> (ø)
frontend · vanilla-ts	62.98% <ø> (ø)
frontend · vue	37.92% <ø> (ø)
gateway · apisix	69.06% <ø> (ø)
gateway · go	63.50% <ø> (ø)
gateway · node-fastify	92.55% <ø> (ø)
gateway · openresty	70.23% <ø> (ø)
gateway · python	92.31% <ø> (ø)
gateway · rust	87.71% <ø> (ø)
gateway · spring-cloud-gateway	95.05% <ø> (ø)
gateway · yarp	96.05% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kamkie]

Claude cross-review — Opus 4.8, medium effort

Verdict: Approve pending green CI. No blocking findings.

Triage:

• Mixed OpenTelemetry versions are expected: exporter/hosting/core moved to 1.17.0 while instrumentation packages remain at their requested 1.16.0 line.
• The IdentityModel transitive floor change is consistent with the direct 8.19.2 pins.
• Microsoft.TestPlatform.TestHost dropping Newtonsoft.Json is the expected vstest 18.8 migration.

No follow-up code changes are required. The regenerated locks are internally consistent; final readiness remains gated on the fresh hosted checks, including Vanilla TypeScript E2E.