Bump bunit, ModelContextProtocol and StackExchange.Redis

[dependabot]

Updated bunit from 2.8.6 to 2.9.0.

Release notes

Sourced from bunit's releases.

2.9.0

Changed

• Update to stable package of AngleSharp.Css

Commits viewable in compare view.

Pinned ModelContextProtocol at 1.4.1.

Release notes

Sourced from ModelContextProtocol's releases.

1.4.1

This release backports a memory-leak fix for HTTP/SSE-based MCP servers. StreamableHttpServerTransport now releases its Server-Sent Events response stream reference as soon as a GET request ends, instead of holding it until the session is disposed via explicit DELETE or idle timeout. Long-lived SSE clients that disconnect without sending DELETE no longer pin the underlying Kestrel connection and its associated memory-pool buffers (~20 MiB per session), preventing the sustained memory growth that could accumulate under connect/disconnect churn.

What's Changed

• Release SSE response stream reference when GET request ends #​1628 by @​halter73 (co-authored by @​joelmforsyth @​Copilot)

Acknowledgements

• @​slomangino123 submitted issue #​766 (resolved by #​1628)

Full Changelog: modelcontextprotocol/csharp-sdk@v1.4.0...v1.4.1

1.4.0

v1.4.0 introduces support for the Identity Assertion Authorization Grant (ID-JAG) flow via the new IdentityAssertionGrantProvider, enabling enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider and access MCP servers without per-server authorization prompts. The release also adds a new InheritEnvironmentVariables option on StdioClientTransportOptions for controlling the child server's environment, alongside two security hardening fixes: the stdio client transport no longer enumerates child-process environment variables in Trace logs, and DELETE on a Streamable HTTP session now requires the same authenticated user that initiated the session.

What's Changed

• Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
• Add InheritEnvironmentVariables to StdioClientTransportOptions #​1563 by @​halter73 (co-authored by @​Copilot)
• Validate user on Streamable HTTP session DELETE #​1604 by @​halter73 (co-authored by @​Copilot)
  • HandleDeleteRequestAsync now mirrors the HasSameUserId check already enforced on GET and POST. A DELETE with a valid Mcp-Session-Id but a different authenticated user now returns 403 Forbidden instead of terminating the session — defense-in-depth against a leaked session ID being used to DoS the original owner.
• Add Enterprise Managed Authorization (SEP-990) support #​1305 by @​aniket-okta (backported in #​1625)
  • Adds IdentityAssertionGrantProvider and supporting option/response types in ModelContextProtocol.Authentication implementing the Identity Assertion Authorization Grant flow: RFC 8693 token exchange at the enterprise IdP (ID Token → JWT Authorization Grant) followed by RFC 7523 JWT bearer grant at the MCP authorization server (JAG → access token). See the new Cross-Application Access section in the transport docs for full usage details.

Documentation Updates

• Fix broken links to MCP Tasks specification #​1594 by @​tarekgh

Repository Infrastructure Updates

• Update release processes to support release servicing branches #​1620 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​aniket-okta made their first contribution in #​1305
• @​felixweinberger submitted issue #​949 (resolved by #​1305)
• @​eiriktsarpalis @​ericstj @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v1.3.0...v1.4.0

Commits viewable in compare view.

Pinned ModelContextProtocol at 2.1.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.1.0

This release adds an opt-in subscriptions/listen handler for custom server-side notification streams, improves HTTP transport fallback reliability, and expands guidance and samples for telemetry and binary resources.

What's Changed

• Keep AutoDetect channel open after provisional SSE failure #​1768 by @​PranavSenthilnathan
• Preserve HTTP status codes across target frameworks #​1767 by @​PranavSenthilnathan
• Fall back to initialize when server/discover fails at the HTTP layer #​1766 by @​rbstp
• Add public subscriptions/listen server handler (SEP-2575) #​1775 by @​tarekgh

Documentation Updates

• Add README for the InMemoryTransport sample #​1769 by @​AkbarDizaji
• Add Application Insights telemetry example #​1778 by @​lntutor
• Clarify client handling of embedded binary tool resources #​1762 by @​luisangelrod

Test Improvements

• Speed up CLI argument escaping tests #​1773 by @​PranavSenthilnathan

Repository Infrastructure Updates

• Clarify AI disclosure format with a > [!NOTE] alert example #​1771 by @​PranavSenthilnathan (co-authored by @​Copilot)
• Bump the npm_and_yarn group across 1 directory with 6 updates #​1787
• Avoid reading Configuration in Directory.Build.props #​1776 by @​lntutor
• Bump danielpalme/ReportGenerator-GitHub-Action from 5.5.10 to 5.5.11 #​1784

Acknowledgements

• @​AkbarDizaji made their first contribution in #​1769
• @​luisangelrod made their first contribution in #​1762
• @​rbstp submitted issue #​1765 (resolved by #​1766)
• @​TomasHubelbauer submitted issue #​1026 (resolved by #​1778)
• @​Youssef1313 submitted issue #​995 (resolved by #​1766)
• @​eng-marani submitted issue #​1261 (resolved by #​1762)
• @​jeffhandley @​tarekgh @​halter73 @​PranavSenthilnathan reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.0.0...v2.1.0

Commits viewable in compare view.

Updated StackExchange.Redis from 3.0.25 to 3.1.13.

Release notes

Sourced from StackExchange.Redis's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Superseded by #59.