Bump the version-updates group with 9 updates

[dependabot]

Updated Asm.AspNetCore.Api from 5.0.13 to 5.0.17.

Release notes

Sourced from Asm.AspNetCore.Api's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Asm.OAuth from 5.0.13 to 5.0.17.

Release notes

Sourced from Asm.OAuth's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Asp.Versioning.Http from 10.0.1 to 10.2.1.

Release notes

Sourced from Asp.Versioning.Http's releases.

10.2.0

This release includes some big new features but is fully backward compatible with 10.0.0. The new features include versioned model member filtering, Roslyn analyzers, gRPC preview support, and a number of servicing patches since the previous release.

Fixes

All Platforms

• Parsing an API version whose status ends in '.' no longer succeeds silently
• Very large padding values in a format string no longer cause a stack overflow
• Incorrect lower and upper bounds when matching API version ranges
• Parsing a positive integer no longer allows whitespace or a leading '-'

ASP.NET Core

• Routes are no longer incorrectly evicted from the route table (#​1138)
• Fixed routing of unversioned endpoints
• Fixed extracting an API version that includes a status when versioning by URL segment (#​1187)
• A user-registered IProblemDetailsWriter is preserved by AddApiVersioning() (#​1191)

ASP.NET Core OpenAPI

• Support for more XML comment tags (#​1205)
• Fixed the error message reported for an unmapped JSON property
• Fixed descriptions applied to filtered members

Features

All Platforms

• New ApiVersionRange type for matching a set of API versions using the same interval notation as a package version
  • 1.0 → x ≥ 1.0
  • [1.0] → x == 1.0
  • (1.0,) → x > 1.0
  • (,1.0] → x ≤ 1.0
  • [1.0,2.0) → 1.0 ≤ x < 2.0
  • Multiple rules are combined as a logical or; ApiVersionRange.Any and ApiVersionRange.Empty are provided for
    the degenerate cases
  • A range matches API versions; it does not define them. API versions must still be explicitly declared
• New VisibleInApiVersionAttribute indicates the range of API versions a data member is visible in; for example,
  [VisibleInApiVersion("2.0")]
• New IAnnotation<TKey, TValue> abstraction for associating out-of-band metadata with a member
• [StringSyntax] is now applied to API version inputs so the IDE and analyzers understand them; the recognized
  syntaxes are ApiVersion, ApiVersionRange, and ApiVersionFormat

Analyzers

API Versioning now ships Roslyn analyzers. There is no new package to install — the core rules are packed into Asp.Versioning.Abstractions and the API rules are packed into Asp.Versioning.Http, so any application that already references API Versioning picks them up transitively.

There is an initial set of 31 rules. You can find all of the rule information in the new diagnostics wiki topic.

Notes:
... (truncated)

Commits viewable in compare view.

Updated Asp.Versioning.Mvc.ApiExplorer from 10.0.1 to 10.2.1.

Release notes

Sourced from Asp.Versioning.Mvc.ApiExplorer's releases.

10.2.0

This release includes some big new features but is fully backward compatible with 10.0.0. The new features include versioned model member filtering, Roslyn analyzers, gRPC preview support, and a number of servicing patches since the previous release.

Fixes

All Platforms

• Parsing an API version whose status ends in '.' no longer succeeds silently
• Very large padding values in a format string no longer cause a stack overflow
• Incorrect lower and upper bounds when matching API version ranges
• Parsing a positive integer no longer allows whitespace or a leading '-'

ASP.NET Core

• Routes are no longer incorrectly evicted from the route table (#​1138)
• Fixed routing of unversioned endpoints
• Fixed extracting an API version that includes a status when versioning by URL segment (#​1187)
• A user-registered IProblemDetailsWriter is preserved by AddApiVersioning() (#​1191)

ASP.NET Core OpenAPI

• Support for more XML comment tags (#​1205)
• Fixed the error message reported for an unmapped JSON property
• Fixed descriptions applied to filtered members

Features

All Platforms

• New ApiVersionRange type for matching a set of API versions using the same interval notation as a package version
  • 1.0 → x ≥ 1.0
  • [1.0] → x == 1.0
  • (1.0,) → x > 1.0
  • (,1.0] → x ≤ 1.0
  • [1.0,2.0) → 1.0 ≤ x < 2.0
  • Multiple rules are combined as a logical or; ApiVersionRange.Any and ApiVersionRange.Empty are provided for
    the degenerate cases
  • A range matches API versions; it does not define them. API versions must still be explicitly declared
• New VisibleInApiVersionAttribute indicates the range of API versions a data member is visible in; for example,
  [VisibleInApiVersion("2.0")]
• New IAnnotation<TKey, TValue> abstraction for associating out-of-band metadata with a member
• [StringSyntax] is now applied to API version inputs so the IDE and analyzers understand them; the recognized
  syntaxes are ApiVersion, ApiVersionRange, and ApiVersionFormat

Analyzers

API Versioning now ships Roslyn analyzers. There is no new package to install — the core rules are packed into Asp.Versioning.Abstractions and the API rules are packed into Asp.Versioning.Http, so any application that already references API Versioning picks them up transitively.

There is an initial set of 31 rules. You can find all of the rule information in the new diagnostics wiki topic.

Notes:
... (truncated)

Commits viewable in compare view.

Updated Azure.Core from 1.60.0 to 1.61.0.

Release notes

Sourced from Azure.Core's releases.

1.61.0

1.61.0 (2026-07-30)

Features Added

• Added AzureAuthorityHosts.AzureBleuCloud (https://login.sovcloud-identity.fr/), the Microsoft Entra authority host for Bleu Cloud, the national partner cloud for France. Interactive credentials' Authenticate methods now also resolve the default Azure Resource Manager scope for Bleu Cloud.

Bugs Fixed

• Fixed an issue where response content logging could emit more bytes than were actually read when a non-buffered (streaming) response was read into a buffer larger than the response body. Previously, when the read began at offset 0, the entire caller-supplied buffer was logged — including the bytes past the response payload, which for a pooled buffer contain unrelated in-process content — and the configured LoggedContentSizeLimit was not applied. The logging policy now logs only the bytes that were read. (#​61399)
• Fixed an issue where RequestFailedException could throw a secondary ArgumentNullException while formatting a failed response that had a text content-type header but an empty body, masking the actual service failure. The exception now preserves the original HTTP status, reason phrase, and headers, and no longer formats empty response content.
• Fixed AzureCliCredential to not pass both --tenant and --subscription flags to the Azure CLI, as the CLI rejects this combination. When a tenant is requested (for example, via challenge-based authentication) it now takes precedence and --subscription is omitted; --subscription is used only when no tenant is requested. (#​58949)

Other Changes

• Added azure-deprecating to the default list of allowed (non-redacted) headers in DiagnosticsOptions to support deprecating behavior notification.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.SpaProxy from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.AspNetCore.SpaProxy's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ApiDescription.Server from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Extensions.ApiDescription.Server's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Graph from 6.2.0 to 6.5.0.

Release notes

Sourced from Microsoft.Graph's releases.

6.5.0

6.5.0 (2026-08-05)

Features

• generation: update request builders and models (#​3161) (21e9e4e)

Bug Fixes

• ci: route NuGet version check through CFS (#​3162) (8c6b248)

6.4.0

6.4.0 (2026-07-21)

Features

• generation: update request builders and models (1688dbc)

6.3.0

6.3.0 (2026-07-10)

Features

• generation: update request builders and models (23ebe4d)
• generation: update request builders and models (9ce59b4)
• generation: update request builders and models (21088d5)

Bug Fixes

• ci: daily CI pipeline configuration (#​3136) (b6f4b45)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions