Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@types/node (source)	25.9.5 → 25.9.6			devDependencies	patch
@types/react (source)	19.2.18 → 19.3.0			devDependencies	minor
@types/react-dom (source)	19.2.5 → 19.3.0			devDependencies	minor
Microsoft.AspNetCore.Authentication.OpenIdConnect (source)	10.0.11 → 10.0.12			nuget	patch
Microsoft.Extensions.Hosting.Systemd (source)	10.0.11 → 10.0.12			nuget	patch
Microsoft.NET.Test.Sdk	18.9.0 → 18.10.0			nuget	minor
OpenIddict.Server.AspNetCore (source)	7.6.1 → 7.7.0			nuget	minor
Quartz (source)	3.20.0 → 3.21.0			nuget	minor	3.22.0
Quartz.Extensions.DependencyInjection (source)	3.20.0 → 3.21.0			nuget	minor	3.22.0
Quartz.Extensions.Hosting (source)	3.20.0 → 3.21.0			nuget	minor	3.22.0
dotnet-sdk	10.0.400 → 10.0.401			dotnet-sdk	patch
react (source)	19.2.8 → 19.3.0			dependencies	minor
react-dom (source)	19.2.8 → 19.3.0			dependencies	minor
vite (source)	8.2.2 → 8.3.0			devDependencies	minor

---

Release Notes

dotnet/dotnet (Microsoft.AspNetCore.Authentication.OpenIdConnect)

v10.0.12

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.10.0

What's Changed

• Drop Mono fallback, run .NET Framework tests on Windows only by @​nohwnd in #​16158
• Run Microsoft.Testing.Platform test apps under vstest.console and datacollector by @​nohwnd in #​16201
• Fix test output eaten by MSBuild terminal logger by @​nohwnd in #​16223
• Remove the experimental test session feature by @​nohwnd in #​16231
• Skip a single bad executor instead of failing all executor loading by @​nohwnd in #​16239
• Assert apartment state instead of using Clipboard in UI tests by @​nohwnd in #​16270
• Surface test host crashes during protocol negotiation by @​nohwnd in #​16285
• Pass the inferred target platform to the host in run settings by @​nohwnd in #​16271
• Report raw invalid IsTargetPlatformInferred value, cover host x64 forcing by @​nohwnd in #​16295
• Disable the MTP testhost by default (#​16337) by @​nohwnd in #​16341

Full Changelog: microsoft/vstest@v18.9.0...v18.10.0

openiddict/openiddict-core (OpenIddict.Server.AspNetCore)

v7.7.0

Compare Source

This release introduces the following changes:

• A vulnerability affecting the validation of audiences contained in client assertions by the OpenIddict server stack was identified earlier today (thanks @​x-redacted! ❤️) and fixed.

[!CAUTION]
Upgrading to OpenIddict 7.7 or 8.0 preview 4 is strongly advised. See GHSA-925x-4h4v-2792 for more information.

• On .NET 10 and higher, the OpenIddict.Quartz package now references the 4.0 version of Quartz.NET. See https://www.quartz-scheduler.net/documentation/quartz-4.x/migration-guide.html for more information about Quartz.NET 4.0.

[!IMPORTANT]
On .NET Framework and .NET Standard 2.0/2.1, the package keeps referencing the 3.x branch, as Quartz.NET 4.0 is only compatible with .NET 10 and higher.

• The aud claim in client assertions can now be represented as a JSON array, as allowed by the recent versions of the Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants specification.

• The OpenIddict.Client.WebIntegration package now supports JoinRpg (thanks @​leotsarev! ❤️)

• grant_type=urn:ietf:params:oauth:grant-type:device_code token requests that don't include a client identifier are now rejected earlier by the OpenIddict server stack.

• The net9.0-android, net9.0-ios, net9.0-maccatalyst and net9.0-macos target framework monikers are no longer supported by Microsoft and have been removed from the OpenIddict.Client.SystemIntegration package and the OpenIddict metapackage. Users of the OpenIddict.Client.SystemIntegration package are invited to migrate to .NET 10.0.

• All the .NET and third-party dependencies have been updated to their latest version.

• The System.Interactive.Async dependency (used only on .NET Framework and .NET Standard) was downgraded to 3.2.0 to fix a TypeLoadException that prevented using the OpenIddict Entity Framework Core 2.3 stores on .NET Framework after migrating to OpenIddict 7.6.0.

quartznet/quartznet (Quartz)

v3.21.0

Quartz.NET 3.21.0 carries the three fixes held back from 3.20.1 because each needed a small addition to the public surface or changed what a running scheduler does. All three were found while 4.0 was being finished; each is as old as 3.x. The public API grows by two interfaces on one class and nothing else; the schema is 3.20's. Three of the changes alter behaviour, each marked Behavior change worth noting below.

dotnet add package Quartz --version 3.21.0

What changed

• ResumeAll clears every paused trigger group, not only the ones with triggers — the persistent store resumed the groups it found in QRTZ_TRIGGERS and then deleted only its all-groups marker, so a group paused while it held no triggers kept its QRTZ_PAUSED_TRIGGER_GRPS row and went on pausing whatever was scheduled into it afterwards. Pausing a group before anything is scheduled into it is a documented use of the exact-name matcher, so this was a row the store wrote on purpose and could not take back. The trailing delete now takes every group, as RAMJobStore has always done. (#​3721, #​3742, port of f76b04a)
  • Behavior change worth noting: a group paused while empty no longer survives ResumeAll.
• A job store closes its lock handler when it shuts down — RedisSemaphore opened a ConnectionMultiplexer on the first lock and kept it, with its heartbeat, for the life of the process, because nothing on the store's shutdown path reached the lock handler and ISemaphore had no member that meant "we are done". On a branch that targets netstandard2.0 and net462 an interface cannot gain a default member, so JobStoreSupport.Shutdown now disposes a lock handler that implements IAsyncDisposable or IDisposable, after the misfire handler, the cluster manager and the connection manager have stopped, logging and continuing if that throws; RedisSemaphore implements both and closes the multiplexer it opened. (#​3721, #​3742, port of #​3639)
  • Behavior change worth noting: a custom ISemaphore that implements either interface is now disposed at shutdown.
• A configured wait longer than the platform's timer ceiling is refused where it is set — Task.Delay refuses anything longer than about 49.7 days on .NET and about 24.9 days on .NET Framework, with an ArgumentOutOfRangeException naming a parameter called delay, and every duration Quartz waits out that way was accepted unchecked and reported later from wherever the wait happened. MisfireHandlerFrequency, MisfireThreshold (when it is also the handler's sleep), ClusterCheckinInterval, DbRetryInterval, TransientRetryInterval, the row-lock handlers' RetryPeriod, StartDelayed's argument and QuartzHostedServiceOptions.StartDelay now name the setting, the ceiling and the value at configuration time. The ceiling is per target framework, held to what Task.Delay actually accepts by a test. (#​3721, #​3742, port of #​3577)
  • Behavior change worth noting: a value past the ceiling now fails at configuration rather than later.

Public API — additive only

• Quartz.Extensions.Redis: RedisSemaphore implements IAsyncDisposable and IDisposable.

Upgrading

dotnet add package Quartz --version 3.21.0. Nothing to migrate. The 4.0 line is the current major; the 4.x migration guide is the way there, and 4.0.1 made the upgrade one a dependency bot can offer.

Full changelog: quartznet/quartznet@v3.20.1...v3.21.0

v3.20.1

Quartz.NET 3.20.1 is a maintenance release: every change is a bug fix, the public API is untouched (the baselines did not move), and the schema is 3.20's. Most of it was found while 4.0 was being finished and rehearsed — a fix that turned out to be as old as 3.x was ported here rather than left on the newer line — and one item comes from a production application's 3.19.1 → 4.0 upgrade that also read on 3.x. Eight of the fixes change what a running scheduler does, each marked Behavior change worth noting below.

dotnet add package Quartz --version 3.20.1

What changed

Landed on the branch since 3.20.0:

• A DailyTimeIntervalTrigger stored through the default Newtonsoft path reads back again — TimeOfDay has no parameterless constructor, so with the trigger converters off (the default) EndTimeOfDay threw "Unable to find a constructor" and StartTimeOfDay silently read back as midnight. A converter scoped to TimeOfDay-typed members reads both forms; nothing about what is written changed, so every blob a released 3.20 wrote is one this reads. (9ee33fec17, fixes #​3508)
• A daily time interval trigger never fires before it starts — StartTimeUtc kept its milliseconds while the fire times are counted in whole seconds, so a start of 22:50:00.68 could produce a first fire at 22:50:00.000. Start and end are rounded down to the second when set, as CronTriggerImpl always did. (cc051a7788, #​3386)
• A trigger with nothing left to fire is finished however its last firing ended — a firing abandoned by a failing job listener, a veto or a shutdown left a one-shot trigger waiting for ever in RAMJobStore and as a permanent COMPLETE row in the ADO store. Both stores finish it now. (0af9431d3e, #​3507)
• The in-memory store applies the misfire policy of a trigger it unblocks — a trigger blocked behind a [DisallowConcurrentExecution] job is neither acquired nor swept, so the completion that unblocks it is the first thing that can settle its missed fire time; RAMJobStore now does what JobStoreSupport.RecoverUnblockedMisfires always did. (c9d8658a35, #​3463)
• Pausing a trigger no longer throws its error away — RAMJobStore wrote Paused over Error, so a failed trigger vanished from every listing once its group was paused and ResetTriggerFromErrorState had nothing to reset. It now pauses only what the ADO store pauses: waiting, acquired and blocked triggers. (a56a16ca0c)
  • Behavior change worth noting: 3.20.0's notes listed this among the store-parity alignments left off 3.x; it is on 3.x now.
• Rescheduling recomputes a fire time its new start time left behind — RescheduleJob advanced a never-fired repeating simple trigger's start time past a next fire time it kept, so it fired at the stale time and again at its start. (3e086091fc, #​3554)
• A trigger loaded beside its job by the XML processor is scheduled once, not twice — every such trigger was scheduled and then immediately rescheduled with overwrite-existing-data on, and a repeating trigger that starts now fired twice milliseconds apart. (f25080cef6, #​3554)
• Both serializers read a string dictionary written by the other — a Dictionary<string, string> job-data value written by the Newtonsoft package carried a $type the System.Text.Json reader handed back as an entry, and one written by System.Text.Json came back from Json.NET as a JObject. Both readers read both shapes; neither writer changed. (83ba80ce79, part of #​3582)
• Schema validation checks QRTZ_SIMPROP_TRIGGERS too — a database missing only that table passed validation and failed on the first calendar-interval, daily-time-interval or recurrence trigger insert. (b33c70487b, #​3564)
• The 3.20 index-alignment scripts name the 4.0 index script that supersedes them (4b3c43a90e); untagged builds from the branch say 3.20 (0e2f6bcf31); the XML scheduling integration test opens its own fixture's data source (4c07210199, #​3573).

Ported from 4.0:

• A job listener that throws before it returns no longer wedges the firing — a synchronous throw from JobToBeExecuted escaped as itself rather than the exception the run shell catches, so TriggeredJobComplete was never reached: the trigger stayed acquired and, for a [DisallowConcurrentExecution] job, every sibling trigger stayed blocked; the firing was also listed as executing for the life of the process. (port of #​3502)
• MySQL's misfire sweep reads the index that has the shape it needs — both misfire statements and the count every misfire pass starts with were forced onto IDX_QRTZ_T_NFT_ST_MISFIRE, whose second column is compared with <> and stops the seek dead. Measured on 4.x against 100,000 triggers: the count 111 ms → 0.7 ms, the sweep 66 ms → 0.7 ms. No schema change. (port of #​3608)
• A process that cannot load the job classes can edit their schedules — RescheduleJob and UpdateTriggerDetails on the ADO store resolved the job's class to decide whether the new trigger could run, and failed in an administration node without the assembly. Both read the job's two attribute flags from QRTZ_JOB_DETAILS now, so the decision is right without the class and a placeholder ITypeLoadHelper — which decided that question by whether the placeholder carried the attribute — is no longer needed. (port of #​3705)
• A transaction the database rolled back is retried whatever the driver calls it — SQLSTATE class 40 (40001, 40P01; 40002 excepted) is transient. Firebird reports a write conflict that way with IsTransient false, and MySql.Data its 1213 deadlock. (port of #​3454)
  • Behavior change worth noting: those failures are retried where they were treated as permanent.
• A persistent store refuses a repeat interval it cannot hold — a SimpleTrigger interval finer than a millisecond was stored as 0, read back as zero, and left the trigger in ACQUIRED for good behind a divide-by-zero the store logged and swallowed. It is refused on write now, naming the trigger and the column; RAMJobStore keeps accepting it. (port of #​3673)
  • Behavior change worth noting: storing such a trigger throws where it used to succeed and leave the trigger stuck; a trigger already stored with a zero interval is unaffected by this release.
• System.Text.Json refuses a job-data value it cannot read back — a List<string> or a nested object serialized happily and threw on the next read with the blob already in the database, and every later acquisition of the trigger failed on it. A value that would be stored as a JSON array, or as an object other than a Dictionary<string, string>, is refused before the first byte is written, naming the entry and its type. Anything stored as a number or a string — every numeric type, DateTime, Guid, byte[], Uri — still round-trips exactly as before. (port of #​3495)
  • Behavior change worth noting: such a value is a JsonSerializationException at store time, where it used to be a blob the next read failed on. The refusal also covers three shapes that did not throw before but never came back as themselves either — a non-generic Hashtable, an object whose properties are all strings, and a JobDataMap nested inside a JobDataMap — each of which the reader handed back as a Dictionary<string, string>. Store one of those as a string of your own making.
• A daily time interval trigger stops at its end time — an EndTimeUtc falling between two fire times of the same day let the trigger go on firing until the daily window closed, and FinalFireTimeUtc reported that close even when it was a day past the end. (port of the daily half of #​3458)
  • Behavior change worth noting: a trigger whose end time fell mid-window fires fewer times than on 3.20.
• NativeJob no longer deadlocks a child that writes more than a pipe buffer — both streams were redirected whether or not consumeStreams asked for them to be read, so with the defaults a chatty process blocked on its own write and the job's synchronous wait held a worker for ever. Nothing is redirected unless consumed. (port of the rc.1 fix)
• A connection that cannot join the ambient transaction is refused — EnlistConnection inside a TransactionScope took a Microsoft.Data.Sqlite connection on trust, and SQLite cannot enlist, so every statement committed on the spot and a rolled-back scope left the schedule behind. EnlistTransaction(DbTransaction) still works there. (port of the beta.1 fix)
• The misfire threshold instant itself is late, on every store — a trigger due at exactly now - MisfireThreshold was a misfire to RAMJobStore and to the ADO store's single-trigger path but not to its periodic sweep; the sweep says <= now and the acquisition predicate moved to > in step. (port of #​3462)
  • Behavior change worth noting: a trigger due at exactly that instant is swept as a misfire where the periodic sweep used to pass over it, so its misfire instruction now applies to it.
• A job-data number written with a decimal comma is unreadable, not a hundredfold of itself — "3,14" read as 314 from the floating-point accessors while GetInt threw. (port of the beta.1 fix)
  • Behavior change worth noting: GetDouble and GetFloat throw a FormatException for such a string where they used to answer a number a hundred times too large.
• A group matcher containing [ matches literally on SQL Server — T-SQL reads [ as a character class in LIKE; it is escaped on that dialect only, because the standard forbids escaping a non-wildcard elsewhere. (port of the rc.1 fix)
  • Behavior change worth noting: a matcher whose value contains [ matches the groups it names rather than the character class T-SQL read it as, so it can list, pause, resume or delete a different set than on 3.20.
• DirectoryScanJob stores its previous scan as something a job store can write — it kept a List<FileInfo> under [PersistJobDataAfterExecution], which System.Text.Json cannot write, so its first firing on such a store failed to persist. A legacy list already in a running scheduler is still read. (port of the rc.1 fix)
• DirectoryScanJob runs at all on 3.20 — it read its optional job-data keys with GetString, which throws for a key that is not there, so a job configured without a directory provider or listener name failed on every firing with KeyNotFoundException. Found while porting the previous item; the optional keys are asked for rather than read.
• SelectSchedulerStateRecords binds its parameters in statement order — only a provider with BindByName off could ever have noticed. (port of the alpha.3 fix)

Public API

Unchanged. No signature was added, altered or removed, and the PublicApiTest baselines did not move.

Upgrading

A drop-in upgrade from 3.20.0: no schema change, no configuration change, no migration script. Read the Behavior change worth noting bullets above — each is a case that used to be silently wrong and is now either correct or loud.

About the 4.0 line

Quartz.NET 4.0 was released on 2026-09-03. It targets net10.0 only; 3.x remains the line for netstandard2.0 and .NET Framework, and fixes that apply to both keep landing on both, which is what most of this release is. The migration guide is the map if you are considering the move.

Full changes: quartznet/quartznet@v3.20.0...v3.20.1

dotnet/sdk (dotnet-sdk)

v10.0.401

Compare Source

react/react (react)

v19.3.0

Compare Source

react/react (react-dom)

v19.3.0

Compare Source

vitejs/vite (vite)

v8.3.0

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Tuesday (* 0-6 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.