Update dependency Microsoft.AspNetCore.OData to v9 - #3817
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/microsoft.aspnetcore.odata-9.x
branch
from
August 17, 2026 07:42
0fbbb30 to
2ff8804
Compare
renovate
Bot
force-pushed
the
renovate/microsoft.aspnetcore.odata-9.x
branch
from
August 26, 2026 17:12
2ff8804 to
93209c1
Compare
renovate
Bot
force-pushed
the
renovate/microsoft.aspnetcore.odata-9.x
branch
from
August 28, 2026 11:07
93209c1 to
e4f8f53
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.7.0→9.5.0Release Notes
OData/AspNetCoreOData (Microsoft.AspNetCore.OData)
v9.5.0Compare Source
AspNetCoreOData 9.5.0
Full changelog: OData/AspNetCoreOData@9.4.1...9.5.0
This release focuses on security hardening of query parsing, batch handling, and delta updates, along with several bug fixes and a new configurable safeguard.
🔒 Security
Prefer: maxpagesize=0(CWE-1284/CWE-770). A client-suppliedmaxpagesizeis now honored only when it is a positive integer, so the operator-configuredPageSizecan no longer be disabled to pull an entire collection in one response. Also hardens the header parser against a baremaxpagesizetoken that previously threw a 500. (4018c71)cast()chain depth in filter validation and binding. AddsMaxFunctionCallDepth(default 15) enforcement in both the validator and the binder to mitigate stack-pressure DoS from deeply nested$filterexpressions. (e9bf5dc)$1/../../../admin-style traversal), and have auth/identity/forwarding headers (Host,X-Forwarded-*,X-MS-Client-Principal-*,X-ARR-*, …) stripped via a deny-list. (491fb92)MaxReceivedMessageSizedefault (100 MB) (CWE-770) to prevent unbounded resource allocation. (#1574)$filter/$orderby/$apply. Open/dynamic property segments now bind only to model-declared properties (resolving EDM→CLR renames correctly), preventing unmodeled CLR properties from leaking. (5e3adee)SelectExpandWrapper. CLR properties excluded via[NotMapped]or.Ignore()no longer surface in$skiptokenvalues when ordering by an open-type property. (6f91036)UpdatablePropertiesallow-list for nested resources inDelta<T>. Removing a nested (complex / single-valued navigation) property fromUpdatablePropertiesis now respected byPatch()/Put(), closing an over-posting gap. Default behavior is unchanged. (4a192c4)✨ Enhancements
MaxFunctionCallDepthsetting to limit nested function-call depth, configurable viaODataValidationSettings,ODataQuerySettings, and the[EnableQuery]attribute. (#1575)🐛 Bug fixes
ConstantNode/BinaryOperatorNodeinstead of string concatenation), fixing ordering by nullable/non-nullable bool, enum, and open-type properties. (ec8da22)cast()toEdm.Stringbinding and add test coverage across all property types. (d92c39d)ODataOptions.TimeZonewas ignored; dates were always serialized usingTimeZoneInfo.Local. (#1546)v9.4.1Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@9.4.0...9.4.1
v9.4.0Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@9.3.1...9.4.0
v9.3.2Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@9.3.1...9.3.2
v9.3.1Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@9.3.0...9.3.1
v9.3.0Compare Source
What's Changed
ISearchQueryValidatorby @xuzhg in #1456AggregationBinderandComputeBinderfor extensibility by @gathogojr in #1457Full Changelog: 9.2.1...9.3.0
v9.2.1Compare Source
What's Changed
Obsoleteattribute toEdmDeltaResourceObjectandEdmDeltaComplexObjecttype by @gathogojr in #1436Full Changelog: 9.2.0...9.2.1
v9.2.0Compare Source
What's Changed
Full Changelog: 9.1.3...9.2.0
v9.1.3Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@9.1.2...9.1.3
v9.1.2Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@9.1.1...9.1.2
v9.1.1Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@9.1.0...9.1.1
v9.1.0Compare Source
What's Changed
await usingfor async disposal of message writer by @habbes in #1323a77ed76): Fix AutoExpand Issues with Capitalized $Expand System Query Options by @WanjohiSammy in #1309QueryNodetoSingleResourceCastNodefor Unquoted Type Parameter by @WanjohiSammy in #1313New Contributors
Full Changelog: OData/AspNetCoreOData@9.0.0...9.1.0
v9.0.0: ASP.NET Core OData 9.0.0Compare Source
Full Changelog: OData/AspNetCoreOData@9.0.0-rc.1...9.0.0
v8.3.1Compare Source
Fixes https://redirect.github.com/OData/AspNetCoreOData/issues/1483[: Regression with computed in $orderby with 'Could not find xxx property on xxx type] by @xuzhg
v8.3.0Compare Source
What's Changed
AggregationBinderandComputeBinderfor extensibility by @gathogojr in #1378EntitySetAggregationtests to mitigate issue causing tests to hang on AzDO by @gathogojr in #1460Full Changelog: 8.2.7...8.3.0
v8.2.7Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@8.2.6...8.2.7
v8.2.6Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@8.2.5...8.2.6
v8.2.5: ASP.NET Core OData 8.2.5Compare Source
What's Changed
GetNavigationSourceextension method by @habbes in #1159ODataPathExtensions.GetNavigationSourceby @habbes in #1161New Contributors
Full Changelog: OData/AspNetCoreOData@8.2.4...8.2.5
v8.2.4: ASP.NET Core OData 8.2.4Compare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/
What's Changed
$skiptokenenabled and$orderby=... descby @orty in #1054New Contributors
Full Changelog: OData/AspNetCoreOData@8.2.3...8.2.4
v8.2.3: ASP.NET Core OData 8.2.3Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@8.2.2...8.2.3
v8.2.2: ASP.NET Core OData 8.2.2 - DeprecatedCompare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.2.2
What's Changed
$expandwithout$selectand camel cased property names by @orty in #1024Full Changelog: OData/AspNetCoreOData@8.2.1...8.2.2
v8.2.1: ASP.NET Core OData 8.2.1 - DeprecatedCompare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.2.1
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@8.2.0...8.2.1
v8.2.0: ASP.NET Core OData 8.2.0Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@8.1.2...8.2.0
v8.1.2: ASP.NET Core OData 8.1.2Compare Source
What's Changed
Full Changelog: OData/AspNetCoreOData@8.1.1...8.1.2
v8.1.1: ASP.NET Core OData 8.1.1 (Deprecated)Compare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.1.1
What's Changed
Full Changelog: OData/AspNetCoreOData@8.1.0...8.1.1
v8.1.0: ASP.NET Core OData 8.1.0 (Deprecated)Compare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.1.0
Breaking changes
QuerySettingsinODataOptionsis changed to usingQueryConfigurationsof typeDefaultQueryConfigurationsWhat's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@8.0.12...8.1.0
v8.0.12: ASP.NET Core OData 8.0.12Compare Source
What's Changed
New Contributors
Full Changelog: OData/AspNetCoreOData@8.0.11...8.0.12
v8.0.11: ASP.NET Core OData 8.0.11Compare Source
https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.0.11
What has changed
ArgumentNullExceptionwhen callingAddODataNewtonsoftJsonby @xuzhg #589$select=*with actions and functions by @Nthemba #594ODataControllerhelper methods that returnODataErrorfor non-success responses by @KenitoInc #623ArgumentNullExceptionwhen on empty select/expand by @giulianob #621Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.