Skip to content

Update dependency Microsoft.AspNetCore.OData to v9 - #3817

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/microsoft.aspnetcore.odata-9.x
Open

Update dependency Microsoft.AspNetCore.OData to v9#3817
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/microsoft.aspnetcore.odata-9.x

Conversation

@renovate

@renovate renovate Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
Microsoft.AspNetCore.OData 7.7.09.5.0 age confidence

Release Notes

OData/AspNetCoreOData (Microsoft.AspNetCore.OData)

v9.5.0

Compare Source

AspNetCoreOData 9.5.0

Full changelog: OData/AspNetCoreOData@9.4.1...9.5.0

This release focuses on security hardening of query parsing, batch handling, and delta updates, along with several bug fixes and a new configurable safeguard.

🔒 Security

  • Prevent server-driven paging bypass via Prefer: maxpagesize=0 (CWE-1284/CWE-770). A client-supplied maxpagesize is now honored only when it is a positive integer, so the operator-configured PageSize can no longer be disabled to pull an entire collection in one response. Also hardens the header parser against a bare maxpagesize token that previously threw a 500. (4018c71)
  • Bound nested function call and cast() chain depth in filter validation and binding. Adds MaxFunctionCallDepth (default 15) enforcement in both the validator and the binder to mitigate stack-pressure DoS from deeply nested $filter expressions. (e9bf5dc)
  • Strengthen OData batch sub-request URL and header validation. Sub-requests are now validated for matching authority (scheme/host/port), constrained to the OData route prefix (blocking $1/../../../admin-style traversal), and have auth/identity/forwarding headers (Host, X-Forwarded-*, X-MS-Client-Principal-*, X-ARR-*, …) stripped via a deny-list. (491fb92)
  • Set a bounded MaxReceivedMessageSize default (100 MB) (CWE-770) to prevent unbounded resource allocation. (#​1574)
  • Enforce EDM model boundary for open-type property binding in $filter / $orderby / $apply. Open/dynamic property segments now bind only to model-declared properties (resolving EDM→CLR renames correctly), preventing unmodeled CLR properties from leaking. (5e3adee)
  • Respect EDM model exclusions in SelectExpandWrapper. CLR properties excluded via [NotMapped] or .Ignore() no longer surface in $skiptoken values when ordering by an open-type property. (6f91036)
  • Enforce the UpdatableProperties allow-list for nested resources in Delta<T>. Removing a nested (complex / single-valued navigation) property from UpdatableProperties is now respected by Patch()/Put(), closing an over-posting gap. Default behavior is unchanged. (4a192c4)

✨ Enhancements

  • Add MaxFunctionCallDepth setting to limit nested function-call depth, configurable via ODataValidationSettings, ODataQuerySettings, and the [EnableQuery] attribute. (#​1575)

🐛 Bug fixes

  • Build the skip-token filter as an OData AST to correctly handle malformed/unexpected token values (typed ConstantNode/BinaryOperatorNode instead of string concatenation), fixing ordering by nullable/non-nullable bool, enum, and open-type properties. (ec8da22)
  • Fix cast() to Edm.String binding and add test coverage across all property types. (d92c39d)
  • Fixes #​1545: ODataOptions.TimeZone was ignored; dates were always serialized using TimeZoneInfo.Local. (#​1546)

v9.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@9.4.0...9.4.1

v9.4.0

Compare Source

What's Changed

Full Changelog: OData/AspNetCoreOData@9.3.1...9.4.0

v9.3.2

Compare Source

What's Changed

  • Fixes #​1483: Regression with computed in $orderby with 'Could not find a property named xxx on ....' by @​xuzhg in #​1486

Full Changelog: OData/AspNetCoreOData@9.3.1...9.3.2

v9.3.1

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@9.3.0...9.3.1

v9.3.0

Compare Source

What's Changed

Full Changelog: 9.2.1...9.3.0

v9.2.1

Compare Source

What's Changed

Full Changelog: 9.2.0...9.2.1

v9.2.0

Compare Source

What's Changed

Full Changelog: 9.1.3...9.2.0

v9.1.3

Compare Source

What's Changed

  • Validate ODL Version in csproj against builder.versions.settings.targets and update ODataLibPackageDependency to 8.2.3 by @​WanjohiSammy in #​1389

Full Changelog: OData/AspNetCoreOData@9.1.2...9.1.3

v9.1.2

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@9.1.1...9.1.2

v9.1.1

Compare Source

What's Changed

Full Changelog: OData/AspNetCoreOData@9.1.0...9.1.1

v9.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@9.0.0...9.1.0

v9.0.0: ASP.NET Core OData 9.0.0

Compare Source

Full Changelog: OData/AspNetCoreOData@9.0.0-rc.1...9.0.0

v8.3.1

Compare Source

Fixes https://redirect.github.com/OData/AspNetCoreOData/issues/1483[: Regression with computed in $orderby with 'Could not find xxx property on xxx type] by @​xuzhg

v8.3.0

Compare Source

What's Changed

Full Changelog: 8.2.7...8.3.0

v8.2.7

Compare Source

What's Changed

Full Changelog: OData/AspNetCoreOData@8.2.6...8.2.7

v8.2.6

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.2.5...8.2.6

v8.2.5: ASP.NET Core OData 8.2.5

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.2.4...8.2.5

v8.2.4: ASP.NET Core OData 8.2.4

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.2.3...8.2.4

v8.2.3: ASP.NET Core OData 8.2.3

Compare Source

What's Changed

Full Changelog: OData/AspNetCoreOData@8.2.2...8.2.3

v8.2.2: ASP.NET Core OData 8.2.2 - Deprecated

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.2.2

What's Changed

Full Changelog: OData/AspNetCoreOData@8.2.1...8.2.2

v8.2.1: ASP.NET Core OData 8.2.1 - Deprecated

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.2.1

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.2.0...8.2.1

v8.2.0: ASP.NET Core OData 8.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.1.2...8.2.0

v8.1.2: ASP.NET Core OData 8.1.2

Compare Source

What's Changed

  • Add ODataNullValueExtensions and use it during serializer by @​xuzhg in #​901
  • Re-add the removed 'QuerySettings' to avoid breaking changes. by @​xuzhg in #​891

Full Changelog: OData/AspNetCoreOData@8.1.1...8.1.2

v8.1.1: ASP.NET Core OData 8.1.1 (Deprecated)

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.1.1

What's Changed

  • Fix skiptoken paging edge case where property is nullable on CLR type but not nullable on Edm type by @​gathogojr in #​881

Full Changelog: OData/AspNetCoreOData@8.1.0...8.1.1

v8.1.0: ASP.NET Core OData 8.1.0 (Deprecated)

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.1.0

Breaking changes

  1. QuerySettings in ODataOptions is changed to using QueryConfigurations of type DefaultQueryConfigurations

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.0.12...8.1.0

v8.0.12: ASP.NET Core OData 8.0.12

Compare Source

What's Changed

New Contributors

Full Changelog: OData/AspNetCoreOData@8.0.11...8.0.12

v8.0.11: ASP.NET Core OData 8.0.11

Compare Source

https://www.nuget.org/packages/Microsoft.AspNetCore.OData/8.0.11

What has changed

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file p: Lowest t: Task labels Aug 17, 2026
@renovate
renovate Bot enabled auto-merge August 17, 2026 00:52
@renovate
renovate Bot force-pushed the renovate/microsoft.aspnetcore.odata-9.x branch from 0fbbb30 to 2ff8804 Compare August 17, 2026 07:42
@renovate
renovate Bot force-pushed the renovate/microsoft.aspnetcore.odata-9.x branch from 2ff8804 to 93209c1 Compare August 26, 2026 17:12
@renovate
renovate Bot force-pushed the renovate/microsoft.aspnetcore.odata-9.x branch from 93209c1 to e4f8f53 Compare August 28, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file p: Lowest t: Task

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants