Bump Microsoft.AspNetCore.OData from 9.4.1 to 9.5.0

[dependabot]

Updated Microsoft.AspNetCore.OData from 9.4.1 to 9.5.0.

Release notes

Sourced from Microsoft.AspNetCore.OData's releases.

9.5.0

AspNetCoreOData 9.5.0

Full changelog: OData/AspNetCoreOData@9.4.1...9.5.0

This release focuses on security hardening of query parsing, batch handling, and delta updates, along with several bug fixes and a new configurable safeguard.

🔒 Security

• Prevent server-driven paging bypass via Prefer: maxpagesize=0 (CWE-1284/CWE-770). A client-supplied maxpagesize is now honored only when it is a positive integer, so the operator-configured PageSize can no longer be disabled to pull an entire collection in one response. Also hardens the header parser against a bare maxpagesize token that previously threw a 500. (4018c71)
• Bound nested function call and cast() chain depth in filter validation and binding. Adds MaxFunctionCallDepth (default 15) enforcement in both the validator and the binder to mitigate stack-pressure DoS from deeply nested $filter expressions. (e9bf5dc)
• Strengthen OData batch sub-request URL and header validation. Sub-requests are now validated for matching authority (scheme/host/port), constrained to the OData route prefix (blocking $1/../../../admin-style traversal), and have auth/identity/forwarding headers (Host, X-Forwarded-*, X-MS-Client-Principal-*, X-ARR-*, …) stripped via a deny-list. (491fb92)
• Set a bounded MaxReceivedMessageSize default (100 MB) (CWE-770) to prevent unbounded resource allocation. (#​1574)
• Enforce EDM model boundary for open-type property binding in $filter / $orderby / $apply. Open/dynamic property segments now bind only to model-declared properties (resolving EDM→CLR renames correctly), preventing unmodeled CLR properties from leaking. (5e3adee)
• Respect EDM model exclusions in SelectExpandWrapper. CLR properties excluded via [NotMapped] or .Ignore() no longer surface in $skiptoken values when ordering by an open-type property. (6f91036)
• Enforce the UpdatableProperties allow-list for nested resources in Delta<T>. Removing a nested (complex / single-valued navigation) property from UpdatableProperties is now respected by Patch()/Put(), closing an over-posting gap. Default behavior is unchanged. (4a192c4)

✨ Enhancements

• Add MaxFunctionCallDepth setting to limit nested function-call depth, configurable via ODataValidationSettings, ODataQuerySettings, and the [EnableQuery] attribute. (#​1575)

🐛 Bug fixes

• Build the skip-token filter as an OData AST to correctly handle malformed/unexpected token values (typed ConstantNode/BinaryOperatorNode instead of string concatenation), fixing ordering by nullable/non-nullable bool, enum, and open-type properties. (ec8da22)
• Fix cast() to Edm.String binding and add test coverage across all property types. (d92c39d)
• Fixes #​1545: ODataOptions.TimeZone was ignored; dates were always serialized using TimeZoneInfo.Local. (#​1546)

Commits viewable in compare view.

[dependabot]

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.