Skip to content

Bump Autofac from 4.8.0 to 9.3.2 - #2097

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/source/Calamari.Common/Autofac-9.3.2
Open

Bump Autofac from 4.8.0 to 9.3.2#2097
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/source/Calamari.Common/Autofac-9.3.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown

Updated Autofac from 4.8.0 to 9.3.2.

Release notes

Sourced from Autofac's releases.

9.3.2

What's Changed

  • Reduce registration cost incurred by scans for [ServiceKey] attribute by @​npease18 (#​1495, fixes #​1480)

New Contributors

Full Changelog: autofac/Autofac@v9.3.1...v9.3.2

9.3.1

What's Changed

Fix per-resolve closure allocation in resolve pipeline (#​1493) by @​tillig in autofac/Autofac#1494

Full Changelog: autofac/Autofac@v9.3.0...v9.3.1

9.3.0

What's Changed

Full Changelog: autofac/Autofac@v9.2.0...v9.3.0

9.2.0

What's Changed

Full Changelog: autofac/Autofac@v9.1.0...v9.2.0

9.1.0

This is a pretty big release for Autofac with some major new functionality!

AnyKey Support

First, Autofac now natively supports the concept of AnyKey. It behaves the same way AnyKey works in Microsoft.Extensions.DependencyInjection, but it is native to Autofac directly. The unit tests here show some very detailed examples of usage, but on a high level:

var builder = new ContainerBuilder();
builder.RegisterType<Service>().Keyed<IService>(KeyedService.AnyKey);

var container = builder.Build();

// Registering as AnyKey allows it to respond to... any key!
var service = container.ResolveKeyed<IService>("service1");

Inject Service Key Into Constructors

The new [ServiceKey] attribute allows you to inject the service key provided during resolution. This is handy in conjunction with AnyKey. Again, this is similar to the construct in Microsoft.Extensions.DependencyInjection, but with native Autofac.

First, mark up your class to take the constructor parameter.

public class Service : IService
{
  private readonly string _id;
  public Service([ServiceKey] string id) => _id = id;
}

Then when you resolve the class, the service key will automatically be injected.

You can also make use of this in a lambda registration.

var builder = new ContainerBuilder();
builder.Register<Service>((ctx, p) => {
  var key = p.TryGetKeyedServiceKey(out string value) ? value : null;
  return new Service(key);
}).Keyed<Service>(KeyedService.AnyKey);

Metrics

Some metrics have been introduced that can allow you to capture counters on how long middleware is taking, how often lock contention occurs, and so on.

Set the AUTOFAC_METRICS environment variable in your process to true or 1 to enable this feature. You can see the set of counters that will become available here.

⚠️ This is NOT FREE. Collecting counters and metrics will incur a performance hit, so it's not something you want to leave on in production.

... (truncated)

9.0.0

Updated Autofac for .NET 10. New current set of target frameworks: net10.0;net8.0;netstandard2.1;netstandard2.0

Breaking Changes

Dropped support for net6.0, net7.0.

Additional Changes

  • Added support for net10.0.
  • Updated dependencies:
    • System.Diagnostics.DiagnosticSource 8.0.1 => 10.0.0
    • Microsoft.Bcl.AsyncInterfaces 8.0.0 => 10.0.0

Full Changelog: autofac/Autofac@v8.4.0...v9.0.0

8.4.0

Minor breaking change: The shim RequiresUnreferencedCodeAttribute has been changed from public to internal (#​1462/#​1463 - thanks @​prochnowc!). This will only affect people targeting older/lower .NET standard frameworks who also rely on the shim attribute in Autofac. While it's technically breaking, it didn't seem like a great reason to do a full major release due to the edge case nature of the set of applications/users affected.

8.3.0

What's Changed

  • Corrected nullable markup on IIndex<K,V>.TryGetValue() since it may return null on failure.
  • Composite services can now be keyed (#​1458 - thanks @​syko9000!)
  • Packages for core Autofac are no longer published to MyGet. Instead, builds are now available from GitHub Packages This also means the actual packages themselves won't be manually attached to the release - you can get them from the package source now.

Full Changelog: autofac/Autofac@v8.2.1...v8.3.0

8.2.1

Fix #​1450: AutoActivate() no longer hides the default service registration. (Thanks, @​nblumhardt!)

8.2.0

What's Changed

  • Fix #​1437: Improve type cache handling for generic type arguments with respect to AssemblyLoadContext disposal (#​1438 - thanks @​hemirunner426!)
  • Added overloads for RegisterServiceMiddleware to assist with interceptors/decorators (#​1439 - thanks @​idiotsky!)

Full Changelog: autofac/Autofac@v8.1.1...v8.2.0

8.1.1

What's Changed

  • Fix boxing in ResolveRequest.operator==() (#​1430, thanks @​SergeiPavlov!)
  • Remove redundant null-checking in resolution extensions (#​1428, thanks @​SergeiPavlov!)
  • Fix #​1427: Ensure WithProperty registration methods consistently allow null values (#​1428)

Full Changelog: autofac/Autofac@v8.1.0...v8.1.1

8.1.0

What's Changed

  • Optimized required member caching (#​1415 - thanks @​SergeiPavlov!)
  • Correctly handle polyfilled required infrastructure attributes by (#​1421 - thanks @​DoctorVanGogh!)
  • Improve memory management in registered services tracking (#​1423 - thanks @​snaumenko-st!)
  • Fix #​1330: Generic decorators attached to generics that expose multiple service types should be handled properly (#​1424)

Full Changelog: autofac/Autofac@v8.0.0...v8.1.0

8.0.0

Breaking Changes

  • Removed netcoreapp3.1 support/testing (#​1401).
  • Converted ResolveRequest into a readonly struct (#​1397 - thanks @​SergeiPavlov!).

Additional Changes

  • Added net8.0 target (#​1401).
  • Replaced use of Moq in tests with NSubstitute (#​1390 - thanks @​aydjay!).

Full Changelog: autofac/Autofac@v7.1.0...v8.0.0

7.1.0

What's Changed

  • Fix #​1388: Re-enabled RegsiterTypes filtering. This was an accidental behavior regression where the RegisterTypes method wouldn't filter out non-registerable types.
  • RegisterType<T> and RegisterType(Type t) will now throw when non-registerable types are provided, for example containerBuilder.RegisterType<IInterface>() (you can't register interfaces - you can register things As<IInterface>). This used to throw at container build time; now it throws at RegisterType time and it has a more precise error message so you can handle these issues more proactively.

Full Changelog: autofac/Autofac@v7.0.1...v7.1.0

7.0.1

What's Changed

  • Reduced lock contention in LifetimeScope.CreateSharedInstance (thanks @​botinko)
  • Optimized Autofac.Features.OpenGenerics.OpenGenericServiceBinder.TryBindOpenGenericTypedService (thanks @​SergeiPavlov)

Full Changelog: autofac/Autofac@v7.0.0...v7.0.1

7.0.0

Version 7.0.0 is a major increment due to some changes in the target frameworks and some behavioral changes. We summarize these in the documentation, but included here as well:

New Features

  • Properties marked required will now be injected by default. As part of this, the default property injector using PropertiesAutowired() will not inject properties marked required. The documentation has more explanation with examples.
  • Ability to isolate AssemblyLoadContext by lifetime scope. A new method, BeginLoadContextLifetimeScope, has been added that allows you to create a lifetime scope tied to a specific AssemblyLoadContext. When the scope is disposed, Autofac will perform a best-effort release of all references to types from that context so the assemblies can be unloaded. The documentation explains this in greater detail.
  • Documentation links in exception messages. Common Autofac exceptions now include links to our online documentation to help you understand what the exceptions mean and how to troubleshoot them.

Issues and PRs

Full Changelog: autofac/Autofac@v6.5.0...v7.0.0

Breaking Changes

  • net50 no longer targeted. Autofac will still work with .NET 5 via the netstandard2.1 target, but we recommend you upgrade to a later, supported version of .NET.
  • Properties marked required will now be injected by default. As noted above, required properties will be injected. This is a behavioral change from Autofac 6.0.
  • Default property injection ignores required properties. Using PropertiesAutowired() will ignore required properties because it's assumed they must be set during construction rather than post-object-creation.
  • RegisterGeneratedFactory is obsolete. This feature has been replaced by the Func<X, Y, B> built-in relationship and delegate factories.
  • ILifetimeScope has a new BeginLoadContextLifetimeScope method. If you have mocks of ILifetimeScope this method must now be implemented.

6.5.0

  • Reflection caches have moved to a central location Autofac.Core.ReflectionCacheSet (#​1341). This is part of an effort to support unloading AssemblyLoadContexts associated with child scopes and enable better plugin support (#​1324).
  • IDecoratorContext now extends IComponentContext so decorator decisions can be made based on the constructed container (#​1338, #​1352).
  • Fix memory leak regression (#​1353 - Thanks @​botinko!)

Full Changelog: autofac/Autofac@v6.4.0...v6.5.0

6.4.0

  • Fix typos in exception messages (#​1301, #​1302, #​1323)
  • Enable open generic assembly scanning to use WithMetadata and generate metadata (#​1299 - thanks @​romerod!)
  • Package targets .NET 6 TFM (#​1306)
  • README included in NuGet package (#​1295, #​1308)
  • Symbols published in .snupkg format (#​995, #​1309)
  • Fix issue where changing type parameter names caused generic resolution to fail (#​1315, #​1316)
  • Added generic delegates to make registering lambda components easier (#​1320, #​1321)
  • Optimization of reflection activation for components that only have one constructor - specifically, if there is only one constructor on a component, that constructor is cached as the one for activation and IConstructorSelector invocation is skipped (#​1325)

The new feature to be aware of here is the generic delegates for making lambda registrations easier (#​1320, #​1321). It makes resolving dependencies in lambdas more straightforward.

The old way meant injecting an IComponentContext and resolving the dependencies manually.

builder.Register(
  ctx =>
  {
    var dep1 = ctx.Resolve<IDependency1>();
    var dep2 = ctx.Resolve<IDependency2>();
    return new Component(dep1, dep2, "configuration-value");
  });

That old way still works and is not deprecated. You can keep doing that.

However, you can now skip the manual resolutions and just provide the dependencies as the parameters to the lambda:

builder.Register(
  (IDependency dep1, IDependency dep2) =>
    new Component(dep1, dep2, "configuration-value"));

If you need both the context and dependencies for advanced cases, you can do that, too.

builder.Register(
  (IComponentContext ctx, IDependency dep1) =>
  {
    var dep2 = ctx.Resolve<IDependency2>(new NamedParameter("p", "someValue"));
    new Component(dep1, dep2, "configuration-value");
  });

6.3.0

  • Modules can now be registered conditionally using an OnlyIf clause. (#​1235, #​1272)
  • Delegate factories will no longer allow parameters with the name value to inject by name as that's a reserved word in property setter methods. (#​1275)
  • IAsyncDisposable instances that have not been activated are correctly disposed when the scope is disposed. (#​1285)
  • There are now generic overloads for TryResolveNamed and TryResolveKeyed. (#​1263, #​1287 - thanks @​v0idzz!)
  • Fixed performance regression in assembly scanning with respect to compiler generated types. (#​1289 - thanks @​RogerKratz!)

6.2.0

Resolved issues / PRs:

  • #​215: You can now use RegisterAssemblyOpenGenericTypes to do assembly scanning and register open generics! (#​1232 / #​1246)
  • #​1211: Added ConfigurePipeline to IComponentRegistration to allow easier registration pipeline modification (related to #​1211)
  • #​1238: Static and constructors are no longer considered for reflection (#​1239)
  • #​1252: Behavior of ConcurrentBag on different platforms resulted in a memory leak in OnActivated usage; we now flush the ConcurrentBag of registrations on disposal of a lifetime scope (#​1257)

6.1.0

  • Added direct support for .NET 5.
  • Internals update to allow more dynamic reconfiguration of resolve pipelines.
  • Fix #​1204: Decorated instances marked with AllowCircularDependencies should now get properties injected correctly.
  • Fix #​1226: Constructor binders correctly detect ref parameters.

6.0.0

Version 6.0.0 represents a major update in the Autofac internals. While every effort has been made to ensure code using version 5.x will continue to work exactly as you expect, you should be aware of the breaking changes and test things out. For the majority case, things should just continue to work; breaking changes are primarily in more rare advanced usage scenarios.

Check out the release blog post! Also, the documentation has been updated and is ready!

⚠️ Starting with Autofac 6.0, we now only target netstandard20 and netstandard21; we have removed the explicit target for net461.

The impact to you is that, while Autofac will still work on .NET Framework 4.6.1 as it did before, we strongly encourage you to upgrade to .NET Framework 4.7.2 or higher, as per the .NET Standard Documentation, to avoid any of the known dependency issues when using .NET Standard packages in .NET Framework 4.6.1.

New Features

There are a lot of new features, but the big ones are here. Other features and fixes will be outlined in the Issues section, below.

Issues and PRs

The following issues have been addressed in v6:

  • #​718: Circular dependency support using property injection and relationships like Lazy<T> should now work.
  • #​788: DOT graph support has been added via the Autofac.Diagnostics.DotGraph package.
  • #​798 / #​1148: Circular dependency handling uses the .NET runtime to check stack depth when checking for circular dependencies rather than using a fixed stack depth.
  • #​828: The ILifetimeScope.LifetimeScopeEnding event is raised and completes before the scope is disposed.
  • #​970: The composite pattern is now supported.
  • #​1069 / #​1172: Core Autofac events are now async-friendly.
  • #​1120 / #​1128: ContainerBuilder is now sealed.
  • #​1123: Explicitly injected properties can now be declared using an expression.
  • #​1126 / #​1169: Diagnostics are handled via DiagnosticSource.
  • #​1162: A new "pooled" lifetime type has been added via the Autofac.Pooling package.

Breaking Changes

We'll do our best to keep an upgrade guide with breaking changes available and up to date. We're pretty sure we caught them all, but if you find a gotcha, let us know on the Documentation repo.

A summary of the breaking changes is as follows:

  • net461 is no longer targeted; Autofac now targets netstandard2.0 and netstandard2.1.
  • Activation events are no longer exposed - this all happens through middleware now.
    • If you were using an Autofac module to attach to activation events and inject parameters, similar to the way the log4net module example is shown in the documentation, this now needs to happen through middleware. The log4net module example has been updated to show you the new way it works.
    • RegistrationBuilder.RegistrationData no longer exposes activation handlers. The CoreEventMiddleware is the source of events now.
    • IComponentRegistration no longer exposes activation events. The CoreEventMiddleware is the source of events now.
  • Interface changes:
    • IConstructorSelector implementations need to switch to use BoundConstructor instead of ConstructorParameterBinding.
    • IRegistrationSource implementations need to update the RegistrationsFor method signature.
    • IInstanceActivator implementations no longer have an ActivateInstance method and instead have a ConfigurePipeline method.
    • IComponentRegistry no longer supplies a DecoratorsFor method to check decorators. Use IComponentRegistry.ServiceMiddlewareFor instead.
    • The ResolveRequest constructor now takes a ServiceRegistration instead of an IComponentRegistration.
      ... (truncated)

5.2.0

Fixes:

  • #​1108: OnActivating() and OnActivated() should now act more consistently with decorators than it previously did.
  • #​1113: Lifetime scope discrepancies between different decorated implementations should no longer cause problems with IEnumerable<T> resolutions.

Thanks to @​VonOgre for a ton of great work on this one.

5.1.4

#​1111 / #​1102 - Minor update to handling of provided instances with OnRelease.

5.1.3

Issues resolved:

  • #​1089: Owned instances now allow for async disposal.
  • #​1094: InstancePerOwned now works correctly with keyed registrations.
  • #​1099: ACTNARS can now resolve generic types with abstract type arguments.
  • #​1102: Provided instances should now have OnRelease called when the container is disposed regardless of whether the instances themselves were resolved from the container.
  • #​1107: The new() generic type constraint should now be correctly handled in open generic registrations.

5.1.2

  • Fix #​1085 - StackOverflowException thrown with circular property dependencies

5.1.1

Replaced missing constructor on ResolveRequest to fix accidental break in 5.1.0.

5.1.0

  • Update NuGet package to use new icon
  • Cache the implementations of a ServiceRegistrationInfo until the implementations change
  • Fix #​963 - Partially decorating service implementing multiple interfaces throws
  • Fix #​1073 - Always lock when getting an initialized ServiceRegistrationInfo
  • Fix #​1077 - Keep raising 'Registered' and 'RegistrationSourceAdded' events after the 'ComponentRegistry' has been built

5.0.0

This is the first major-version release we've had in about three years (Autofac 4.0 was released in August 2016). There are some breaking changes and new features you should know about as you decide your upgrade strategy.

Breaking Changes

Framework Version Targeting Changes

Starting with Autofac 5.0 there is no longer support for .NET 4.5.x. .NET 4.5.2, the last release in that line, follows the same support lifecycle as Windows Server 2012 R2 which ended mainstream support in September 2018.

Autofac 5.0 now targets:

  • netstandard2.0
  • netstandard2.1
  • net461

Containers are Immutable

The container registry can no longer be updated after it has been built.

The ContainerBuilder.Update method was marked obsolete in November 2016 and there has been a robust discussion to answer questions about how to get the container contents to adjust as needed at runtime.

ContainerBuilder.Update has now been removed entirely.

If you need to change registration behavior at runtime, there are several options available to you including the use of lambdas or child lifetime scopes. See this discussion issue for examples and ideas. We will work to add some documentation based on this issue.

[PR #​948 - thanks @​weelink!]

Lifetime Scope Disposal Hierarchy Enforced

Resolving a service from a lifetime scope will now check all parent scopes to make sure none of them have been disposed.

If you dispose a lifetime scope, all children of that lifetime scope will stop resolving objects. In cases like this you'll start getting ObjectDisposedException instead.

If you have a custom application integration that involves creating/destroying lifetime scopes (e.g., custom per-request support) this may cause issues where proper disposal ordering is not occurring.

[Fixes #​1020; PR #​1061 - thanks @​alistairjevans!]

Prevent Auto-Injecting onto Static Properties

Autofac will no longer do property injection on static properties when auto-wiring of properties is enabled.

If your application behavior depends on static property injection you will need to do some additional work like adding a build callback to populate the property.

[Fixes #​1013; PR #​1021 - thanks @​alistairjevans!]

Features and Fixes

Asynchronous Disposal Support

Autofac lifetime scopes now implement the IAsyncDisposable interface so they can be disposed asynchyronously.

... (truncated)

4.9.4

  • Fix #​1006 - Issue with Entity Framework Core DI registrations
  • Fix #​1009 - Exception in ParameterCompatibleWithTypeConstraint when parameter type is interface and constraint type is class

4.9.3

  • Fix #​976 - Throw an exception if a lifetime scope is created with a duplicate tag
  • Fix #​972 - Resolving services registered as open generics with generic constraints throws ComponentNotRegisteredException
  • Fix #​999 - Support decoration of component returned from lambda expression and cast as interface
  • Faster RegisterAssemblyTypes by putting slow custom attribute check last

4.9.2

  • Reduce the verbosity of activator exception messages; reverts #​343.
  • Resolved #​932: Added serialization constructor to DependencyResolutionException for supported framework targets.
  • Fixed an issue where a decorator was only applied if the decorator interface was the first service assigned to the registration. Found while investigating #​963.
  • Resolved #​965: Do not apply the decorator if already applied, or if the registration is for an adapter.

4.9.1

  • Fix for #​960 - ExternalRegistrySource reuses ExternalComponentRegistration instances causing ObjectDisposedException
  • Made the backing field for ServiceRegistrationInfo.IsInitialized volatile to prevent the ComponentRegistry taking an avoidable lock due to reordering

4.9.0

  • Decorator enhancements
  • Switched from symbol server to SourceLink support
  • #​919: Memory optimisations
  • Reduced locking in ComponentRegistry to improve concurrency of service resolution (extracted from PR #​953)
  • Fix for #​635 SingleInstance lock. Use lock only if instance not created yet.
  • Alternative to #​924: Changed max resolve limit to static for reflection access
  • Improved performance of CollectionRegistrationSource
  • Resolved #​927: Clarified duplicate lifetime scope exception message with respect to Owned<T>
  • Fix for #​889 and #​932 - Add .NET Standard 2.0 target and make DependencyResolutionException serializable
  • Fix for #​929: Resetting resolve op activation stack on succeed or fail to allow try/catch in lambda registrations
  • Inherit Registered callback in child scopes (closes #​218)
  • Move registration source extension method to a dedicated class and make consistent with module registration
  • Fix for #​218: Module.AttachToComponentRegistration() detects registrations in nested scopes
  • Throw ObjectDisposedException on activation if activator is disposed
  • Solution upgraded to .NET Core SDK 2.2.101

4.9.0-beta1

  • Decorator enhancements
  • Switched from symbol server to SourceLink support
  • #​919: Memory optimisations
  • Solution upgraded to Upgrade to .NET Core SDK 2.1.200
  • Alternative to #​924: Changed max resolve limit to static for reflection access

4.8.1

  • Minor performance improvements.
  • Fix #​916: IStartable that creates child lifetime scope during Start() no longer tries to activate itself.

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Autofac
  dependency-version: 9.3.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants