Bump Microsoft.AspNetCore.OData from 9.4.1 to 9.5.0

[dependabot]

Updated Microsoft.AspNetCore.OData from 9.4.1 to 9.5.0.

Release notes

Sourced from Microsoft.AspNetCore.OData's releases.

9.5.0

AspNetCoreOData 9.5.0

Full changelog: OData/AspNetCoreOData@9.4.1...9.5.0

This release focuses on security hardening of query parsing, batch handling, and delta updates, along with several bug fixes and a new configurable safeguard.

🔒 Security

• Prevent server-driven paging bypass via Prefer: maxpagesize=0 (CWE-1284/CWE-770). A client-supplied maxpagesize is now honored only when it is a positive integer, so the operator-configured PageSize can no longer be disabled to pull an entire collection in one response. Also hardens the header parser against a bare maxpagesize token that previously threw a 500. (4018c71)
• Bound nested function call and cast() chain depth in filter validation and binding. Adds MaxFunctionCallDepth (default 15) enforcement in both the validator and the binder to mitigate stack-pressure DoS from deeply nested $filter expressions. (e9bf5dc)
• Strengthen OData batch sub-request URL and header validation. Sub-requests are now validated for matching authority (scheme/host/port), constrained to the OData route prefix (blocking $1/../../../admin-style traversal), and have auth/identity/forwarding headers (Host, X-Forwarded-*, X-MS-Client-Principal-*, X-ARR-*, …) stripped via a deny-list. (491fb92)
• Set a bounded MaxReceivedMessageSize default (100 MB) (CWE-770) to prevent unbounded resource allocation. (#​1574)
• Enforce EDM model boundary for open-type property binding in $filter / $orderby / $apply. Open/dynamic property segments now bind only to model-declared properties (resolving EDM→CLR renames correctly), preventing unmodeled CLR properties from leaking. (5e3adee)
• Respect EDM model exclusions in SelectExpandWrapper. CLR properties excluded via [NotMapped] or .Ignore() no longer surface in $skiptoken values when ordering by an open-type property. (6f91036)
• Enforce the UpdatableProperties allow-list for nested resources in Delta<T>. Removing a nested (complex / single-valued navigation) property from UpdatableProperties is now respected by Patch()/Put(), closing an over-posting gap. Default behavior is unchanged. (4a192c4)

✨ Enhancements

• Add MaxFunctionCallDepth setting to limit nested function-call depth, configurable via ODataValidationSettings, ODataQuerySettings, and the [EnableQuery] attribute. (#​1575)

🐛 Bug fixes

• Build the skip-token filter as an OData AST to correctly handle malformed/unexpected token values (typed ConstantNode/BinaryOperatorNode instead of string concatenation), fixing ordering by nullable/non-nullable bool, enum, and open-type properties. (ec8da22)
• Fix cast() to Edm.String binding and add test coverage across all property types. (d92c39d)
• Fixes #​1545: ODataOptions.TimeZone was ignored; dates were always serialized using TimeZoneInfo.Local. (#​1546)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 22.72%. Comparing base (e40adc9) to head (d251b2d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #313   +/-   ##
=======================================
  Coverage   22.72%   22.72%           
=======================================
  Files          22       22           
  Lines         691      691           
  Branches       14       14           
=======================================
  Hits          157      157           
  Misses        529      529           
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.