Quartz.NET Files

Three packages take the fixed versions of dependencies named in Microsoft's October 13 security advisories. There is no public API change and no schema change, and no other package changes.

Fixed

• Quartz.Dashboard.Agent requires Microsoft.AspNetCore.SignalR.Client 10.0.13. 4.5.0 required 10.0.0, and every SignalR client before 10.0.13 brings a Microsoft.AspNetCore.SignalR.Common covered by GHSA-334f-vvp4-7g6p (CVE-2026-70159). So an application referencing the agent got NU1903 at restore, and that is an error wherever warnings are errors. The fixed client asks for Microsoft.Extensions.DependencyInjection, Logging and Logging.Abstractions 10.0.13 or later, so an application referencing the agent now resolves those at least that high. The agent's own nuspec no longer repeats the framework-extension floors it inherits from Quartz. (#4065)
• Quartz.Weasel.Oracle and Quartz.Weasel.SqlServer require System.Security.Cryptography.Pkcs 9.0.21. Their database drivers, reached through Weasel, bring Pkcs 8.0.0 and 9.0.4, which GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx cover. Neither package calls it. The direct reference lifts an application's graph to the fixed version, and can go once the drivers require a fixed one themselves. (#4065)

The same SignalR fix ships for 3.x's Quartz.Dashboard in 3.22.6.

What's Changed

Other changes

• The restore graph takes the October 13 security fixes for SignalR and the cryptography packages by @lahma in https://github.com/quartznet/quartznet/pull/4065

Full Changelog: https://github.com/quartznet/quartznet/compare/v4.5.0...v4.5.1