Bump Refit from 12.1.0 to 13.1.0

[dependabot]

Updated Refit from 12.1.0 to 13.1.0.

Release notes

Sourced from Refit's releases.

13.1.0

🗞️ What's Changed

• Fixed the CS0436 build error from PrimitivesR3BridgeGeneratedAttribute (#​2176, #​2194). Bumps ReactiveUI.Primitives to 6.0.0, which moves the R3 bridge generator out of the runtime package. Projects using InternalsVisibleTo (e.g. test projects) build again, and the <Analyzer Remove=... /> workaround is no longer needed.
• Path parameters now use generated request building instead of reflection (#​2174), so they work with AddRefitGeneratedClient and NativeAOT. Now covers enum, Guid, DateTime/DateTimeOffset/DateOnly/TimeOnly/TimeSpan, all integer widths (incl. Int128/UInt128/Half), and any IFormattable (#​2193).

✨ Features

• reactiveui/refit@​b592413509791e267aba66f24e2cf2be9ec1508a feat: add generated request building support for path parameters in the URL. (#​2174) @​calebkiage @​glennawatson
• reactiveui/refit@​9bc675408e2950b54f7e96911f8c6b9754f39e3f feat: support more path parameter types in generated request building (#​2193) @​glennawatson

🧹 General Changes

• reactiveui/refit@​ac79c760e414adeca629adbe290b5765cea41df2 build: update NuGet dependencies (#​2198) @​glennawatson

🔗 Full Changelog: reactiveui/refit@v13.0.0...13.1.0

🙌 Contributions

🌱 New contributors since the last release: @​calebkiage
💖 Thanks to all the contributors: @​calebkiage, @​glennawatson

13.0.0

🗞️ What's Changed

Refit 13 is a major release focused on security hardening and a brand-new testing package.

• Security hardening (#​2181) — closes issues found in a security audit. XML deserialization is now protected against XXE (external entity) attacks, the Newtonsoft.Json integration no longer honours unsafe TypeNameHandling by default (blocking type-confusion/deserialization attacks), and sensitive values (auth headers, tokens) are now redacted from exception and log output. This is the main reason for the major version bump: if you relied on permissive Newtonsoft type handling you may need to opt back in explicitly.
• New Refit.Testing package (#​2184) — a first-party way to stub and verify Refit clients in tests without spinning up a real HttpClient. Supply canned responses for interface calls and assert which requests your code made, instead of hand-rolling HttpMessageHandler fakes.
• R3 bridge analyzer fix (#​2186) — corrects the removal target for the R3 bridge analyzer.
• CI and documentation tidy-ups for SonarCloud on fork pull requests.

✨ Features

• reactiveui/refit@​cc24382535a48c24e15100a3f58914a6e4fe8dcc feat: security hardening from audit (XXE, Newtonsoft type handling, redaction) (#​2181) @​glennawatson
• reactiveui/refit@​339cb8d39e16d05770217902ad9794f0fe289869 feat: add Refit.Testing package for stubbing and verifying clients (#​2184) @​glennawatson

🧹 General Changes

• reactiveui/refit@​5d272c8dc2d691d8c793abe64f1b9e430fdbec4f ci: run SonarCloud on fork pull requests @​glennawatson

📝 Documentation

• reactiveui/refit@​533bbbe525a51eed6397c0d522e5e9cdc281c50b docs: slim fork-PR SonarCloud wrapper comments @​glennawatson

📌 Other

• reactiveui/refit@​c0bbb5a857691bb7cd39c19d573a3f21faaaf607 [codex] Fix R3 bridge analyzer removal target (#​2186) @​ChrisPulman

🔗 Full Changelog: reactiveui/refit@v12.1.0...v13.0.0

🙌 Contributions

💖 Thanks to all the contributors: @​ChrisPulman, @​glennawatson

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}