Bump the version-updates group with 13 updates by dependabot[bot] · Pull Request #843 · AndrewMcLachlan/MooBank

Patch release for Aspire 13.4 fixing polyglot AppHost code generation binding when CLI and SDK versions diverge, resource service port collision in --isolated mode, and a MongoDB.Driver dependency update.

🐛 Fixes

🔗 Polyglot AppHost code generation silently failed when CLI and SDK versions diverged — Aspire.TypeSystem used a floating strong-name AssemblyVersion that changed with every build. When the installed Aspire CLI was built at a different version than the AppHost's SDK, the CLR couldn't satisfy the strong-name bind and every code generator (TypeScript, Python, Java, Go, Rust) was silently dropped, surfacing as No code generator found for language: <lang>. The AssemblyVersion is now frozen at a stable constant so any compatible CLI/SDK pair on 13.4 binds successfully. Relates to #18110 and #17910. (#18160, @sebastienros)
🔌 Multiple AppHosts started with --isolated collided on the resource service port — Both instances tried to bind to the same fixed port from ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL, causing an "address already in use" error on the second instance. DashboardServiceHost now binds to port 0 on loopback when RandomizePorts is true (set by --isolated), letting the OS assign a unique port per instance. (#18341, @JamesNK)
🍃 MongoDB.Driver updated to 3.9.0 — Removes a wrongly pinned SharpCompress transitive dependency and uses the corrected Snappier transitive. Fixes #17981. (#18279, @Falco20019)

🏷️ Housekeeping

🚀 Bumped branding to 13.4.6 (#18343)

Full Changelog: v13.4.5...v13.4.6

Full commit: 87fe259e4fc244c599019a7b1304c85a1488f248

Generated by Generate release notes for a new stable Aspire release · 131 AIC · ⌖ 13.5 AIC · ⊞ 37.4K

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Generated by Generate release notes for a new stable Aspire release · ● 4.4M

Commits viewable in compare view.

Updated Aspire.Hosting.SqlServer from 13.4.4 to 13.4.6.

Release notes

Sourced from Aspire.Hosting.SqlServer's releases.

13.4.6 What's New in Aspire 13.4.6

Patch release for Aspire 13.4 fixing polyglot AppHost code generation binding when CLI and SDK versions diverge, resource service port collision in --isolated mode, and a MongoDB.Driver dependency update.

🐛 Fixes

🔗 Polyglot AppHost code generation silently failed when CLI and SDK versions diverged — Aspire.TypeSystem used a floating strong-name AssemblyVersion that changed with every build. When the installed Aspire CLI was built at a different version than the AppHost's SDK, the CLR couldn't satisfy the strong-name bind and every code generator (TypeScript, Python, Java, Go, Rust) was silently dropped, surfacing as No code generator found for language: <lang>. The AssemblyVersion is now frozen at a stable constant so any compatible CLI/SDK pair on 13.4 binds successfully. Relates to #18110 and #17910. (#18160, @sebastienros)
🔌 Multiple AppHosts started with --isolated collided on the resource service port — Both instances tried to bind to the same fixed port from ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL, causing an "address already in use" error on the second instance. DashboardServiceHost now binds to port 0 on loopback when RandomizePorts is true (set by --isolated), letting the OS assign a unique port per instance. (#18341, @JamesNK)
🍃 MongoDB.Driver updated to 3.9.0 — Removes a wrongly pinned SharpCompress transitive dependency and uses the corrected Snappier transitive. Fixes #17981. (#18279, @Falco20019)

🏷️ Housekeeping

🚀 Bumped branding to 13.4.6 (#18343)

Full Changelog: v13.4.5...v13.4.6

Full commit: 87fe259e4fc244c599019a7b1304c85a1488f248

Generated by Generate release notes for a new stable Aspire release · 131 AIC · ⌖ 13.5 AIC · ⊞ 37.4K

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Generated by Generate release notes for a new stable Aspire release · ● 4.4M

Commits viewable in compare view.

Updated Microsoft.Identity.Client from 4.84.2 to 4.85.2.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.85.2 What's Changed

Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) by @Robbie-Microsoft in Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) AzureAD/microsoft-authentication-library-for-dotnet#6070
Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) by @Robbie-Microsoft in Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) AzureAD/microsoft-authentication-library-for-dotnet#6059
Add refresh token cache partitioning support by @iNinja in Add refresh token cache partitioning support AzureAD/microsoft-authentication-library-for-dotnet#6077
Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) by @Robbie-Microsoft in Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) AzureAD/microsoft-authentication-library-for-dotnet#6089

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.1...4.85.2

4.85.1 What's Changed

Migrate OBO tests from old lab to ID4SLAB1 by @RyAuld in Migrate OBO tests from old lab to ID4SLAB1 AzureAD/microsoft-authentication-library-for-dotnet#6021
Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade by @neha-bhargava in Mark regional SNI mTLS PoP test inconclusive on AAD test-slice Bearer downgrade AzureAD/microsoft-authentication-library-for-dotnet#6084
Expose canonical tag names per-metric by @ssmelov in Expose canonical tag names per-metric AzureAD/microsoft-authentication-library-for-dotnet#6076

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.85.0...4.85.1

4.85.0 What's Changed

Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait by @jayesh-a-shah in Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait AzureAD/microsoft-authentication-library-for-dotnet#6054
Add GovFr, GovDe, GovSg to AzureCloudInstance enum by @bgavrilMS in Add GovFr, GovDe, GovSg to AzureCloudInstance enum AzureAD/microsoft-authentication-library-for-dotnet#6023
Take home account from request, if not available elsewhere. by @yowl in Take home account from request, if not available elsewhere. AzureAD/microsoft-authentication-library-for-dotnet#5657
Validate Azure region format to prevent region poisoning (fixes #6060) by @Robbie-Microsoft in Validate Azure region format to prevent region poisoning (fixes #6060) AzureAD/microsoft-authentication-library-for-dotnet#6061
Promote MsalServiceException.SubError to public by @neha-bhargava in Promote MsalServiceException.SubError to public AzureAD/microsoft-authentication-library-for-dotnet#6063
Migrate region discovery to IMDS /compute JSON endpoint (#6039) by @Robbie-Microsoft in Migrate region discovery to IMDS /compute JSON endpoint (#6039) AzureAD/microsoft-authentication-library-for-dotnet#6057
fix: Service Fabric MI sends principalId for ObjectId; reject ClientId/ResourceId (mirror of #6066) by @neha-bhargava in fix: Service Fabric MI sends principalId for ObjectId; reject ClientId/ResourceId (mirror of #6066) AzureAD/microsoft-authentication-library-for-dotnet#6069
Exclude caller SDK telemetry from access token cache keys by @bgavrilMS in Exclude caller SDK telemetry from access token cache keys AzureAD/microsoft-authentication-library-for-dotnet#6074
Add MSAL.NET telemetry enrichment by @ssmelov in Add MSAL.NET telemetry enrichment AzureAD/microsoft-authentication-library-for-dotnet#6071

New Contributors

@jayesh-a-shah made their first contribution in Fix proactive token refresh bypassing cancellation, leading to unbounded semaphore wait AzureAD/microsoft-authentication-library-for-dotnet#6054
@yowl made their first contribution in Take home account from request, if not available elsewhere. AzureAD/microsoft-authentication-library-for-dotnet#5657

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.84.2...4.85.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0 What's Changed

Add ARM64 msdia140.dll support to test platform packages by @jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
Update System.Memory from 4.5.5 to 4.6.3 by @nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

@jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore.SwaggerUI from 10.2.1 to 10.2.3.

Release notes

Sourced from Swashbuckle.AspNetCore.SwaggerUI's releases.

10.2.3 What's Changed

Bump swagger-ui-dist to 5.32.7 by @dependabot in Bump swagger-ui-dist from 5.32.6 to 5.32.7 in /src/Swashbuckle.AspNetCore.SwaggerUI domaindrivendev/Swashbuckle.AspNetCore#4015

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.2...v10.2.3

10.2.2 What's Changed

Update NuGet packages by @martincostello in Update NuGet packages domaindrivendev/Swashbuckle.AspNetCore#3990
Set SOURCE_DATE_EPOCH by @martincostello in Set SOURCE_DATE_EPOCH domaindrivendev/Swashbuckle.AspNetCore#3997
Fix InvalidOperationException if no route matches by @martincostello in Fix InvalidOperationException if no route matches domaindrivendev/Swashbuckle.AspNetCore#3999
Fix empty parameter example not generated by @dldl-cmd in Fix empty parameter example not generated domaindrivendev/Swashbuckle.AspNetCore#3932
Map [MinLength]/[MaxLength] on dictionary properties to minProperties/maxProperties by @KitKeen in Map [MinLength]/[MaxLength] on dictionary properties to minProperties / maxProperties domaindrivendev/Swashbuckle.AspNetCore#3922
Fix conflicting required+nullable schema when only NonNullableReferen… by @KitKeen in Fix conflicting required+nullable schema when only NonNullableReferen… domaindrivendev/Swashbuckle.AspNetCore#3912
Fix ExposeSwaggerDocumentUrlsRoute behaviour by @martincostello in Fix ExposeSwaggerDocumentUrlsRoute behaviour domaindrivendev/Swashbuckle.AspNetCore#4000
Use NUGET_API_KEY by @martincostello in Use NUGET_API_KEY domaindrivendev/Swashbuckle.AspNetCore#4006

New Contributors

@KitKeen made their first contribution in Map [MinLength]/[MaxLength] on dictionary properties to minProperties / maxProperties domaindrivendev/Swashbuckle.AspNetCore#3922

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.1...v10.2.2

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Asm from 3.8.147 to 3.8.153 Bumps Asm.AspNetCore from 3.8.147 to 3.8.153 Bumps Asm.AspNetCore.Api from 3.8.147 to 3.8.153 Bumps Asm.Cqrs.AspNetCore from 3.8.147 to 3.8.153 Bumps Asm.Domain from 3.8.147 to 3.8.153 Bumps Asm.Domain.Infrastructure from 3.8.147 to 3.8.153 Bumps Asm.ModelContextProtocol from 3.8.147 to 3.8.153 Bumps Asm.Testing.Domain from 3.8.147 to 3.8.153 Bumps Aspire.Hosting.JavaScript from 13.4.4 to 13.4.6 Bumps Aspire.Hosting.SqlServer from 13.4.4 to 13.4.6 Bumps Microsoft.Identity.Client from 4.84.2 to 4.85.2 Bumps Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0 Bumps Swashbuckle.AspNetCore.SwaggerUI from 10.2.1 to 10.2.3 --- updated-dependencies: - dependency-name: Asm dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.AspNetCore dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.AspNetCore.Api dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.Cqrs.AspNetCore dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.Domain dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.Domain.Infrastructure dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.ModelContextProtocol dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Asm.Testing.Domain dependency-version: 3.8.153 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Aspire.Hosting.JavaScript dependency-version: 13.4.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Aspire.Hosting.SqlServer dependency-version: 13.4.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: Microsoft.Identity.Client dependency-version: 4.85.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: Swashbuckle.AspNetCore.SwaggerUI dependency-version: 10.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-06-29T22:41:40Z

Summary

Assembly	Line coverage	Branch coverage
Asm.MooBank	67.4%	65.1%
Asm.MooBank.Domain	91.2%	81.3%
Asm.MooBank.Infrastructure	81%	78.5%
Asm.MooBank.Models	91.4%	81.5%
Asm.MooBank.Modules.Accounts	67.1%	64.2%
Asm.MooBank.Modules.Assets	59%	83.3%
Asm.MooBank.Modules.Bills	88.2%	82%
Asm.MooBank.Modules.Budgets	81.1%	92.7%
Asm.MooBank.Modules.Families	68.9%	100%
Asm.MooBank.Modules.Forecast	81.1%	81.5%
Asm.MooBank.Modules.Groups	73.4%	100%
Asm.MooBank.Modules.Institutions	67.7%	100%
Asm.MooBank.Modules.Instruments	70.7%	64%
Asm.MooBank.Modules.Reports	65.2%	61.3%
Asm.MooBank.Modules.Stocks	73.9%	79.5%
Asm.MooBank.Modules.Tags	80.5%	72.2%
Asm.MooBank.Modules.Transactions	69.5%	62.5%
Asm.MooBank.Modules.Users	66.9%	100%
Asm.MooBank.Security	52.2%	68.9%

dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Jun 29, 2026

dependabot Bot requested a review from AndrewMcLachlan as a code owner June 29, 2026 22:38

dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .net code labels Jun 29, 2026

dependabot Bot mentioned this pull request Jun 29, 2026

Bump the version-updates group with 12 updates #839

Closed

github-actions Bot enabled auto-merge June 29, 2026 22:38

github-actions Bot merged commit 924c02f into main Jun 29, 2026
20 checks passed

github-actions Bot deleted the dependabot/nuget/version-updates-9dbba36f4c branch June 29, 2026 22:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the version-updates group with 13 updates#843

Bump the version-updates group with 13 updates#843
github-actions[bot] merged 1 commit into
mainfrom
dependabot/nuget/version-updates-9dbba36f4c

dependabot Bot commented on behalf of github Jun 29, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026

13.4.6

What's New in Aspire 13.4.6

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.6

What's New in Aspire 13.4.6

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

4.85.2

What's Changed

4.85.1

What's Changed

4.85.0

What's Changed

New Contributors

18.7.0

What's Changed

New Contributors

10.2.3

What's Changed

10.2.2

What's Changed

New Contributors

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants