Skip to content

Add 4.15.0 release notes - #4050

Merged
Iarek Kovtunenko (iarekk) merged 1 commit into
masterfrom
release/4.15.0-notes
Sep 21, 2026
Merged

Add 4.15.0 release notes#4050
Iarek Kovtunenko (iarekk) merged 1 commit into
masterfrom
release/4.15.0-notes

Conversation

@iarekk

@iarekk Iarek Kovtunenko (iarekk) commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Microsoft.Identity.Web 4.15.0 expands federated credential and proof-of-possession support, improves app authentication and authorization validation, and strengthens Entra Sidecar request handling and container reliability.

Federated credentials and proof of possession

Authentication and token acquisition

Authorization and request validation

Entra Sidecar reliability and validation

Dependency updates

This PR updates changelog.md only.

@iarekk
Iarek Kovtunenko (iarekk) marked this pull request as ready for review September 16, 2026 12:22
@iarekk
Iarek Kovtunenko (iarekk) requested a review from a team as a code owner September 16, 2026 12:22
@iarekk
Add 4.15.0 release notes
8729184 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 56bc718a-9906-4477-bedb-cd974a527389
@iarekk
Iarek Kovtunenko (iarekk) merged commit c86f145 into master Sep 21, 2026
9 checks passed
@iarekk
Iarek Kovtunenko (iarekk) deleted the release/4.15.0-notes branch September 21, 2026 10:54
@iarekk Iarek Kovtunenko (iarekk) mentioned this pull request Sep 21, 2026
Merged
This was referenced Oct 1, 2026
Merged
Merged
Merged
Merged
Merged
Open
Merged
Sarah Sayeed Qureshi (sarahsa) pushed a commit to heimdallpower/api-sdk that referenced this pull request Oct 2, 2026
@dependabot
chore(nuget): Bump the nuget-dependencies group with 2 updates (#175)
67b9681 
Updated
[coverlet.collector](https://github.com/coverlet-coverage/coverlet) from
10.0.1 to 10.1.0.

<details>
<summary>Release notes</summary>

_Sourced from [coverlet.collector's
releases](https://github.com/coverlet-coverage/coverlet/releases)._

## 10.1.0

### Improvements

- Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP
[#​2019](coverlet-coverage/coverlet#2019)
- Implement dynamic exclusion filters for assemblies (Coverlet.MTP)
[#​1946](coverlet-coverage/coverlet#1946)
- Replace legacy .sln files with modern .slnx format
[#​1966](coverlet-coverage/coverlet#1966)
- coverlet.console: add trace diagnostics and actionable warnings for
instrumentation/hit/empty-result failures
[#​2005](coverlet-coverage/coverlet#2005)
- Relax auto-property skip logic and improve coverage for records
[#​1941](coverlet-coverage/coverlet#1941)

### Fixed

- Fix coverlet.MTP does not collect coverage on the .NET Framework
portion of a large project
[#​1980](coverlet-coverage/coverlet#1980)
[#​1967](coverlet-coverage/coverlet#1967)
- Fix Regression in branch coverage for lambda expressions
[#​1938](coverlet-coverage/coverlet#1938)
- Fix When using "is" with "or" in pattern matching, branch coverage is
lower than normal
[#​1979](coverlet-coverage/coverlet#1979)
- Fix silent zero coverage on .NET Framework since 8.0.0
[#​1985](coverlet-coverage/coverlet#1985) by
@​tobiwae
- Fix Race condition between ProcessExit hit-file write and out-of-proc
coverage read causes EndOfStreamException
[#​1987](coverlet-coverage/coverlet#1987)
[#​1988](coverlet-coverage/coverlet#1988) by
@​bkoelman
- Fix Regression TypeInitializationException when targeting .NET
Framework - Could not load type
'System.Collections.Concurrent.ConcurrentBag
[#​2010](coverlet-coverage/coverlet#2010)
- Fix use --config-file CLI arg in coverlet.MTP
[#​2030](coverlet-coverage/coverlet#2030) by
alexthornton1
- Fix silently empty coverage for shared-framework assemblies missing
from compileLibraries
[#​2032](coverlet-coverage/coverlet#2032) by
@​Eljees

[Diff between 10.0.1 and
10.1.0](coverlet-coverage/coverlet@v10.0.1...v10.1.0)

Commits viewable in [compare
view](coverlet-coverage/coverlet@v10.0.1...v10.1.0).
</details>

Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.15.0 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.15.0...4.16.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 2, 2026
Open
Open
Merged
Merged
Merged
Closed
Merged
Closed
Open
This was referenced Oct 6, 2026
Closed
Open
Open
Open
Open
Closed
Open
Closed
Open
Open
Merged
Open
Merged
Merged
Closed
Open
James Gunn (gunndabad) pushed a commit to DFE-Digital/teaching-record-system that referenced this pull request Oct 8, 2026
@dependabot @github-actions
Bump Microsoft.Identity.Web and Microsoft.IdentityModel.Protocols.Ope…
dda72b3 
…nIdConnect (#3914)

Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.14.2 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

## 4.15.0

## Federated credentials and proof of possession

- Federated credential token exchange derives cloud-specific audience
and scope metadata from the authority host, with explicit overrides
still supported. #​3994
- The Entra Sidecar `/Validate` endpoint accepts Signed HTTP Request
proof-of-possession tokens for app-only client-credential flows. #​4008
- Credential Guard key attestation is available through the optional
`Microsoft.Identity.Web.KeyAttestation` package and
`AddMicrosoftIdentityWebKeyAttestation()` registration. #​4004

## Authentication and token acquisition

- EasyAuth app-token acquisition returns an app-only authentication
result produced through client credentials. #​4015
- Graph v4 credentials are attached only to destinations matching the
configured absolute HTTPS origin; custom Graph proxy base URLs remain
supported. #​4012

## Authorization and request validation

- OWIN web APIs require a non-empty recognized scope or role unless
ACL-based authorization is explicitly enabled. #​4006 #​4009
- Explicitly configured missing scope or app-permission requirements now
fail authorization. #​4010
- Local redirect paths containing control characters are rejected.
#​4028

## Entra Sidecar reliability and validation

- Invalid selected `AgentUserId` values return HTTP 400. #​4011
- Automatic forwarded-header processing is rejected outside Development
when `ForwardedHeaders_Enabled=true`. #​4018
- Non-local Host headers are rejected outside Development except on
`/healthz`. #​4023
- Windows containers use `ContainerUser`, and ACL authorization defaults
are correctly applied to named bearer options. #​4042

## Dependency updates

- `Microsoft.Identity.Client` and
`Microsoft.Identity.Client.KeyAttestation`: 4.87.0 -> 4.90.0. #​4003
#​3994 #​4052
- `Microsoft.Identity.Abstractions`: 12.6.0 -> 12.7.0. #​4020 #​3994

**Full changelog**:
AzureAD/microsoft-identity-web@4.14.2...4.15.0


Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.14.2...4.16.0).
</details>

Updated
[Microsoft.IdentityModel.Protocols.OpenIdConnect](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet)
from 8.22.0 to 8.23.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.IdentityModel.Protocols.OpenIdConnect's
releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)._

## 8.23.0

## What's Changed
* Backport configurable SHR `p` claim path comparison to 8.x by
@​debchoudhury-id4s in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3577
* Backport SHR p-claim percent-encoding hex case handling to dev8x by
@​debchoudhury-id4s in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3579
* Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x
package by @​iNinja in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3547
* Include WS-Trust in build pipelines by @​iNinja in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3604
* Log IDX10650 decryption-tag failures below Error during multi-key
decryption by @​RojaEnnam in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3582
* Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3597
* Add Composite ML-DSA support (internal, gated) by @​iNinja in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3596


**Full Changelog**:
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in [compare
view](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Oct 8, 2026
Open
Open
Merged
Open
Merged
Open
Open
Merged
github-actions Bot pushed a commit to mpaulosky/SuggestionApp that referenced this pull request Oct 11, 2026
@dependabot
chore: Bump the all-nuget group with 2 updates (#27)
6619c96 
Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.15.0 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.15.0...4.16.0).
</details>

Updated
[Microsoft.Identity.Web.UI](https://github.com/AzureAD/microsoft-identity-web)
from 4.15.0 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web.UI's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.15.0...4.16.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot dependabot Bot mentioned this pull request Oct 11, 2026
Merged
github-actions Bot pushed a commit to mpaulosky/IssueTracker that referenced this pull request Oct 11, 2026
@dependabot
chore: Bump the all-nuget group with 7 updates (#260)
619eb8a 
Updated [Aspire.Hosting](https://github.com/microsoft/aspire) from
13.5.4 to 13.6.0.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Hosting's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


Commits viewable in [compare
view](microsoft/aspire@v13.5.4...v13.6.0).
</details>

Updated [Aspire.Hosting.AppHost](https://github.com/microsoft/aspire)
from 13.5.4 to 13.6.0.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Hosting.AppHost's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


Commits viewable in [compare
view](microsoft/aspire@v13.5.4...v13.6.0).
</details>

Updated [Aspire.Hosting.MongoDB](https://github.com/microsoft/aspire)
from 13.5.4 to 13.6.0.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Hosting.MongoDB's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


Commits viewable in [compare
view](microsoft/aspire@v13.5.4...v13.6.0).
</details>

Updated [Aspire.Hosting.Redis](https://github.com/microsoft/aspire) from
13.5.4 to 13.6.0.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Hosting.Redis's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


Commits viewable in [compare
view](microsoft/aspire@v13.5.4...v13.6.0).
</details>

Updated
[MessagePack](https://github.com/MessagePack-CSharp/MessagePack-CSharp)
from 2.5.305 to 2.5.307.

<details>
<summary>Release notes</summary>

_Sourced from [MessagePack's
releases](https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases)._

## 2.5.307

## Security fix

* Fix [LZ4 decompression integer overflow
bug](GHSA-7rj2-5w9w-r9jx)

**Full Changelog**:
MessagePack-CSharp/MessagePack-CSharp@v2.5.305...v2.5.307

Commits viewable in [compare
view](MessagePack-CSharp/MessagePack-CSharp@v2.5.305...v2.5.307).
</details>

Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.15.0 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.15.0...4.16.0).
</details>

Updated
[Microsoft.Identity.Web.UI](https://github.com/AzureAD/microsoft-identity-web)
from 4.15.0 to 4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web.UI's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.16.0

## What's Changed
* Add 4.15.0 release notes by @​iarekk in
AzureAD/microsoft-identity-web#4050
* Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in
AzureAD/microsoft-identity-web#4060
* Add Sidecar 1.1.2 changelog by @​soodt in
AzureAD/microsoft-identity-web#4070
* Fix FIC telemetry enrichment during credential warm-up and assertion
cache hits by @​neha-bhargava in
AzureAD/microsoft-identity-web#4072
* Update agentic docs to cover current behavior by @​Avery-Dunn in
AzureAD/microsoft-identity-web#4077
* Bump the notsecurity group with 4 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#4074


**Full Changelog**:
AzureAD/microsoft-identity-web@4.15.0...4.16.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.15.0...4.16.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 11, 2026
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@4gust Nilesh Choudhary (4gust) 4gust approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@iarekk @4gust