Repository navigation
chore(deps): Bump Aspire.Hosting.Docker and 16 others - #569
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps Aspire.Hosting.Docker from 13.5.4 to 13.6.3 Bumps Aspire.Hosting.JavaScript from 13.5.4 to 13.6.3 Bumps Aspire.Hosting.PostgreSQL from 13.5.4 to 13.6.3 Bumps Aspire.Npgsql.EntityFrameworkCore.PostgreSQL to 13.6.3, 13.6.4 Bumps coverlet.collector from 10.0.1 to 10.1.0 Bumps Fido2.AspNet from 4.0.1 to 4.3.1 Bumps MessagePack from 3.1.9 to 3.1.12 Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol to 1.20.1 Bumps OpenTelemetry.Extensions.Hosting to 1.20.1 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.18.0 to 1.20.1 Bumps OpenTelemetry.Instrumentation.Http from 1.18.0 to 1.20.1 Bumps OpenTelemetry.Instrumentation.Runtime from 1.18.0 to 1.20.1 Bumps Scalar.AspNetCore to 2.18.2, 2.18.3 Bumps SkiaSharp from 4.152.1 to 4.153.1 Bumps SkiaSharp.NativeAssets.Linux.NoDependencies from 4.152.1 to 4.153.1 Bumps System.IO.Abstractions from 22.2.0 to 22.3.0 Bumps System.IO.Abstractions.TestingHelpers from 22.2.0 to 22.3.0 --- updated-dependencies: - dependency-name: Aspire.Npgsql.EntityFrameworkCore.PostgreSQL dependency-version: 13.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Fido2.AspNet dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Extensions.Hosting dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Instrumentation.Runtime dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Scalar.AspNetCore dependency-version: 2.18.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: SkiaSharp dependency-version: 4.153.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: SkiaSharp.NativeAssets.Linux.NoDependencies dependency-version: 4.153.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: System.IO.Abstractions dependency-version: 22.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: System.IO.Abstractions.TestingHelpers dependency-version: 22.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Aspire.Npgsql.EntityFrameworkCore.PostgreSQL dependency-version: 13.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Scalar.AspNetCore dependency-version: 2.18.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Aspire.Hosting.Docker dependency-version: 13.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Aspire.Hosting.JavaScript dependency-version: 13.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Aspire.Hosting.PostgreSQL dependency-version: 13.6.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: MessagePack dependency-version: 3.1.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: OpenTelemetry.Extensions.Hosting dependency-version: 1.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
|
Superseded by #571. |
dependabot
Bot
deleted the
dependabot/nuget/MusicHoarder.Api.Tests/nuget-deps-1a5841ecb2
branch
October 27, 2026 17:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Aspire.Hosting.Docker from 13.5.4 to 13.6.3.
Release notes
Sourced from Aspire.Hosting.Docker's releases.
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Updated Aspire.Hosting.JavaScript from 13.5.4 to 13.6.3.
Release notes
Sourced from Aspire.Hosting.JavaScript's releases.
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Updated Aspire.Hosting.PostgreSQL from 13.5.4 to 13.6.3.
Release notes
Sourced from Aspire.Hosting.PostgreSQL's releases.
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Updated Aspire.Npgsql.EntityFrameworkCore.PostgreSQL from 13.5.4 to 13.6.3.
Release notes
Sourced from Aspire.Npgsql.EntityFrameworkCore.PostgreSQL's releases.
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Pinned Aspire.Npgsql.EntityFrameworkCore.PostgreSQL at 13.6.4.
Release notes
Sourced from Aspire.Npgsql.EntityFrameworkCore.PostgreSQL's releases.
13.6.4
What's New in Aspire 13.6.4
Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.
🐛 Fixes
🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature
FailedToStartstate when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured throughDcpPublisher:KubernetesApiTimeout,DcpPublisher:KubernetesInitializationAdditionalTimeout, andDcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #20691. (#20868, backport of #20752, @danegsta)☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a
bicep().parameter(...)expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#20767, backport of #20557, @sebastienros)🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (
0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#21282, backport of #21276, @mitchdenny)Full Changelog: v13.6.3...v13.6.4
Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf
Commits viewable in compare view.
Updated coverlet.collector from 10.0.1 to 10.1.0.
Release notes
Sourced from coverlet.collector's releases.
10.1.0
Improvements
Fixed
Diff between 10.0.1 and 10.1.0
Commits viewable in compare view.
Updated Fido2.AspNet from 4.0.1 to 4.3.1.
Release notes
Sourced from Fido2.AspNet's releases.
4.3.1
Security fix — see GHSA-gw6g-q29j-3jvp
Also updates Blazor WebAssembly packages to 8.0.32 (GHSA-qjpx-jqm5-h2c4).
4.3.0
Backports two WebAuthn Level 3 validation checks from the 5.0.0-preview line to the 4.x line (#689, #690).
What changed
crossOrigin/topOriginin the collected client data are now validated during both registration and authentication. A response withcrossOrigin: trueis rejected unlessFido2Configuration.AllowCrossOriginRequestsis set; when present,topOriginmust match one of your configured origins.Cross-origin ceremonies were previously accepted with no validation at all. If your application intentionally performs WebAuthn ceremonies inside a cross-origin iframe, you need to opt in going forward:
Same-origin applications (the vast majority) are unaffected. See the v4.3.0 Upgrade Guide (https://github.com/passwordless-lib/fido2-net-lib/blob/maintenance-4.x/Documentation/migration-guide-4.3.0.md) for details.
Also in this release
topOriginparse that could throw a rawUriFormatExceptionon malformed input instead of the library's own Fido2VerificationException.Fido2MetadataServiceRepositoryTests(mostly surfaced on macOS CI runners), unrelated to the above but included for CI stability.All Fido2 and Fido2.AspNet users on the 4.x line should review the upgrade guide before updating, in case cross-origin ceremonies apply to your deployment.
Full Changelog: passwordless-lib/fido2-net-lib@4.2.0...4.3.0
4.2.0
Full Changelog: passwordless-lib/fido2-net-lib@4.1.1...4.2.0
Security fixes for SSRF, an unauthenticated denial-of-service, and a metadata
validation bypass — see security advisory GHSA-jc6v-cf3v-w2fm for full details,
severity, and proof of concept.
All Fido2 and Fido2.AspNet users on 4.x should upgrade to this version.
4.1.1
Blazor-only patch release. Fixes #633 and #634 — Fido2.BlazorWebAssembly packages from 4.0.0 through 5.0.0-preview.3 (including 4.1.0) shipped WebAuthn.ts instead of the compiled WebAuthn.js, so the module import 404'd on first use. No other changes from 4.1.0.
4.1.0
What's Changed
New Contributors
Full Changelog: passwordless-lib/fido2-net-lib@4.0.0...4.1.0
Commits viewable in compare view.
Updated MessagePack from 3.1.9 to 3.1.12.
Release notes
Sourced from MessagePack's releases.
3.1.12
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.11...v3.1.12
3.1.11
Security fix
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.10...v3.1.11
3.1.10
Security fix
Other fixes
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.9...v3.1.10
Commits viewable in compare view.
Pinned OpenTelemetry.Exporter.OpenTelemetryProtocol at 1.20.1.
Release notes
Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.
1.20.1
For highlights and announcements pertaining to this release see: Release Notes > 1.20.1.
The following changes are from the previous release 1.20.0.
NuGet: OpenTelemetry v1.20.1
Fixed a possible race condition on ARM64 when multiple threads record the
first measurement with no tags, or the first overflow measurement, that could
cause the measurement to be recorded incorrectly.
(#7951)
Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
and prefixed JWTs.
(#7955)
Fixed default HTTP client log filtering when registering the OTLP log exporter
through
OpenTelemetryLoggerOptions.(#7959)
Fixed legacy self-diagnostics logging terminating the process when the log
file is truncated or the log volume runs out of space.
(#7956)
Experimental (pre-release builds only): Fixed
Logger.EmitLogignoringinstrumentation suppression, which could cause recursive exports or deadlocks.
(#7961)
Fixed delta double counters losing subsequent measurements after a non-finite
or large value and idle metric points with a
NaNvalue failing to be reclaimed.(#7963)
Improve the assignment of values to exponential histogram buckets when the
value is near a bucket boundary by using a pre-computed lookup table.
(#7911)
Fixed
LogRecords being returned to the shared pool while still queued forexport when an exporter stops enumerating a single-item or array
Batch<LogRecord>early which could cause aBatchLogRecordExportProcessoron the same provider to export missing or incorrect data.
(#7965)
Fixed a
SuppressInstrumentationScope.Enter()reference count never beingreleased when the
Activityit was entered for is not recorded, which causedall subsequent telemetry in that execution context to be suppressed.
(#7966)
Self-diagnostics log files, whether configured through
OTEL_DIAGNOSTICS.jsonor
SelfDiagnosticsOptions, are now always created as new files.(#7968)
... (truncated)
1.20.1-rc.1
The following changes are from the previous release 1.20.0.
NuGet: OpenTelemetry v1.20.1-rc.1
Fixed a possible race condition on ARM64 when multiple threads record the
first measurement with no tags, or the first overflow measurement, that could
cause the measurement to be recorded incorrectly.
(#7951)
Fixed self-diagnostics preamble redaction of quoted or encoded PEM material
and prefixed JWTs.
(#7955)
Fixed default HTTP client log filtering when registering the OTLP log exporter
through
OpenTelemetryLoggerOptions.(#7959)
Fixed legacy self-diagnostics logging terminating the process when the log
file is truncated or the log volume runs out of space.
(#7956)
Experimental (pre-release builds only): Fixed
Logger.EmitLogignoringinstrumentation suppression, which could cause recursive exports or deadlocks.
(#7961)
Fixed delta double counters losing subsequent measurements after a non-finite
or large value and idle metric points with a
NaNvalue failing to be reclaimed.(#7963)
Improve the assignment of values to exponential histogram buckets when the
value is near a bucket boundary by using a pre-computed lookup table.
(#7911)
Fixed
LogRecords being returned to the shared pool while still queued forexport when an exporter stops enumerating a single-item or array
Batch<LogRecord>early which could cause aBatchLogRecordExportProcessoron the same provider to export missing or incorrect data.
(#7965)
Fixed a
SuppressInstrumentationScope.Enter()reference count never beingreleased when the
Activityit was entered for is not recorded, which causedall subsequent telemetry in that execution context to be suppressed.
(#7966)
Self-diagnostics log files, whether configured through
OTEL_DIAGNOSTICS.jsonor
SelfDiagnosticsOptions, are now always created as new files.(#7968)
Self-diagnostics messages written to the sinks configured by
SelfDiagnosticsOptionsare now truncated to 16,384 characters so that the... (truncated)
1.20.1-beta.1
The following changes are from the previous release 1.20.0-beta.1.
NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.20.1-beta.1
made the server buffer a full copy of the response for each client that did
not read it until the request completed or tim...
Description has been truncated
Dependabot will resolve any conf...
Description has been truncated