Bump the grouped-dependencies group with 26 updates

[dependabot]

Updated Asp.Versioning.Mvc from 8.1.1 to 10.0.0.

Release notes

Sourced from Asp.Versioning.Mvc's releases.

10.0.0

The official release for 10.0 is here! In addition to the changes in the preview releases, there are a few additional changes.

Features

All Platforms

• ApiVersionAttribute, MapToVersionAttribute, and AdvertiseApiVersionsAttribute all now have a constructor which can support the date format without being a string; for example, [ApiVersion(2026, 04, 01)]

ASP.NET Core OpenAPI

• XmlCommentsTransformer is now resolved via DI, which allows it to be re-registered with a user-defined file path
• Public types and members are now virtual for developer extensibility

Fixes

ASP.NET Core OpenAPI

• Fix comparison between entry and calling assembly (#​1175)
• Ensure keyed services are registered with a lowercase key (#​1176)
• Fix nested key service resolution (#​1177)
• Implement IKeyedServiceProvider when injecting ApiVersion (#​1178)

Breaking Changes

ASP.NET Core OpenAPI

• OpenAPI documents use "enum": ["1.0"] instead of "default": "1.0"
  • This has a similar effect, but removes the free-form input when the value is bounded
  • When optional, the enum value can still be deleted/removed
  • Some UIs, such as Scalar, still provide a way to provide an enumerated value that isn't in the list

Release Notes

• Asp.Versioning.OData is being released as rc.1 because Microsoft.AspNetCore.OData is only at preview.2
• Asp.Versioning.OpenAPI is being released as rc.1 pending the outcome of dotnet/aspnetcore#​66408
  • If the package can be released without requiring the explicit use of Reflection, that is the preference
  • No additional changes are planned unless bugs are reported

Feedback

Thanks to the contributors on this release whether it was code contributions or test driving the previews. Special thanks to @​sander1095 for being a strong advocate and helping to bring even more visibility to the project.

10.0.0-preview.2

This release is a quick iteration which contains minor fixes based on feedback from Preview 1.

Trying out previews is always a big ask. The OpenAPI extensions are net new, so I really am looking for some community support to flush out any edge cases I may have been missed before releasing officially. All other libraries are stable.

Aside from whatever the community may report, there are only two final things I'm considering for the final release:

1. gRPC versioning support, which I'm waiting on grpc/grpc-dotnet#​2690 and grpc/grpc-dotnet#​2693
2. Coordination with Microsoft to open up types in Microsoft.AspNetCore.OpenAPI so I don't have to resort to Reflection for integration

If these are not able to be completed within the next few weeks, then I will officially release the stable libraries. The gRPC support will then come in a future, likely minor version, release. The OpenAPI extensions may stay in preview as AOT will likely be broken.

Features

All Platforms

• Support _ prefix character when extracting API versions from a .NET namespace (#​1172)
• Generate software bill of materials (SBOM) (#​1100)

Fixes

ASP.NET Core with OpenAPI

• Build-time OpenAPI documents have empty paths (#​1165, #​1168)
• Missing XML Comments (#​1169)
• Support <example> tags (#​1170)

Breaking Changes

The OpenAPI extensions for API Versioning (e.g. x-api-versioning) will now use a nested links property rather than a simple array. This allows the schema to be open for possible future enhancements.

Preview 1

{
    "x-api-versioning":
    [
        {
            "title": "Version Policy",
            "type": "text/html",
            "rel": "info",
            "url": "http://my.api.com/policies/versioning.html"
        }
    ]
}

Preview 2+

{
 ... (truncated)

## 10.0.0-preview.1

This is a major release that includes new, publicly visible API changes as well as a rollup of bug fixes. This is an initial preview release that is primarily focused on improving OpenAPI integration. Additional features will come in the next preview. The wiki has not be fully updated - yet, but that will also occur in the near future.

These are preview features and changes. Please report issues if you find them. Feel free to start a [discussion](../../discussions) about the changes in the forthcoming official release.

# Features

## All Platforms

- Support for the `deprecation` response header as defined by [RFC 9745](https://www.rfc-editor.org/rfc/rfc9745.html) (#​1128)

## ASP.NET Core

- Integration with the [Microsoft.AspNetCore.OpenApi](https://www.nuget.org/packages/Microsoft.AspNetCore.OpenApi) library
  - These features in the new [Asp.Versioning.OpenApi](https://www.nuget.org/packages/Asp.Versioning.OpenApi) library
  - OpenAPI documents are now generated per API version
  - Sunset and deprecation policies are automatically included with standard (English) text, but can be customized
  - Sunset and deprecation policies links are included in OpenAPI documents via the `x-api-versioning` extension
  - The versioned `HttpClient` can now read and report on sunset and deprecation policies
  - All [example projects](../../tree/main/examples/AspNetCore) have been updated to use [Scalar](https://scalar.com/)

### Example

The following provides an example of a bare minimum setup:

```c#
var builder = WebApplication.CreateBuilder( args );
var services = builder.Services;

services.AddApiVersioning()
        .AddApiExplorer()
        .AddOpenApi();

var app = builder.Build();
var hello = app.NewVersionedApi( "HelloWorld" );
var v1 = hello.MapGroup( "/hello-world" ).HasApiVersion( 1.0 );
var v2 = hello.MapGroup( "/hello-world" ).HasApiVersion( 2.0 );

v1.MapGet( "/", ( ApiVersion version ) => $"Hello world from v{version}" );
v2.MapGet( "/", ( ApiVersion version ) => $"Hello world from v{version}" );

if ( app.Environment.IsDevelopment() )
{
    app.MapOpenApi().WithDocumentPerVersion();
}

app.Run();

The key differences from what you may be currently doing:

... (truncated)

Commits viewable in compare view.

Updated Aspire.Hosting.AppHost from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.CosmosDB from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Azure.CosmosDB's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.Functions from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Azure.Functions's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.ServiceBus from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Azure.ServiceBus's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.Storage from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Azure.Storage's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.StackExchange.Redis.OutputCaching from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.StackExchange.Redis.OutputCaching's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated coverlet.collector from 8.0.1 to 10.0.0.

Release notes

Sourced from coverlet.collector's releases.

10.0.0

Improvements

• Unique Report Filenames (coverlet.MTP and AzDO) #​1866
• Add --coverlet-file-prefix option for unique report files #​1869
• Introduce .NET 10 support #​1823

Fixed

• Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
• Fix [BUG] Missing Coverage after moving to MTP #​1843
• Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
• Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
• Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
• Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
• Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

• Add comprehensive async method tests and documentation for issue #​1864
• Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
• Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Azure.Cosmos from 3.58.0 to 3.59.0.

Release notes

Sourced from Microsoft.Azure.Cosmos's releases.

3.59.0

Added

• 5579 Change Feed Processor: Adds Lease container export support
• 5709 Performance: Adds caching for URL-encoded AAD authorization signature
• 5731 DNS dot-suffix: Adds TCP DNS dot-suffix for Direct mode to avoid Kubernetes ndots latency
• 5755 Exceptionless: Adds enabling exception less 400 status code
• 5756 Exceptionless: Adds enabling exception less 404/1002 status code
• 5757 Exceptionless: Adds enabling exception less 403
• 5779 Direct: Adds Direct package version bump to 3.42.4
• 5786 Region Availability: Adds missing regions from Direct 3.42.4
• 5788 Socket Handler: Adds HTTP/2 PING keep-alive to detect broken connections in pool

Fixed

• 5553 NativeDLLs: Fixes Conditionally include win-x64 native DLLs based on RuntimeIdentifier
• 5588 LINQ: Fixes memory leak from Expression.Compile() in all call sites
• 5617 ChangeFeedProcessor: Fixes first-change skip during initial startup by anchoring StartTime
• 5636 CosmosClientBuilder: Fixes self-referencing loop in GetSerializedConfiguration with STJ TypeInfoResolver
• 5748 Routing: Fixes GetOverlappingRanges CPU overhead from repeated JSON deserialization
• 5807 ChangeFeedProcessor: Fixes lease de-duplication for /partitionKey-partitioned lease containers

See full changelog: https://github.com/Azure/azure-cosmos-dotnet-v3/blob/master/changelog.md#​3590

3.59.0-preview.0

3.59.0-preview.0 - 2026-3-20

Added

• 5502 VectorIndex Policy: Adds Support for QuantizerType in IndexingPolicy
• 5634 Semantic Reranking: Adds response body in semantic reranking error responses
• 5685 Read Consistency Strategy: Adds Read Consistency Strategy option for read requests
• 5447 Per Partition Automatic Failover: Adds Hub Region Processing Only While Routing Requests Failed with 404/1002 for single master accounts
• 5551 HPK: Adds internal CosmosClientOptions flag UseLengthAwareRangeComparer for length aware range comparer rollout
• 5582 Query: Adds ability to choose global vs local/focused statistics for FullTextScore
• 5610 Refactors N-Region Synchronous Commit feature to use IServiceConfigurationReaderVNext interface.
• 5693 ThinClient Integration: Adds Enable Multiple Http2 connection on SocketsHttpHandler
• 5614 ThinClient Integration: Adds support for QueryPlan in thinclient mode

Fixed

• 5597 CosmosClient: Fixes ObjectDisposedException message when client is disposed during request
• 5613 CrossRegionHedgingAvailabilityStrategy: Fixes ArgumentNullException race condition in hedging cancellation
• 5650 Batch: Fixes null ErrorMessage when promoting status from MultiStatus response
• 5651 Serializer: Fixes unsafe stream cast in FromStream
• 5697 ResourceThrottleRetryPolicy: Fixes cumulativeRetryDelay tracking when x-ms-retry-after-ms header is absent

Commits viewable in compare view.

Updated Microsoft.Azure.Functions.Worker from 2.51.0 to 2.52.0.

Release notes

Sourced from Microsoft.Azure.Functions.Worker's releases.

2.52.0

What's Changed

Microsoft.Azure.Functions.Worker (metapackage) 2.52.0

• Update Microsoft.Azure.Functions.Worker.Core to 2.52.0
• Update Microsoft.Azure.Functions.Worker.Grpc to 2.52.0

Microsoft.Azure.Functions.Worker.Core 2.52.0

• Add support for propagating trace context tags from worker to host (#​3303)
• Add support for propagating OpenTelemetry Baggage to the worker. Requires use with the OpenTelemetry Extension to work end to end (#​3319).

Microsoft.Azure.Functions.Worker.Grpc 2.52.0

• Update protobuf version to v1.12.0-protofile and add support for propagating tags from the worker to the functions host (#​3303).
• Update protobuf version to v1.13.0-protofile to add support for propagating OpenTelemetry baggage to the worker (#​3319).

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Json from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Resilience from 10.4.0 to 10.5.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

1. Rename VectorStoreVectorAttribute constructor parameter #​7460
   • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
   • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

• HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

• Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
• Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
• Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
• Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
• Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
• Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
• Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

• Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
• Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

• Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
• Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

• Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

• Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

• Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

... (truncated)

10.4.1

This release of the Microsoft.Extensions.AI packages adds new experimental APIs for Realtime client sessions and Text-to-Speech, along with OpenTelemetry and middleware improvements.

Packages in this release

Package	Version
Microsoft.Extensions.AI.Abstractions	10.4.1
Microsoft.Extensions.AI	10.4.1
Microsoft.Extensions.AI.OpenAI	10.4.1

Experimental API Changes

New Experimental APIs

• New experimental API: Realtime Client Sessions #​7285 and #​7399
• New experimental API: Text-to-Speech Client #​7381

Changes to Experimental APIs

• Hosted File Download Stream: write-path methods now explicitly throw NotSupportedException #​7394

What's Changed

AI

• Add ITextToSpeechClient abstraction, middleware, and OpenAI implementation #​7381 by @​stephentoub
• Realtime Client Proposal #​7285 by @​tarekgh
• Add VoiceActivityDetection options to realtime session abstractions #​7399 by @​tarekgh
• Make UriContent mediaType parameter optional with inference from URI file extension #​7398 by @​stephentoub (co-authored by @​Copilot)
• Emit gen_ai.client.operation.exception via ILogger LoggerMessage on OpenTelemetry instrumentation classes #​7379 by @​stephentoub (co-authored by @​Copilot)
• Support invoke_workflow as an equivalent parent span to invoke_agent in FunctionInvokingChatClient #​7382 by @​stephentoub (co-authored by @​Copilot)
• Make HostedFileDownloadStream explicitly read-only #​7394 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

• Document JSON schema derivation for return types in AIFunctionFactory #​7400 by @​stephentoub (co-authored by @​Copilot)

Test Improvements

• Fix test warnings #​7369 by @​jozkee
• Add tests for JSON deserialization of serializable types #​7373 by @​stephentoub (co-authored by @​Copilot)

Repository Infrastructure Updates

• Update Package Validation Baseline to 10.4.0 #​7389 by @​jeffhandley (co-authored by @​Copilot)
• Update ModelContextProtocol libraries to version 1.0.0 #​7340 by @​stephentoub (co-authored by @​Copilot)

Acknowledgements

• @​eiriktsarpalis @​ericstj @​CodeBlanch @​lmolkova @​adamsitnik @​joperezr reviewed pull requests
  ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.5 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.4.0 to 10.5.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

1. Rename VectorStoreVectorAttribute constructor parameter #​7460
   • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
   • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

• HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

• Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
• Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
• Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
• Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
• Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
• Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
• Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

• Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
• Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

• Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
• Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

• Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

• Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

• Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

... (truncated)

10.4.1

This release of the Microsoft.Extensions.AI packages adds new experimental APIs for Realtime client sessions and Text-to-Speech, along with OpenTelemetry and middleware improvements.

Packages in this release

Package	Version
Microsoft.Extensions.AI.Abstractions	10.4.1
Microsoft.Extensions.AI	10.4.1
Microsoft.Extensions.AI.OpenAI	10.4.1

Experimental API Changes

New Experimental APIs

• New experimental API: Realtime Client Sessions #​7285 and #​7399
• New experimental API: Text-to-Speech Client #​7381

Changes to Experimental APIs

• Hosted File Download Stream: write-path methods now explicitly throw NotSupportedException #​7394

What's Changed

AI

• Add ITextToSpeechClient abstraction, middleware, and OpenAI implementation #​7381 by @​stephentoub
• Realtime Client Proposal #​7285 by @​tarekgh
• Add VoiceActivityDetection options to realtime session abstractions #​7399 by @​tarekgh
• Make UriContent mediaType parameter optional with inference from URI file extension #​7398 by @​stephentoub (co-authored by @​Copilot)
• Emit gen_ai.client.operation.exception via ILogger LoggerMessage on OpenTelemetry instrumentation classes #​7379 by @​stephentoub (co-authored by @​Copilot)
• Support invoke_workflow as an equivalent parent span to invoke_agent in FunctionInvokingChatClient #​7382 by @​stephentoub (co-authored by @​Copilot)
• Make HostedFileDownloadStream explicitly read-only #​7394 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

• Document JSON schema derivation for return types in AIFunctionFactory #​7400 by @​stephentoub (co-authored by @​Copilot)

Test Improvements

• Fix test warnings #​7369 by @​jozkee
• Add tests for JSON deserialization of serializable types #​7373 by @​stephentoub (co-authored by @​Copilot)

Repository Infrastructure Updates

• Update Package Validation Baseline to 10.4.0 #​7389 by @​jeffhandley (co-authored by @​Copilot)
• Update ModelContextProtocol libraries to version 1.0.0 #​7340 by @​stephentoub (co-authored by @​Copilot)

Acknowledgements

• @​eiriktsarpalis @​ericstj @​CodeBlanch @​lmolkova @​adamsitnik @​joperezr reviewed pull requests
  ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.15.2 to 1.15.3.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

• NuGet: OpenTelemetry v1.15.3

  • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
    (#​7069)

  • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
    unspecified or out-of-range severities without returning invalid enum values.
    (#​7092)

  • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
    infinite values as invalid and fall back to the default ratio when using
    traceidratio and parentbased_traceidratio samplers.
    (#​7103)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.15.3

  • Fix baggage and trace headers not respecting the maximum length in some cases.
    (#​7061)

  • Improve efficiency of parsing of baggage and B3 propagation headers.
    (#​7061)

  • Breaking change: Fixed tracestate parsing to reject keys that do not
    begin with a lowercase letter, including keys beginning with digits, to
    align with the W3C Trace Context specification.
    (#​7065)

  • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
    separators when parsing the baggage header, as required by the
    W3C Baggage specification.
    (#​7009)

  • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
    from values when parsing the baggage header.
    (#​7009)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

  No notable changes.

  See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.3-beta.1

  • Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
    not being sanitized, resulting in malformed metric names.
    (#​6187)

  • Fixed Prometheus metric serialization to handle empty label names without
    throwing during scrape rendering.
    (#​7077)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.3-beta.1

  • Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
    not being sanitized, resulting in malformed metric names.
    (#​6187)

  • Fixed Prometheus metric serialization to handle empty label names without
    throwing during scrape rendering.
    (#​7077)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.15.3-beta.1

  • Fixes support for byte, short, int, and float attributes.
    (#​7080)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.15.2 to 1.15.3.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

• NuGet: OpenTelemetry v1.15.3

  • Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
    (#​7069)

  • Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
    unspecified or out-of-range severities without returning invalid enum values.
    (#​7092)

  • Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
    infinite values as invalid and fall back to the default ratio when using
    traceidratio and parentbased_traceidratio samplers.
    (#​7103)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.15.3

  • Fix baggage and trace headers not respecting the maximum length in some cases.
    (#​7061)

  • Improve efficiency of parsing of baggage and B3 propagation headers.
    (#​7061)

  • Breaking change: Fixed tracestate parsing to reject keys that do not
    begin with a lowercase letter, including keys beginning with digits, to
    align with the W3C Trace Context specification.
    (#​7065)

  • Fixed BaggagePropagator to trim optional whitespace (OWS) around =
    separators when parsing the baggage header, as required by the
    W3C Baggage specification.
    (#​7009)

  • Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
    from values when parsing the baggage header.
    (#​7009)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

  No notable changes.

  See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.3-beta.1

  • Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
    not being sanitized, resulting in malformed metric names.
    (#​6187)

  • Fixed Prometheus metric serialization to handle empty label names without
    throwing during scrape rendering.
    (#​7077)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.3-beta.1

  • Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
    not being sanitized, resulting in malformed metric names.
    (#​6187)

  • Fixed Prometheus metric serialization to handle empty label names without
    throwing during scrape rendering.
    (#​7077)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Shims.OpenTracing v1.15.3-beta.1

  • Fixes support for byte, short, int, and float attributes.
    (#​7080)

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​7125)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.15.1 to 1.15.2.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.15.2

• NuGet: OpenTelemetry.Exporter.Geneva v1.15.2

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.15.0 to 1.15.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.15.1

• NuGet: OpenTelemetry.Instrumentation.AspNet v1.15.1

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule v1.15.1

  • Propagate baggage before Activity is created.
    (#​3820)

  See CHANGELOG for details.

1.15.1-beta.2

• NuGet: OpenTelemetry.Instrumentation.Wcf v1.15.1-beta.2

  • Revert System.Security.Cryptography.Xml dependency version update for
    .NET 8, 9, and 10 to 4.7.1 released in 1.15.1-beta.1 introduced in #​4103.
    (#​4266)

  See CHANGELOG for details.

1.15.1-beta.1

• NuGet: OpenTelemetry.Extensions.Enrichment v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  • Fixed trace enrichment callbacks so exceptions thrown by user-provided
    enrichers or enrichment actions no longer interrupt trace processing.
    (#​4165)

  See CHANGELOG for details.

1.15.1-alpha.1

• NuGet: OpenTelemetry.Instrumentation.EventCounters v1.15.1-alpha.1

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Runtime from 1.15.0 to 1.15.1.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.15.1

• NuGet: OpenTelemetry.Instrumentation.AspNet v1.15.1

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AspNet.TelemetryHttpModule v1.15.1

  • Propagate baggage before Activity is created.
    (#​3820)

  See CHANGELOG for details.

1.15.1-beta.2

• NuGet: OpenTelemetry.Instrumentation.Wcf v1.15.1-beta.2

  • Revert System.Security.Cryptography.Xml dependency version update for
    .NET 8, 9, and 10 to 4.7.1 released in 1.15.1-beta.1 introduced in #​4103.
    (#​4266)

  See CHANGELOG for details.

1.15.1-beta.1

• NuGet: OpenTelemetry.Extensions.Enrichment v1.15.1-beta.1

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  • Fixed trace enrichment callbacks so exceptions thrown by user-provided
    enrichers or enrichment actions no longer interrupt trace processing.
    (#​4165)

  See CHANGELOG for details.

1.15.1-alpha.1

• NuGet: OpenTelemetry.Instrumentation.EventCounters v1.15.1-alpha.1

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  See CHANGELOG for details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions