Skip to content

Bump the nuget-minor-patch group with 21 updates - #3519

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-minor-patch-0aade784c9
Closed

Bump the nuget-minor-patch group with 21 updates#3519
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-minor-patch-0aade784c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Aspire.Hosting from 13.4.6 to 13.5.3.

Release notes

Sourced from Aspire.Hosting's releases.

13.5.3

What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

  • 📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #​19489. (#​19585, backport of #​19579, @​sebastienros)

  • 🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #​19496. (#​19625, backport of #​19590, @​karolz-ms, @​danegsta)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.3

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2

What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

  • 🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#​19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #​19554, @​mitchdenny)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1

What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

  • 🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

  • 🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #​19365. Fixes #​19503. ([#​19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #​19506, @​adamint)

🏷️ Housekeeping

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

13.5.0

Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements.

Highlights

  • 💬 Richer AppHost interactions — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options.
  • 🖥️ Interactive terminal sessions — The experimental WithTerminal() API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in aspire terminal CLI command for attaching from your shell.
  • 🌐 TypeScript AppHost is generally available — Polyglot AppHosts no longer require the ASPIREATS001 experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#.
  • 🛠️ CLI installation and reliability — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while aspire stop --force, aspire update --migrate, aspire doctor, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows.
  • 🎨 Refreshed dashboard — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active.
  • 💻 Rebranded VS Code extension — The extension is now named Aspire and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery.
  • ☸️ More expressive deployments — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory.
  • ☁️ Expanded hosting integrations — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new Aspire.Hosting.Dotnet package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities.

⚠️ Breaking changes

Notable changes include hosting context ServiceProvider properties being renamed to Services, PublishAsConnectionString becoming obsolete in favor of AddConnectionString, removal of aspire ps --resources and --include-hidden in favor of aspire describe, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the Aspire 13.5 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.5.

Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜

Full Changelog: v13.4.6...v13.5.0

Full commit: e076d8e427cb3afb528dbd605acd74c3aea69f94

Commits viewable in compare view.

Updated Aspire.Hosting.PostgreSQL from 13.4.6 to 13.5.3.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.5.3

What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

  • 📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #​19489. (#​19585, backport of #​19579, @​sebastienros)

  • 🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #​19496. (#​19625, backport of #​19590, @​karolz-ms, @​danegsta)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.3

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2

What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

  • 🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#​19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #​19554, @​mitchdenny)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1

What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

  • 🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

  • 🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #​19365. Fixes #​19503. ([#​19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #​19506, @​adamint)

🏷️ Housekeeping

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

13.5.0

Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements.

Highlights

  • 💬 Richer AppHost interactions — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options.
  • 🖥️ Interactive terminal sessions — The experimental WithTerminal() API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in aspire terminal CLI command for attaching from your shell.
  • 🌐 TypeScript AppHost is generally available — Polyglot AppHosts no longer require the ASPIREATS001 experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#.
  • 🛠️ CLI installation and reliability — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while aspire stop --force, aspire update --migrate, aspire doctor, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows.
  • 🎨 Refreshed dashboard — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active.
  • 💻 Rebranded VS Code extension — The extension is now named Aspire and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery.
  • ☸️ More expressive deployments — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory.
  • ☁️ Expanded hosting integrations — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new Aspire.Hosting.Dotnet package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities.

⚠️ Breaking changes

Notable changes include hosting context ServiceProvider properties being renamed to Services, PublishAsConnectionString becoming obsolete in favor of AddConnectionString, removal of aspire ps --resources and --include-hidden in favor of aspire describe, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the Aspire 13.5 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.5.

Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜

Full Changelog: v13.4.6...v13.5.0

Full commit: e076d8e427cb3afb528dbd605acd74c3aea69f94

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Resilience from 10.8.0 to 10.9.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.9.0

Version 10.9.0 is headlined by changes in these areas:

  • AI: New experimental routing APIs center on the abstract RoutingChatClient base class, with SemanticRoutingChatClient as a concrete semantic-routing implementation. Separately, the abstract FailoverChatClient specialization and its concrete OrderedFailoverChatClient implementation add failover routing.
  • AI Evaluation: The generated report gains redesigned Overview, Cases, History, and Comparison views.
  • ASP.NET Core and HTTP diagnostics: The release adds HTTP request latency log enrichment and fixes configuration binding, response-body logging, request-path redaction, and resilience package version handling.
  • Source-generated logging and service discovery: Fixes cover classification type qualification, thread-local state cleanup, and DNS query suffix handling.

Experimental API Changes

New Experimental APIs

  • New experimental API: HTTP request latency log enrichment (EXTEXP0013) #​7602
  • New experimental API: Chat client routing and failover (MEAI001) #​7662

What's Changed

AI (Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI)

  • Add extensible chat client routing #​7662 by @​joshuajyue (co-authored by @​Copilot)
  • Pass the request's options to the selected client #​7685 by @​joshuajyue (co-authored by @​jozkee @​Copilot)
  • AI.Abstractions: fix ExcludeFromSchema dropped under concurrent AIFunction creation #​7677 by @​jozkee (co-authored by @​Copilot)
  • Cap OpenAI dependency version (b10f9c0) by @​jeffhandley (co-authored by @​Copilot)

Note: Microsoft.Extensions.AI.OpenAI constrains its dependency for OpenAI to 2.12.x, preventing OpenAI updates to 2.13.0+ due to an incompatibility. We expect to release Microsoft.Extensions.AI.OpenAI version 10.9.1 during the week of August 17 to address this issue.

HTTP Resilience and Diagnostics (Microsoft.Extensions.Http.Resilience and Microsoft.Extensions.Http.Diagnostics)

  • Fix Grpc.Net.ClientFactory version range check - Fixes #​7565 #​7566 by @​Ghost93
  • Fix response body logging under debugger #​7678 by @​Rimobul
  • Redact outgoing path when route is unknown #​7687 by @​Rimobul
  • Fix HTTP client logging config binding #​7691 by @​Rimobul

ASP.NET Core Extensions (Microsoft.AspNetCore.Diagnostics.Middleware)

  • Rename HttpLatencyTelemetry extensions class and drop redundant TFM guard #​7645 by @​EasyL0ver (co-authored by @​Copilot)
  • Add HTTP request latency log enricher (experimental) #​7602 by @​EasyL0ver (co-authored by @​Copilot)

Logging Source Generator (Microsoft.Gen.Logging)

  • [Microsoft.Gen.Logging] Clear thread-local state when logging throws #​7682 by @​Rimobul
  • [Microsoft.Gen.Logging] Fully qualify classification types #​7689 by @​Rimobul

AI Evaluation (Microsoft.Extensions.AI.Evaluation.Reporting)

  • [Microsoft.Extensions.AI.Evaluation.Reporting] Evaluation report redesign #​7609 by @​grafanaKibana

Project Templates (Microsoft.McpServer.ProjectTemplates)

  • Remove MCP server project template #​7680 by @​jeffhandley (co-authored by @​Copilot)

... (truncated)

10.8.4

This servicing update refreshes the .NET AI project templates ahead of the July 30, 2026 retirement of GitHub Models — removing the GitHub Models provider option and updating template dependencies.

As a result, both the AI Chat Web (aichatweb) and AI Agent Web API (aiagent-webapi) templates now require the AI service provider to be chosen explicitly via --provider; there is no longer a default. One of the following must be selected:

  • --provider azureopenai — Azure OpenAI
  • --provider ollama — Ollama (for local development)
  • --provider openai — OpenAI Platform

Packages in this release

Package Version
Microsoft.Extensions.AI.Templates 10.8.4-preview.3.26379.3
Microsoft.Agents.AI.ProjectTemplates 1.13.0-preview.1.26379.3

What's Changed

Project templates

  • Removed the GitHub Models provider from the AI Chat Web and AI Agent Web API templates, ahead of GitHub Models being fully retired on July 30, 2026. The --provider option is now required with no default (#​7667).
  • Updated AI template dependencies — bumped Aspire.Hosting.AppHost to 13.4.6 and CommunityToolkit.VectorData.SqliteVec to 1.0.0-preview.4 (aligned System.Linq.AsyncEnumerable to 10.0.9), replacing earlier workaround package pins (#​7639).

Full Changelog

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version Note
Microsoft.Extensions.VectorData.Abstractions 10.8.2 Published August 7, 2026
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

Update: August 7, 2026
The Microsoft.Extensions.VectorData.Abstractions package was initially excluded from this release by mistake. Because Microsoft.Extensions.VectorData.ConformanceTests has a dependency on Microsoft.Extensions.VectorData.Abstractions, that led to failures when updating to Microsoft.Extensions.VectorData.ConformanceTests 10.8.2.

Microsoft.Extensions.VectorData.Abstractions was published August 7, 2026 to resolve that issue.

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.8.0 to 10.9.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.9.0

Version 10.9.0 is headlined by changes in these areas:

  • AI: New experimental routing APIs center on the abstract RoutingChatClient base class, with SemanticRoutingChatClient as a concrete semantic-routing implementation. Separately, the abstract FailoverChatClient specialization and its concrete OrderedFailoverChatClient implementation add failover routing.
  • AI Evaluation: The generated report gains redesigned Overview, Cases, History, and Comparison views.
  • ASP.NET Core and HTTP diagnostics: The release adds HTTP request latency log enrichment and fixes configuration binding, response-body logging, request-path redaction, and resilience package version handling.
  • Source-generated logging and service discovery: Fixes cover classification type qualification, thread-local state cleanup, and DNS query suffix handling.

Experimental API Changes

New Experimental APIs

  • New experimental API: HTTP request latency log enrichment (EXTEXP0013) #​7602
  • New experimental API: Chat client routing and failover (MEAI001) #​7662

What's Changed

AI (Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI)

  • Add extensible chat client routing #​7662 by @​joshuajyue (co-authored by @​Copilot)
  • Pass the request's options to the selected client #​7685 by @​joshuajyue (co-authored by @​jozkee @​Copilot)
  • AI.Abstractions: fix ExcludeFromSchema dropped under concurrent AIFunction creation #​7677 by @​jozkee (co-authored by @​Copilot)
  • Cap OpenAI dependency version (b10f9c0) by @​jeffhandley (co-authored by @​Copilot)

Note: Microsoft.Extensions.AI.OpenAI constrains its dependency for OpenAI to 2.12.x, preventing OpenAI updates to 2.13.0+ due to an incompatibility. We expect to release Microsoft.Extensions.AI.OpenAI version 10.9.1 during the week of August 17 to address this issue.

HTTP Resilience and Diagnostics (Microsoft.Extensions.Http.Resilience and Microsoft.Extensions.Http.Diagnostics)

  • Fix Grpc.Net.ClientFactory version range check - Fixes #​7565 #​7566 by @​Ghost93
  • Fix response body logging under debugger #​7678 by @​Rimobul
  • Redact outgoing path when route is unknown #​7687 by @​Rimobul
  • Fix HTTP client logging config binding #​7691 by @​Rimobul

ASP.NET Core Extensions (Microsoft.AspNetCore.Diagnostics.Middleware)

  • Rename HttpLatencyTelemetry extensions class and drop redundant TFM guard #​7645 by @​EasyL0ver (co-authored by @​Copilot)
  • Add HTTP request latency log enricher (experimental) #​7602 by @​EasyL0ver (co-authored by @​Copilot)

Logging Source Generator (Microsoft.Gen.Logging)

  • [Microsoft.Gen.Logging] Clear thread-local state when logging throws #​7682 by @​Rimobul
  • [Microsoft.Gen.Logging] Fully qualify classification types #​7689 by @​Rimobul

AI Evaluation (Microsoft.Extensions.AI.Evaluation.Reporting)

  • [Microsoft.Extensions.AI.Evaluation.Reporting] Evaluation report redesign #​7609 by @​grafanaKibana

Project Templates (Microsoft.McpServer.ProjectTemplates)

  • Remove MCP server project template #​7680 by @​jeffhandley (co-authored by @​Copilot)

... (truncated)

10.8.4

This servicing update refreshes the .NET AI project templates ahead of the July 30, 2026 retirement of GitHub Models — removing the GitHub Models provider option and updating template dependencies.

As a result, both the AI Chat Web (aichatweb) and AI Agent Web API (aiagent-webapi) templates now require the AI service provider to be chosen explicitly via --provider; there is no longer a default. One of the following must be selected:

  • --provider azureopenai — Azure OpenAI
  • --provider ollama — Ollama (for local development)
  • --provider openai — OpenAI Platform

Packages in this release

Package Version
Microsoft.Extensions.AI.Templates 10.8.4-preview.3.26379.3
Microsoft.Agents.AI.ProjectTemplates 1.13.0-preview.1.26379.3

What's Changed

Project templates

  • Removed the GitHub Models provider from the AI Chat Web and AI Agent Web API templates, ahead of GitHub Models being fully retired on July 30, 2026. The --provider option is now required with no default (#​7667).
  • Updated AI template dependencies — bumped Aspire.Hosting.AppHost to 13.4.6 and CommunityToolkit.VectorData.SqliteVec to 1.0.0-preview.4 (aligned System.Linq.AsyncEnumerable to 10.0.9), replacing earlier workaround package pins (#​7639).

Full Changelog

10.8.3

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.3
Microsoft.Extensions.AI.Abstractions 10.8.3
Microsoft.Extensions.AI.OpenAI 10.8.3

Experimental API Changes

Experimental API behavior updates

  • Updated serialization behavior for experimental ToolApprovalRequestContent.RequiresConfirmation so it no longer leaks into consumer source-generated AIContent JSON metadata unless approval APIs are intentionally used (#​7659).

What's Changed

AI abstractions and serialization

  • Fixed MEAI001 leakage from RequiresConfirmation in source-generated AIContent contexts by using an internal JSON-included backing member while keeping the public experimental member ignored for source-generation metadata (#​7659).

Test Improvements

  • Added stabilization regression coverage to verify consumer source-generated List<AIContent> contexts compile and round-trip without requiring MEAI001 suppression (#​7659).

Full Changelog

10.8.2

This servicing release updates Microsoft.Extensions.VectorData.ConformanceTests to 10.8.2 and includes targeted test framework migration fixes.

Packages in this release

Package Version Note
Microsoft.Extensions.VectorData.Abstractions 10.8.2 Published August 7, 2026
Microsoft.Extensions.VectorData.ConformanceTests 10.8.2

Update: August 7, 2026
The Microsoft.Extensions.VectorData.Abstractions package was initially excluded from this release by mistake. Because Microsoft.Extensions.VectorData.ConformanceTests has a dependency on Microsoft.Extensions.VectorData.Abstractions, that led to failures when updating to Microsoft.Extensions.VectorData.ConformanceTests 10.8.2.

Microsoft.Extensions.VectorData.Abstractions was published August 7, 2026 to resolve that issue.

What's Changed

AI

  • Move Microsoft.Extensions.VectorData.ConformanceTests to xUnit 3 #​7636 by @​adamsitnik (co-authored by @​Copilot)

Acknowledgements

  • @​roji reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.1...v10.8.2

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package Version
Microsoft.Extensions.AI 10.8.1
Microsoft.Extensions.AI.Abstractions 10.8.1
Microsoft.Extensions.AI.OpenAI 10.8.1

What's Changed

AI

  • Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #​7617 by @​westey-m
  • Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #​7629 by @​rogerbarreto (co-authored by @​tarekgh)

Acknowledgements

  • @​jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

Commits viewable in compare view.

Updated Microsoft.Orleans.Core from 10.2.2 to 10.3.1.

Release notes

Sourced from Microsoft.Orleans.Core's releases.

10.3.1

The most significant change in this release over 10.3.0 is the format used by the version contract compatibility analyzers. The other changes are test and docs fixes.

What's Changed

Full Changelog: dotnet/orleans@v10.3.0...v10.3.1

10.3.0

Orleans 10.3.0

Orleans 10.3.0 expands the platform across clustering, streaming, persistence, integrations, serialization, and developer tooling while delivering a broad reliability and performance pass. Major outcomes include stronger distributed-directory and membership behavior, new streaming and storage providers, hardened transactions and durable jobs, incremental source generation, safer JSON storage deserialization, and new application templates. Alongside these features and fixes, the release optimizes key runtime paths, comprehensively refreshes the docs, strengthens testing and CI, and updates dependencies and repository maintenance.

Compatibility notes

[!IMPORTANT]
Review these changes before upgrading. This release contains three intentionally behavior-changing updates.

  • Default JSON storage serializer type allow-list (#​10268). The default Newtonsoft.Json-based Orleans storage serializer now resolves $type metadata only for types permitted by Orleans' configured type filters and manifest. Existing wire data remains readable when its types are allowed; [GenerateSerializer] types and standard permitted BCL types continue to work without changes. If persisted, streamed, or transactional JSON contains other types, reads now fail with an actionable JsonSerializationException. Prefer registering those types through TypeManifestOptions.AllowedTypes, [GenerateSerializer], ITypeNameFilter, or ITypeFilter; OrleansJsonSerializerOptions.AllowAllTypes = true restores the former permissive JSON behavior when a narrowly scoped allow-list is not practical.
  • Updated RPC semantic convention keys (#​10354). Orleans activities now emit the current OpenTelemetry RPC key rpc.system.name; Orleans-specific service, target, and source metadata move to orleans.rpc.service, orleans.rpc.target_id, and orleans.rpc.source_id. The runtime-side rpc.method value is now qualified as <interface>/<method>, and affected ActivitySource versions are incremented. Update dashboards, alerts, collectors, and queries which depend on the legacy rpc.system, rpc.service, rpc.orleans.target_id, or rpc.orleans.source_id keys or the previous method value.
  • Grain context configured before construction (#​10565). Orleans now deterministically applies IConfigureGrainContext actions before grain construction, so constructors can observe fully configured context state. Custom IGrainContextActivator implementations must migrate from CreateContext(GrainAddress) to CreateContext(GrainAddress, IConfigureGrainContext[]) and apply the supplied configurators before constructing the grain. Stateless-worker configurators continue to apply to the outer stateless-worker context.

Highlights

Runtime, clustering & resilience

Streaming

Storage, persistence, journaling, durable jobs & transactions

Providers & integrations

Serialization, code generation & analyzers

  • The source generator is now incremental, generates provider metadata at build time, avoids runtime provider scanning, and supports record-parameter field IDs and custom grain-call return types (#​10035, #​10493, #​10566, #​10495, #​10682).
  • Serialization reduces codec and buffer allocations, adds type/assembly allow-list helpers, and clarifies type-trust configuration (#​10301, #​10340, #​10668, #​10228, #​10424).
  • Analyzers detect RPC contract changes and provide improved diagnostic guidance (#​10337, #​10832).

Developer experience, templates, samples & docs

10.3.0-rc.1

What's Changed

Commits viewable in compare view.

Updated Microsoft.Orleans.Runtime from 10.2.2 to 10.3.1.

Release notes

Sourced from Microsoft.Orleans.Runtime's releases.

10.3.1

The most significant change in this release over 10.3.0 is the format used by the version contract compatibility analyzers. The other changes are test and docs fixes.

What's Changed

Full Changelog: dotnet/orleans@v10.3.0...v10.3.1

10.3.0

Orleans 10.3.0

Orleans 10.3.0 expands the platform across clustering, streaming, persistence, integrations, serialization, and developer tooling while delivering a broad reliability and performance pass. Major outcomes include stronger distributed-directory and membership behavior, new streaming and storage providers, hardened transactions and durable jobs, incremental source generation, safer JSON storage deserialization, and new application templates. Alongside these features and fixes, the release optimizes key runtime paths, comprehensively refreshes the docs, strengthens testing and CI, and updates dependencies and repository maintenance.

Compatibility notes

[!IMPORTANT]
Review these changes before upgrading. This release contains three intentionally behavior-changing updates.

  • Default JSON storage serializer type allow-list (#​10268). The default Newtonsoft.Json-based Orleans storage serializer now resolves $type metadata only for types permitted by Orleans' configured type filters and manifest. Existing wire data remains readable when its types are allowed; [GenerateSerializer] types and standard permitted BCL types continue to work without changes. If persisted, streamed, or transactional JSON contains other types, reads now fail with an actionable JsonSerializationException. Prefer registering those types through TypeManifestOptions.AllowedTypes, [GenerateSerializer], ITypeNameFilter, or ITypeFilter; OrleansJsonSerializerOptions.AllowAllTypes = true restores the former permissive JSON behavior when a narrowly scoped allow-list is not practical.
  • Updated RPC semantic convention keys (#​10354). Orleans activities now emit the current OpenTelemetry RPC key rpc.system.name; Orleans-specific service, target, and source metadata move to orleans.rpc.service, orleans.rpc.target_id, and orleans.rpc.source_id. The runtime-side rpc.method value is now qualified as <interface>/<method>, and affected ActivitySource versions are incremented. Update dashboards, alerts, collectors, and queries which depend on the legacy rpc.system, rpc.service, rpc.orleans.target_id, or rpc.orleans.source_id keys or the previous method value.
  • Grain context configured before construction (#​10565). Orleans now deterministically applies IConfigureGrainContext actions before grain construction, so constructors can observe fully configured context state. Custom IGrainContextActivator implementations must migrate from CreateContext(GrainAddress) to CreateContext(GrainAddress, IConfigureGrainContext[]) and apply the supplied configurators ...

Description has been truncated

Dependabot ...

Description has been truncated

@dependabot
Bump the nuget-minor-patch group with 21 updates
9456190 
Bumps Aspire.Hosting from 13.4.6 to 13.5.3
Bumps Aspire.Hosting.PostgreSQL from 13.4.6 to 13.5.3
Bumps Microsoft.Extensions.Http.Resilience from 10.8.0 to 10.9.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.8.0 to 10.9.0
Bumps Microsoft.Orleans.Core from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.Runtime from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.Sdk from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.Serialization.SystemTextJson from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.Server from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.Streaming from 10.2.2 to 10.3.1
Bumps Microsoft.Orleans.TestingHost from 10.1.0 to 10.3.1
Bumps ModelContextProtocol.AspNetCore from 1.2.0 to 1.4.1
Bumps ModelContextProtocol.Core from 1.2.0 to 1.4.1
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.17.0 to 1.18.0
Bumps SkiaSharp from 3.119.2 to 3.119.4
Bumps SkiaSharp.NativeAssets.Linux.NoDependencies from 3.119.2 to 3.119.4
Bumps Testcontainers from 4.14.0 to 4.15.0

---
updated-dependencies:
- dependency-name: Aspire.Hosting
  dependency-version: 13.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.PostgreSQL
  dependency-version: 13.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Core
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Runtime
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Sdk
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Serialization.SystemTextJson
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Server
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.Streaming
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Orleans.TestingHost
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: ModelContextProtocol.AspNetCore
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: ModelContextProtocol.Core
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: SkiaSharp
  dependency-version: 3.119.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: SkiaSharp.NativeAssets.Linux.NoDependencies
  dependency-version: 3.119.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 7, 2026
@meshweaver-cloud
meshweaver-cloud Bot enabled auto-merge September 7, 2026 03:45
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Test Results

0 files   -    16  0 suites   - 16   0s ⏱️ - 11m 47s
0 tests  - 5 928  0 ✅  - 5 734  0 💤  - 194  0 ❌ ±0 
0 runs   - 5 929  0 ✅  - 5 735  0 💤  - 194  0 ❌ ±0 

Results for commit 9456190. ± Comparison against base commit e64689e.

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

This was referenced Sep 7, 2026
Merged
Merged
@rbuergi

rbuergi commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Diagnosed — this PR is red on two independent causes, and neither is a defect in the sweep itself. Both now have fixes in flight; nothing here needs a human decision.

1. Dependency licences — Aspire.Hosting 13.4.6 -> 13.5.3

LICENCE GATE FAILED - dependencies incompatible with Apache-2.0 / MIT:
  Json.More.Net   3.0.1 [transitive] -> OSMF-maintenance-fee
  JsonPatch.Net   5.0.2 [transitive] -> OSMF-maintenance-fee
  JsonPointer.Net 7.0.1 [transitive] -> OSMF-maintenance-fee

This is the hold recorded in /Directory.Packages.props — "🚨 THE ASPIRE FAMILY IS HELD AT 13.4.6 ON PURPOSE — do not let a dependency sweep move it" — and until now nothing made that true: the rule existed only in prose, so the sweep proposed the bump anyway and the licence gate caught it one job before the build. #3537 adds the ignore: block that actually enforces it, with its own exit condition (aspire#19498 removes the JsonPatch.Net dependency; take the first release whose nuspec no longer lists it, then delete the block).

2. Build solution (once) — Microsoft.Orleans 10.2.2 -> 10.3.1

test/MeshWeaver.Hosting.Orleans.TestBase/TwoSiloCacheUpdateFixture.cs(113,28): error CS8602
test/MeshWeaver.Hosting.Orleans.TestBase/SharedOrleansFixture.cs(234,24):      error CS8602

Microsoft.Orleans.TestingHost annotates TestCluster.Primary as SiloHandle? from 10.3.1 on; it is non-nullable at the 10.1.0 currently pinned. Reproduced locally by applying only this bump, and fixed in #3541 — verified clean under both 10.3.1 and main's 10.2.2, so it lands independently of any bump.

What happens to this PR

Once #3537 and #3541 are in, the next sweep regenerates this group without the Aspire bump and with the Orleans bump compiling — i.e. green, delivering the other 19 updates. No action needed on this branch.

Two of the other three reds turned out not to be defects either, for the record: #3527/#3528 were two halves of one atomic SkiaSharp change (managed vs native, plus Svg.Skia's floor, which neither touched), now grouped as skia-stack in #3537; #3526 was ImageSharp 4.x, which enforces a paid licence in MSBuild and cannot build here at all.

auto-merge was automatically disabled September 7, 2026 06:30

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/nuget/nuget-minor-patch-0aade784c9 branch September 7, 2026 06:30
@rbuergi rbuergi mentioned this pull request Sep 9, 2026
Open
6 of 26 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

DevTunnel port resources are Running but Dashboard URLs are empty in 13.5.0 Graph view crashes with 'multiple root elements' on AddBlobs

1 participant

@rbuergi