Bump Akka.Persistence.Hosting from 1.5.67 to 1.5.68

[dependabot]

Updated Akka.Persistence.Hosting from 1.5.67 to 1.5.68.

Release notes

Sourced from Akka.Persistence.Hosting's releases.

1.5.68

1.5.68 May 18th 2026

Security Fixes

• Resolve GHSA-g94r-2vxg-569j by bumping OpenTelemetry minimum to 1.10.0 - OpenTelemetry.Api 1.9.0 has a known moderate severity vulnerability. The minimum OpenTelemetry version floor has been raised from 1.9.0 to 1.10.0, and the Microsoft.Extensions.Logging floor has been raised to 9.0.0. Downstream consumers that previously resolved to the vulnerable OpenTelemetry.Api 1.9.0 will now pull the safe 1.10.0 release.

Bug Fixes

• Fix implicit-sender leak under xUnit v3 parallel execution in Akka.Hosting.TestKit - Under xUnit v3's default parallel-class scheduling, await continuations could resume on ThreadPool threads where a sibling test had pinned its actor cell, causing Tell() to use the wrong implicit sender and replies to land in the wrong TestActor's mailbox. A new wrapping SynchronizationContext preserves xUnit's scheduler while pinning the ambient actor cell across await continuations.
• Fix SynchronizationContext leak and TestActor startup race in Akka.Hosting.TestKit - Two compounding sources of flakiness in sequential xUnit v3 suites: (1) the ActorCellKeepingSynchronizationContext installed during host startup leaked out of the initialization callback and was inherited by subsequent tests, pinning continuations onto disposed ActorCells; (2) the TestActor created during host startup was intermittently terminated by a race with other /system actors starting concurrently. Fixed by bracketing the context installation with a save/restore and adding post-startup TestActor liveness verification with automatic re-creation.
• Fix cached TestProbe refs becoming stale after TestActor recovery in Akka.Hosting.TestKit - Actors created during WithActors could cache IRequiredActor<TestProbe>.ActorRef before recovery ran. Re-registering a new raw TestActor in ActorRegistry did not update those cached refs. TestProbe is now registered via a stable forwarding actor whose target is swapped atomically after recovery, ensuring all cached references remain valid.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)