Bump the routine-minor-patch group with 9 updates

[dependabot]

Summary

Updates nine routine dependencies in the Part 11 GenAiLab snapshot:

• Microsoft.Extensions.AI and Microsoft.Extensions.AI.OpenAI from 10.8.1 to 10.9.0
• Microsoft.Extensions.Http.Resilience and Microsoft.Extensions.ServiceDiscovery from 10.8.0 to 10.9.0
• Five OpenTelemetry packages from 1.17.0 to 1.18.0

Microsoft.Bcl.Memory remains pinned at 10.0.10 as the documented security override. Its 10.0.11 update was removed from this routine group and should be evaluated separately under the dependency policy.

Validation

• Part 11 GenAiLab solution builds in Release with zero warnings
• Resolved dependency graph reports no known vulnerabilities
• git diff --check passes
• Repository CI and CLA checks pass

This Dependabot PR was repaired in commit 577e402 to keep protected dependency updates isolated from routine updates.

[jongalloway]

Repair applied in 577e402: removed the Microsoft.Bcl.Memory 10.0.11 update from this routine group and retained the documented 10.0.10 security override. The repaired GenAiLab solution builds in Release with zero warnings, git diff --check passes, and the resolved dependency graph reports no known vulnerabilities.

[Copilot]

🟡 Changes recommended

The PR description states a protected Microsoft.Bcl.Memory update that is not present in the code and should be corrected or handled separately per dependency policy.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This Dependabot maintenance PR updates the Part 11 GenAiLab snapshot’s NuGet dependencies to newer minor/patch versions, keeping the deployment-ready workshop endpoint current.

Changes:

• Bump Microsoft.Extensions.AI / Microsoft.Extensions.AI.OpenAI to 10.9.0 in GenAiLab.Web.
• Bump Microsoft.Extensions.Http.Resilience / Microsoft.Extensions.ServiceDiscovery to 10.9.0 in GenAiLab.ServiceDefaults.
• Bump OpenTelemetry packages to 1.18.0 in GenAiLab.ServiceDefaults.

Dependency update review (per policy):

• Disposition: repair
• Scope: Part 11 - Deployment / GenAiLab (GenAiLab.Web.csproj, GenAiLab.ServiceDefaults.csproj)
• Classification:
  • Microsoft.Extensions.AI 10.8.1 → 10.9.0: routine update (minor)
  • Microsoft.Extensions.AI.OpenAI 10.8.1 → 10.9.0: routine update (minor)
  • Microsoft.Extensions.Http.Resilience 10.8.0 → 10.9.0: routine update (minor)
  • Microsoft.Extensions.ServiceDiscovery 10.8.0 → 10.9.0: routine update (minor)
  • OpenTelemetry packages 1.17.0 → 1.18.0: routine update (minor)
• Findings (blocker):
  • PR description claims Microsoft.Bcl.Memory was updated to 10.0.11, but the repo still references 10.0.10 (and it’s a documented security override). The description needs correction, or the missing update needs to be handled as a policy-aligned change.
• Validation:
  • Not run here (recommended locally/CI): dotnet restore, dotnet list package --vulnerable --include-transitive, dotnet build -c Release --no-restore.
• Required action: Update the PR description to remove the Microsoft.Bcl.Memory bump claim (or open/adjust a dedicated, policy-validated PR for that protected dependency).

File summaries

File	Description
Part 11 - Deployment/GenAiLab/GenAiLab.Web/GenAiLab.Web.csproj	Updates Microsoft.Extensions.AI* package versions used by the Part 11 GenAiLab web snapshot.
Part 11 - Deployment/GenAiLab/GenAiLab.ServiceDefaults/GenAiLab.ServiceDefaults.csproj	Updates resilience, service discovery, and OpenTelemetry package versions used by the shared defaults project.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.