Skip to content

Bump the all-updates group with 7 updates - #57

Merged
github-actions[bot] merged 2 commits into
mainfrom
dependabot/nuget/src/MX.CraftPledge.ServiceDefaults/all-updates-3d63353d46
Oct 18, 2026
Merged

Bump the all-updates group with 7 updates#57
github-actions[bot] merged 2 commits into
mainfrom
dependabot/nuget/src/MX.CraftPledge.ServiceDefaults/all-updates-3d63353d46

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.Extensions.Http.Resilience from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.19.1 to 1.20.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.20.0

For highlights and announcements pertaining to this release see: Release Notes > 1.20.0.

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      ... (truncated)

1.20.0-rc.1

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0-rc.1

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0-rc.1

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      (#​7727)

... (truncated)

1.20.0-beta.1

The following changes are from the previous release 1.19.1-beta.1.

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.19.1 to 1.20.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.20.0

For highlights and announcements pertaining to this release see: Release Notes > 1.20.0.

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      ... (truncated)

1.20.0-rc.1

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0-rc.1

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0-rc.1

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      (#​7727)

... (truncated)

1.20.0-beta.1

The following changes are from the previous release 1.19.1-beta.1.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.19.0 to 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.2

  • NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.20.0-beta.2

    • Fixed TraceContextEnrichedActorRemotingProviderAttribute ignoring the
      TransportSettings configuration section. Actor remoting clients now load their
      settings from TransportSettings, and actor remoting listeners fall back to
      TransportSettings when no actor-specific section is configured, matching the
      behaviour of Service Fabric's FabricTransportActorRemotingProviderAttribute.
      (#​5450)

    See CHANGELOG for details.

1.20.0-beta.1

1.20.0-alpha.2

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.19.0 to 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.2

  • NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.20.0-beta.2

    • Fixed TraceContextEnrichedActorRemotingProviderAttribute ignoring the
      TransportSettings configuration section. Actor remoting clients now load their
      settings from TransportSettings, and actor remoting listeners fall back to
      TransportSettings when no actor-specific section is configured, matching the
      behaviour of Service Fabric's FabricTransportActorRemotingProviderAttribute.
      (#​5450)

    See CHANGELOG for details.

1.20.0-beta.1

1.20.0-alpha.2

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Runtime from 1.19.0 to 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.2

  • NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.20.0-beta.2

    • Fixed TraceContextEnrichedActorRemotingProviderAttribute ignoring the
      TransportSettings configuration section. Actor remoting clients now load their
      settings from TransportSettings, and actor remoting listeners fall back to
      TransportSettings when no actor-specific section is configured, matching the
      behaviour of Service Fabric's FabricTransportActorRemotingProviderAttribute.
      (#​5450)

    See CHANGELOG for details.

1.20.0-beta.1

1.20.0-alpha.2

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all-updates group with 7 updates
32733b1 
Bumps Microsoft.Extensions.Http.Resilience from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.10.0 to 10.11.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.19.1 to 1.20.0
Bumps OpenTelemetry.Extensions.Hosting from 1.19.1 to 1.20.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.19.0 to 1.20.0
Bumps OpenTelemetry.Instrumentation.Http from 1.19.0 to 1.20.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.19.0 to 1.20.0

---
updated-dependencies:
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 18, 2026
@github-actions

github-actions Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
nuget/MessagePack 2.5.303 UnknownUnknown
nuget/Microsoft.Extensions.Http.Resilience 10.11.0 🟢 7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/Microsoft.Extensions.ServiceDiscovery 10.11.0 🟢 7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol 1.20.0 🟢 8.7
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices🟢 5badge detected: Passing
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
nuget/OpenTelemetry.Extensions.Hosting 1.20.0 🟢 8.7
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices🟢 5badge detected: Passing
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 40 contributing companies or organizations
nuget/OpenTelemetry.Instrumentation.AspNetCore 1.20.0 🟢 8.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices🟢 5badge detected: Passing
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities🟢 100 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 24 contributing companies or organizations
nuget/OpenTelemetry.Instrumentation.Http 1.20.0 🟢 8.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices🟢 5badge detected: Passing
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities🟢 100 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 24 contributing companies or organizations
nuget/OpenTelemetry.Instrumentation.Runtime 1.20.0 🟢 8.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices🟢 5badge detected: Passing
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities🟢 100 existing vulnerabilities detected
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 24 contributing companies or organizations

Scanned Files

  • src/MX.CraftPledge.AppHost/MX.CraftPledge.AppHost.csproj
  • src/MX.CraftPledge.ServiceDefaults/MX.CraftPledge.ServiceDefaults.csproj

@github-actions
github-actions Bot enabled auto-merge (squash) October 18, 2026 04:05
@frasermolyneux

frasermolyneux commented Oct 18, 2026

Copy link
Copy Markdown
Owner

@copilot investigate and resolve the failed checks on this pull request. Keep the fix narrowly scoped and preserve behavior. Follow any linked issue test acceptance criteria; add or extend relevant regression tests when changing code, run applicable unit/integration/Playwright suites using existing tooling, and report commands, results and reasons for unchanged or inapplicable coverage in the PR description. If adequate testing is blocked, explain and stop for human guidance.

@frasermolyneux
Pin patched MessagePack in AppHost
fa6284e 
Co-authored-by: frasermolyneux <34033625+frasermolyneux@users.noreply.github.com>
auto-merge was automatically disabled October 18, 2026 04:27

Head branch was pushed to by a user without write access

Copilot AI commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

@copilot investigate and resolve the failed checks on this pull request. Keep the fix narrowly scoped and preserve ...

Pinned Aspire AppHost’s transitive MessagePack dependency to patched 2.5.303 in fa6284e. The original restore failures were NU1902 for vulnerable 2.5.302; restore, build, and formatting now pass locally. dotnet test exits successfully, but this solution has no test projects. The new hosted PR Verify and Code Quality runs are marked action_required with zero jobs, so they have not rerun; repository-side action is needed to authorize them.

Copilot AI requested a review from frasermolyneux October 18, 2026 04:28
@mx-io-idp-bot

mx-io-idp-bot Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Auto-approved workflow run(s) for this commit after an automated risk review: Ordinary dependency updates and new package addition - no CI workflows, secrets, quality gates, or security controls modified

@github-actions
github-actions Bot enabled auto-merge (squash) October 18, 2026 04:34
Copilot AI deployed to Development October 18, 2026 04:35 Active
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown

🏗️ Terraform Plan

🌍 Environment: dev

✅ Validate — Passed

✅ Plan

Count
➕ Add 10
📋 Resource Details
Action Resource
➕ Create azurerm_app_service_certificate_binding.primary
➕ Create azurerm_app_service_custom_hostname_binding.primary
➕ Create azurerm_app_service_managed_certificate.primary
➕ Create azurerm_application_insights.ai
➕ Create azurerm_dns_cname_record.web_app
➕ Create azurerm_dns_txt_record.app_service_verification
➕ Create azurerm_linux_web_app.app
➕ Create azurerm_service_plan.app[0]
➕ Create random_id.environment_id
➕ Create time_sleep.wait_for_hostname_binding

@sonarqubecloud

sonarqubecloud Bot commented Oct 18, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions
github-actions Bot merged commit 5fd3c2b into main Oct 18, 2026
15 checks passed
@dependabot
dependabot Bot deleted the dependabot/nuget/src/MX.CraftPledge.ServiceDefaults/all-updates-3d63353d46 branch October 18, 2026 04:38

This branch was successfully deployed

1 active deployment
Development — fa6284eb Deployed Oct 18, 2026 by Copilot via terraform-plan-dev #232
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@frasermolyneux frasermolyneux Awaiting requested review from frasermolyneux

Assignees

@frasermolyneux frasermolyneux

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@frasermolyneux