Skip to content

Bump Aspire.Hosting and Aspire.Hosting.AppHost#7

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/multi-dfe2b617fd
Closed

Bump Aspire.Hosting and Aspire.Hosting.AppHost#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/multi-dfe2b617fd

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 5, 2026

Updated Aspire.Hosting from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

  • 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

  • 🚀 Bumped branding to
    13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

  • 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
  • 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
  • ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
  • 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
  • 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

  • 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
  • ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

  • 🔖 Bumped branding to 13.2.3 (#​16181)
  • 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Updated Aspire.Hosting.AppHost from 13.2.2 to 13.2.4.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

  • 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

  • 🚀 Bumped branding to
    13.2.4 (#​16436)

13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

  • 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
  • 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
  • ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
  • 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
  • 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

  • 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
  • ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

  • 🔖 Bumped branding to 13.2.3 (#​16181)
  • 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps Aspire.Hosting from 13.2.2 to 13.2.4
Bumps Aspire.Hosting.AppHost from 13.2.2 to 13.2.4

---
updated-dependencies:
- dependency-name: Aspire.Hosting
  dependency-version: 13.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels May 5, 2026
hoangsnowy added a commit that referenced this pull request May 5, 2026
Brings every open dependabot PR onto feature/v1-m4. Dependabot opened
these against main; this branch consolidates them into one squashable
commit so the PR-list stays short and conflict resolution lives in one
place.

NuGet bumps (Directory.Packages.props):
- Aspire.Hosting              13.2.2 -> 13.2.4
- Aspire.Hosting.AppHost      13.2.2 -> 13.2.4
- Aspire.Hosting.Redis        13.2.2 -> 13.2.4
- Aspire.Hosting.SqlServer    13.2.1 -> 13.2.4
- Azure.Identity              1.18.0 -> 1.21.0
- Azure.Extensions.AspNetCore.Configuration.Secrets  1.5.0 -> 1.5.1
- Azure.Security.KeyVault.Secrets                    4.9.0 -> 4.10.0
- Azure.Storage.Files.Shares  12.20.1 -> 12.25.0
- Elastic.Clients.Elasticsearch  9.3.4 -> 9.3.6
- FluentValidation            11.11.0 -> 12.1.1     (major; API surface
                                                     unchanged for the
                                                     endpoint-filter use)
- FluentValidation.DependencyInjectionExtensions  11.11.0 -> 12.1.1
- Google.Protobuf             3.30.2 -> 3.34.1
- MailKit                     4.15.1 -> 4.16.0
- MimeKit                     4.15.1 -> 4.16.0

GitHub Actions bumps (.github/workflows/*.yml):
- actions/checkout            @v4 -> @v6
- actions/setup-dotnet        @v4 -> @v5
- actions/upload-artifact     @v4 -> @v7

Closes #4 #7 #8 #9 #10 #11 #12 #13 #15 #16 #17 #18 #19 #20

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hoangsnowy
Copy link
Copy Markdown
Owner

Cherry-picked into feature/v1-m4 (commit ecdf625) — closing.

@hoangsnowy hoangsnowy closed this May 5, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 5, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/nuget/multi-dfe2b617fd branch May 5, 2026 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant