Skip to content

deps: Bump the microsoft-extensions group with 1 update#18

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/nuget/src/Notify.IngestionApi/microsoft-extensions-8593baee55
Closed

deps: Bump the microsoft-extensions group with 1 update#18
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/nuget/src/Notify.IngestionApi/microsoft-extensions-8593baee55

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Updated Microsoft.ApplicationInsights.WorkerService from 2.23.0 to 3.1.0.

Release notes

Sourced from Microsoft.ApplicationInsights.WorkerService's releases.

3.1.0

Version 3.1.0

3.0.0

3.0.0-rc1

3.0.0-beta2

Added

  • Automatic configuration binding from "ApplicationInsights" section in appsettings.json for both AspNetCore and WorkerService packages with configuration precedence: environment variables > explicit configuration > appsettings.json
  • Added support for Entra ID (Azure Active Directory) authentication using Azure.Core.TokenCredential
  • Added Self Diagnostics feature
  • Updated the default sampler from Fixed Rate to Rate-Limited Sampling.
  • Update Azure Monitor Exporter to 1.6.0-beta.2
  • Add comprehensive applicationinsights.config support
  • Add properties in TelemetryConfiguration to configure underlying exporter

Bug fix

  • Fix TrackMetric(MetricTelemetry) unsupported telemetry type error

3.0.0-beta1

  • The following Application Insights packages in this repo now use OpenTelemetry internally. OpenTelemetry is the industry standard for telemetry collection and provides better interoperability with other observability tools.
    • Microsoft.ApplicationInsights
    • Microsoft.ApplicationInsights.AspNetCore
    • Microsoft.ApplicationInsights.WorkerService
    • Microsoft.ApplicationInsights.Web
    • Microsoft.ApplicationInsights.NLogTarget
  • Classic APIs of the above packages are preserved; calls are translated to OpenTelemetry telemetry.
  • Other packages not listed above (such as certain auto-collectors and logging adapters that were published from this repo previously) will not have future versions published. See BreakingChanges.md for details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Microsoft.ApplicationInsights.WorkerService from 2.23.0 to 3.1.0

---
updated-dependencies:
- dependency-name: Microsoft.ApplicationInsights.WorkerService
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: microsoft-extensions
- dependency-name: Microsoft.ApplicationInsights.WorkerService
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: microsoft-extensions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 4, 2026

Labels

The following labels could not be found: deps, deps:nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

jppaquet and others added 2 commits May 4, 2026 20:10
Microsoft.ApplicationInsights.WorkerService 3.1.0 transitively pulls
OpenTelemetry.Api 1.15.1, which has a moderate-severity advisory
(GHSA-g94r-2vxg-569j). NuGet's audit step
under -warnaserror fails the restore.

Pin OpenTelemetry.Api to 1.15.3 (latest patched stable in the 1.15.x
line) directly in Notify.IngestionApi.csproj. The transitive pin
propagates to Notify.IngestionApi.Tests via the project reference.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@jppaquet jppaquet closed this May 5, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 5, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@jppaquet jppaquet reopened this May 5, 2026
@jppaquet
Copy link
Copy Markdown
Owner

jppaquet commented May 5, 2026

Closing — pushes to dependabot's branch weren't retriggering CI. Manually applying the bump + the OpenTelemetry.Api 1.15.3 pin (GHSA-g94r-2vxg-569j) on a fresh branch instead.

@jppaquet jppaquet closed this May 5, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 5, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/nuget/src/Notify.IngestionApi/microsoft-extensions-8593baee55 branch May 5, 2026 00:16
jppaquet added a commit that referenced this pull request May 5, 2026
… pin OTel (#21)

Manual landing of dependabot's #18 plus the GHSA-g94r-2vxg-569j fix:
3.1.0 pulls OpenTelemetry.Api 1.15.1 transitively, which has a
moderate-severity advisory. NuGet's audit step under -warnaserror
fails restore unless we pin a patched version directly.

Pin OpenTelemetry.Api → 1.15.3 (latest patched stable in the 1.15.x
line). The transitive pin propagates to Notify.IngestionApi.Tests via
project reference.

Closed dependabot's PR #18 because pushes to its branch weren't
retriggering CI for unclear reasons (close+reopen + empty commits + the
fix push all produced zero workflow runs).

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant