Update OpenTelemetry and Azure Monitor packages to address vulnerabilities

[rajkumar-rangaraj]

What

Bumps OpenTelemetry and Azure Monitor dependencies to address known security advisories and unblock builds.

Package	Old	New
OpenTelemetry	1.15.1	1.15.3
OpenTelemetry.Exporter.Console	1.15.1	1.15.3
OpenTelemetry.Exporter.InMemory	1.15.1	1.15.3
OpenTelemetry.Extensions.Hosting	1.15.1	1.15.3
OpenTelemetry.Instrumentation.AspNetCore	1.15.0	1.15.2
OpenTelemetry.Instrumentation.AspNet	1.15.1	1.15.2
OpenTelemetry.Instrumentation.Http	1.15.0	1.15.1
OpenTelemetry.Instrumentation.SqlClient	1.15.0	1.15.2
Azure.Monitor.OpenTelemetry.Exporter	1.7.0	1.8.0

Why

Building Everything.sln against the previous versions fails with NU1902 because OpenTelemetry.Api 1.15.1 carries a moderate-severity advisory (GHSA-g94r-2vxg-569j). All transitively-required floor versions of dependencies (e.g. Azure.Core >= 1.54.0) are satisfied — no further pins needed.

Test infra fix

This PR also adds:

[assembly: InternalsVisibleTo("DynamicProxyGenAssembly2, PublicKey=" + AssemblyInfo.MoqPublicKey)]

to BASE/src/Microsoft.ApplicationInsights/Properties/AssemblyInfo.cs. Because Microsoft.ApplicationInsights is strong-named, Castle.DynamicProxy (used by Moq) cannot subclass internal types like MemoryMappedFileHandler without it. The MoqPublicKey constant was already defined in the same file but unused. This fix re-enables the 14 SelfDiagnosticsEventListenerTest.* tests across net462/net8.0/net9.0/net10.0.

Validation

• ✅ dotnet restore Everything.sln — clean
• ✅ dotnet build Everything.sln -c Release — 0 errors (baseline main fails with NU1902)
• ✅ dotnet test Everything.sln -c Release — SelfDiagnostics tests now passing (14/14 across all TFMs); remaining 3 failure types are pre-existing flakes on main (IMDS-dependent FeatureMetricEmissionHelperTests.ReportsFeaturesSeen, file-cleanup race in Web.Tests, timing race in WorkerServiceTelemetryTests.BackgroundWorkOperationsAreExported) — out of scope for this change.

[Copilot]

Pull request overview

This PR updates OpenTelemetry and Azure Monitor dependency versions across the repo to address known security advisories and restore successful restores/builds, and it also fixes test mocking for a strong-named assembly by enabling Moq/Castle to proxy internal types.

Changes:

• Bump OpenTelemetry core + instrumentation packages and Azure.Monitor.OpenTelemetry.Exporter via central package management.
• Add an InternalsVisibleTo entry for DynamicProxyGenAssembly2 (with Moq public key) to re-enable mocking of internal types in tests.
• Document the dependency bumps in CHANGELOG.md under a new “Unreleased” section.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Directory.Packages.props	Updates centrally-managed package versions for OpenTelemetry + Azure Monitor exporter.
CHANGELOG.md	Adds an Unreleased entry documenting the dependency/security advisory updates.
BASE/src/Microsoft.ApplicationInsights/Properties/AssemblyInfo.cs	Adds InternalsVisibleTo for Castle/Moq dynamic proxy to mock internal types in a strong-named assembly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.