Bump the microsoft group with 19 updates by dependabot[bot] · Pull Request #71 · razeone/CloudEngAgent

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

Microsoft.Data.SqlClient

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Microsoft.Data.SqlClient.Extensions.Azure

Microsoft.Data.SqlClient.Extensions.Abstractions

Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

Fixed

Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
(#4372,#4373)
Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
(#4159,#4206)
Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
(#4339,#4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
(#4340,#4358)

Who Benefits:

All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:
... (truncated)

7.0.1

This update brings the following changes since the 7.0.0 release:

Fixed

Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' error. The column metadata query now uses dynamic SQL so that references to the graph_type column (introduced in SQL Server 2017) are not compiled on older versions that lack the column. (#3714, #4092, #4147)
Fixed SqlBulkCopy failing on Azure Synapse Analytics dedicated SQL pools. The column-list query previously used a variable-assignment pattern that Synapse does not support; it now uses STRING_AGG when targeting Synapse (engine edition 6) and falls back to the variable-assignment approach for SQL Server 2016 compatibility. (#4149, #4176, #4182)
Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() returning typeof(byte[]) instead of typeof(SqlVector<float>) for vector float32 columns. The methods now follow the same type-determination logic as GetValue(). (#4104, #4105, #4152)
Added missing System.Data.Common (v4.3.0) NuGet package dependency for .NET Framework consumers. The inbox System.Data.Common assembly on .NET Framework predates APIs such as IDbColumnSchemaGenerator; without the explicit NuGet dependency, consumers encountered CS0012 compilation errors when using these types through Microsoft.Data.SqlClient. (#4063, #4074)

Changed

Enabled the User Agent TDS feature extension unconditionally. The Switch.Microsoft.Data.SqlClient.EnableUserAgent AppContext switch has been removed; the driver now always sends User Agent information during login. (#4124, #4154)
Added type forwards from the core Microsoft.Data.SqlClient assembly to public types that were moved to the Microsoft.Data.SqlClient.Extensions.Abstractions package: SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. This ensures binary compatibility for assemblies compiled against earlier versions of Microsoft.Data.SqlClient where these types lived in the core assembly. (#4067, #4117)
Fixed API documentation include paths and duplicate doc snippets. (#4084, #4086, #4107, #4161)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

edwardneal

Target Platform Support

.NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
.NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

Microsoft.Bcl.Cryptography 9.0.13
Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
Microsoft.Data.SqlClient.Internal.Logging 1.0.0
Microsoft.Data.SqlClient.SNI.runtime 6.0.2
Microsoft.Extensions.Caching.Memory 9.0.13
Microsoft.IdentityModel.JsonWebTokens 8.16.0
Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
Microsoft.SqlServer.Server 1.0.0
System.Configuration.ConfigurationManager 9.0.13
System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

Microsoft.Bcl.Cryptography 8.0.0
Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
... (truncated)

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.AI from 10.5.0 to 10.8.1.

Release notes

Sourced from Microsoft.Extensions.AI's releases.

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.8.1
Microsoft.Extensions.AI.Abstractions	10.8.1
Microsoft.Extensions.AI.OpenAI	10.8.1

What's Changed

AI

Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #7617 by @westey-m
Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #7629 by @rogerbarreto (co-authored by @tarekgh)

Acknowledgements

@jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #7610 by @jozkee (co-authored by @jeffhandley @Copilot)
New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #7549 by @javiercn (co-authored by @Copilot)

What's Changed

AI

Upgrade OpenAI dependency to 2.12.0 #7608 by @jozkee (co-authored by @Copilot)
Auto-detect audio format in OpenAISpeechToTextClient #7575 by @jozkee (co-authored by @Copilot)
Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #7624 by @jozkee (co-authored by @Copilot)

Vector Data

Make all test methods virtual in VectorData.ConformanceTests #7606 by @adamsitnik (co-authored by @Copilot)

Documentation Updates

Remove links to ai-samples repo #7574 by @gewarren
Fix up docs with Copilot (MEVD) #7597 by @gewarren
Fix up docs with Copilot (M.E.ServiceDiscovery) #7598 by @gewarren (co-authored by @Copilot)
Fix up docs with Copilot (MEAI) #7600 by @gewarren
Fix up docs with Copilot #7601 by @gewarren

Test Improvements

Fix flaky StampedeTests and harden related test waits #7572 by @jeffhandley (co-authored by @Copilot)
Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #7579 by @adamsitnik (co-authored by @Copilot)
Removing SemanticKernel Connectors dependency and replacing it #7584 by @adamsitnik (co-authored by @Copilot)
Migrate to xUnit v3 #7607 by @adamsitnik (co-authored by @shyamnamboodiripad @Copilot)

Repository Infrastructure Updates

Update OTel GenAI conventions skill for standalone semconv-genai repo #7519 by @jeffhandley (co-authored by @Copilot)
Bump dotnet-coverage from 18.7.0 to 18.8.0 #7552
[main] Update dependencies from dotnet/arcade #7559
Fix transitive MessagePack vulnerability in AI template AppHost projects #7561 by @adamsitnik (co-authored by @Copilot)
Bump esbuild, @vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7564
Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7569
Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7570
Bump PowerShell from 7.6.2 to 7.6.3 #7576
Remove duplicate 'WebAPI' classification from template #7577 by @danroth27
[main] Update dependencies from dotnet/arcade #7590
Eliminate redundant Correctness CI stage by merging into Build #7594 by @adamsitnik (co-authored by @Copilot)
Update Agent Framework to 1.13.0 #7613 by @jeffhandley (co-authored by @Copilot)
... (truncated)

10.7.0

v10.7.0 graduates the Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package to stable. The package registers a Kubernetes-aware ResourceQuotaProvider that reads the pod's CPU and memory requests and limits and exposes them to Microsoft.Extensions.Diagnostics.ResourceMonitoring as baseline and maximum quotas, which then feed the request and limit dimensions of the published resource utilization metrics. The companion ResourceQuota and ResourceQuotaProvider types in Microsoft.Extensions.Diagnostics.ResourceMonitoring graduate to stable in the same change so that consumers can implement custom quota providers without taking an experimental dependency.

On the AI side, Microsoft.Extensions.AI.OpenAI moves to OpenAI 2.11.0 and fixes a deserialization bug in ToolJson.AdditionalProperties so that JSON Schema additionalProperties values shaped as sub-schema objects (for example {"type":"string"}) are preserved instead of throwing during deserialization. HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt graduate to stable since both values are consistently available across hosted-file providers, while Purpose and Scope remain experimental as provider-shaped vocabulary. FunctionInvokingChatClient drops a backward-compat path that auto-marked ToolApprovalResponseContent entries with InformationalOnly: true; consumers that need to continue accepting sessions serialized before #7468 can use the sample ApprovalHistoryNormalizingChatClient middleware added in the test project.

Experimental API Changes

Now Stable

Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package is now stable #7253
Resource Monitoring ResourceQuota and ResourceQuotaProvider APIs are now stable (previously EXTEXP0008) #7253
HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt are now stable (previously MEAI001) #7513

What's Changed

AI

Graduate HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt #7513 by @jozkee (co-authored by @Copilot)
Remove backward-compat InformationalOnly case from FICC; suggest middleware workaround #7538 by @jozkee (co-authored by @Copilot)
Upgrade OpenAI package from 2.10.0 to 2.11.0 #7544 by @jozkee (co-authored by @Copilot)
Fix ToolJson.AdditionalProperties to accept sub-schema objects #7546 by @jozkee (co-authored by @Copilot)

Diagnostics, Health Checks, and Resource Monitoring

Move Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes to stable #7253 by @amadeuszl (co-authored by @Copilot)

Repository Infrastructure Updates

[main] Update dependencies from dotnet/arcade #7521
Bump dotnet-reportgenerator-globaltool from 5.5.9 to 5.5.10 #7522
Bump dotnet-coverage from 18.6.2 to 18.7.0 #7530
Bump PowerShell from 7.6.1 to 7.6.2 #7531
Bump qs from 6.15.1 to 6.15.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7532
[main] Update dependencies from dotnet/arcade #7534
Bump tmp from 0.2.5 to 0.2.6 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7537

Acknowledgements

@ericstj submitted issue #7509 (resolved by #7544)
@scottt732 submitted issue #7540 (resolved by #7546)
@DeagleGross @wtgodbe @dariusclay @evgenyfedorov2 @peterwald @PranavSenthilnathan @shyamnamboodiripad @stephentoub @tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.6.0...v10.7.0

10.6.0

Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.

Experimental API Changes

Now Stable

ResponseContinuationToken and background-response APIs are now stable (previously MEAI001) #7512

What's Changed

AI

Stabilize ResponseContinuationToken / background-response APIs #7512 by @jozkee (co-authored by @Copilot)

Repository Infrastructure Updates

Update version to 10.6.0 #7458 by @jeffhandley
[main] Update dependencies from dotnet/arcade #7451
Bump follow-redirects from 1.15.11 to 1.16.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport #7469
Merge release/10.5 into main #7470 by @jeffhandley
Bump microsoft.visualstudio.slngen.tool from 12.0.13 to 12.0.32 #7484
Bump postcss from 8.5.9 to 8.5.12 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7494
Bump dotnet-reportgenerator-globaltool from 5.5.7 to 5.5.9 #7504
Rename release-notes skill to write-release-notes #7511 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

@wtgodbe @tarekgh @peterwald @JeremyLikness @eiriktsarpalis @ericstj @evgenyfedorov2 reviewed pull requests

Full Changelog: dotnet/extensions@v10.5.2...v10.6.0

10.5.2

This patch release ships a single fix to Microsoft.Extensions.VectorData.Abstractions, correcting StorageName resolution when external serialization is enabled. Microsoft.Extensions.VectorData.ConformanceTests, Microsoft.Extensions.AI.Abstractions, Microsoft.Extensions.AI, and Microsoft.Extensions.AI.OpenAI are published alongside it for version coherency — they contain no code changes from 10.5.1.

Packages in this release

Package	Version
Microsoft.Extensions.VectorData.Abstractions	10.5.2
Microsoft.Extensions.VectorData.ConformanceTests	10.5.2
Microsoft.Extensions.AI.Abstractions	10.5.2
Microsoft.Extensions.AI	10.5.2
Microsoft.Extensions.AI.OpenAI	10.5.2

What's Changed

Microsoft.Extensions.VectorData.Abstractions

Minor fixes to MEVD.Abstractions: correct StorageName behavior when external serialization is enabled, and disable a warning for net462. (by @roji in #7475)

Full Changelog: dotnet/extensions@v10.5.1...v10.5.2

10.5.1

Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.

The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.5.1
Microsoft.Extensions.AI.Abstractions	10.5.1
Microsoft.Extensions.AI.OpenAI	10.5.1
Microsoft.Extensions.AI.Templates	10.5.1-preview.3.26251.3
Microsoft.Agents.AI.ProjectTemplates	1.3.0-preview.1.26251.3

Experimental API Changes

Now Stable

The following types previously emitted the MEAI001 experimental diagnostic and are now stable.

CodeInterpreter and WebSearch tool content types are now stable #7493
- CodeInterpreterToolCallContent
- CodeInterpreterToolResultContent
- WebSearchToolCallContent
- WebSearchToolResultContent
ImageGeneration tool content types and tool are now stable #7476
- ImageGenerationToolCallContent
- ImageGenerationToolResultContent
- HostedImageGenerationTool
- ImageGenerationOptions
- ImageGenerationResponseFormat (the Hosted enum value remains experimental)
- IImageGenerator and the rest of the image generation infrastructure also remain experimental

New Experimental APIs

The following new APIs emit the MEAI001 experimental diagnostic.

New experimental API: HostedToolSearchTool with DeferredTools for tool-search-driven deferred tool loading #7471
New experimental API: OpenAIRequestPolicies extension hook for appending System.ClientModel.PipelinePolicy instances to outgoing OpenAI requests #7495

Breaking Changes to Experimental APIs

WebSearchToolResultContent.Results was renamed to Outputs as part of the stabilization in #7493, aligning with CodeInterpreterToolResultContent.Outputs. The original Results property was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.
```
WebSearchToolResultContent content = ...;
- IList<AIContent>? items = content.Results;
+ IList<AIContent>? items = content.Outputs;
```

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.8.1.

Release notes

Sourced from Microsoft.Extensions.AI.Abstractions's releases.

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.8.1
Microsoft.Extensions.AI.Abstractions	10.8.1
Microsoft.Extensions.AI.OpenAI	10.8.1

What's Changed

AI

Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #7617 by @westey-m
Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #7629 by @rogerbarreto (co-authored by @tarekgh)

Acknowledgements

@jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #7610 by @jozkee (co-authored by @jeffhandley @Copilot)
New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #7549 by @javiercn (co-authored by @Copilot)

What's Changed

AI

Upgrade OpenAI dependency to 2.12.0 #7608 by @jozkee (co-authored by @Copilot)
Auto-detect audio format in OpenAISpeechToTextClient #7575 by @jozkee (co-authored by @Copilot)
Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #7624 by @jozkee (co-authored by @Copilot)

Vector Data

Make all test methods virtual in VectorData.ConformanceTests #7606 by @adamsitnik (co-authored by @Copilot)

Documentation Updates

Remove links to ai-samples repo #7574 by @gewarren
Fix up docs with Copilot (MEVD) #7597 by @gewarren
Fix up docs with Copilot (M.E.ServiceDiscovery) #7598 by @gewarren (co-authored by @Copilot)
Fix up docs with Copilot (MEAI) #7600 by @gewarren
Fix up docs with Copilot #7601 by @gewarren

Test Improvements

Fix flaky StampedeTests and harden related test waits #7572 by @jeffhandley (co-authored by @Copilot)
Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #7579 by @adamsitnik (co-authored by @Copilot)
Removing SemanticKernel Connectors dependency and replacing it #7584 by @adamsitnik (co-authored by @Copilot)
Migrate to xUnit v3 #7607 by @adamsitnik (co-authored by @shyamnamboodiripad @Copilot)

Repository Infrastructure Updates

Update OTel GenAI conventions skill for standalone semconv-genai repo #7519 by @jeffhandley (co-authored by @Copilot)
Bump dotnet-coverage from 18.7.0 to 18.8.0 #7552
[main] Update dependencies from dotnet/arcade #7559
Fix transitive MessagePack vulnerability in AI template AppHost projects #7561 by @adamsitnik (co-authored by @Copilot)
Bump esbuild, @vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7564
Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7569
Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7570
Bump PowerShell from 7.6.2 to 7.6.3 #7576
Remove duplicate 'WebAPI' classification from template #7577 by @danroth27
[main] Update dependencies from dotnet/arcade #7590
Eliminate redundant Correctness CI stage by merging into Build #7594 by @adamsitnik (co-authored by @Copilot)
Update Agent Framework to 1.13.0 #7613 by @jeffhandley (co-authored by @Copilot)
... (truncated)

10.7.0

v10.7.0 graduates the Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package to stable. The package registers a Kubernetes-aware ResourceQuotaProvider that reads the pod's CPU and memory requests and limits and exposes them to Microsoft.Extensions.Diagnostics.ResourceMonitoring as baseline and maximum quotas, which then feed the request and limit dimensions of the published resource utilization metrics. The companion ResourceQuota and ResourceQuotaProvider types in Microsoft.Extensions.Diagnostics.ResourceMonitoring graduate to stable in the same change so that consumers can implement custom quota providers without taking an experimental dependency.

On the AI side, Microsoft.Extensions.AI.OpenAI moves to OpenAI 2.11.0 and fixes a deserialization bug in ToolJson.AdditionalProperties so that JSON Schema additionalProperties values shaped as sub-schema objects (for example {"type":"string"}) are preserved instead of throwing during deserialization. HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt graduate to stable since both values are consistently available across hosted-file providers, while Purpose and Scope remain experimental as provider-shaped vocabulary. FunctionInvokingChatClient drops a backward-compat path that auto-marked ToolApprovalResponseContent entries with InformationalOnly: true; consumers that need to continue accepting sessions serialized before #7468 can use the sample ApprovalHistoryNormalizingChatClient middleware added in the test project.

Experimental API Changes

Now Stable

Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package is now stable #7253
Resource Monitoring ResourceQuota and ResourceQuotaProvider APIs are now stable (previously EXTEXP0008) #7253
HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt are now stable (previously MEAI001) #7513

What's Changed

AI

Graduate HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt #7513 by @jozkee (co-authored by @Copilot)
Remove backward-compat InformationalOnly case from FICC; suggest middleware workaround #7538 by @jozkee (co-authored by @Copilot)
Upgrade OpenAI package from 2.10.0 to 2.11.0 #7544 by @jozkee (co-authored by @Copilot)
Fix ToolJson.AdditionalProperties to accept sub-schema objects #7546 by @jozkee (co-authored by @Copilot)

Diagnostics, Health Checks, and Resource Monitoring

Move Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes to stable #7253 by @amadeuszl (co-authored by @Copilot)

Repository Infrastructure Updates

[main] Update dependencies from dotnet/arcade #7521
Bump dotnet-reportgenerator-globaltool from 5.5.9 to 5.5.10 #7522
Bump dotnet-coverage from 18.6.2 to 18.7.0 #7530
Bump PowerShell from 7.6.1 to 7.6.2 #7531
Bump qs from 6.15.1 to 6.15.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7532
[main] Update dependencies from dotnet/arcade #7534
Bump tmp from 0.2.5 to 0.2.6 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7537

Acknowledgements

@ericstj submitted issue #7509 (resolved by #7544)
@scottt732 submitted issue #7540 (resolved by #7546)
@DeagleGross @wtgodbe @dariusclay @evgenyfedorov2 @peterwald @PranavSenthilnathan @shyamnamboodiripad @stephentoub @tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.6.0...v10.7.0

10.6.0

Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.

Experimental API Changes

Now Stable

ResponseContinuationToken and background-response APIs are now stable (previously MEAI001) #7512

What's Changed

AI

Stabilize ResponseContinuationToken / background-response APIs #7512 by @jozkee (co-authored by @Copilot)

Repository Infrastructure Updates

Update version to 10.6.0 #7458 by @jeffhandley
[main] Update dependencies from dotnet/arcade #7451
Bump follow-redirects from 1.15.11 to 1.16.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport #7469
Merge release/10.5 into main #7470 by @jeffhandley
Bump microsoft.visualstudio.slngen.tool from 12.0.13 to 12.0.32 #7484
Bump postcss from 8.5.9 to 8.5.12 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7494
Bump dotnet-reportgenerator-globaltool from 5.5.7 to 5.5.9 #7504
Rename release-notes skill to write-release-notes #7511 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

@wtgodbe @tarekgh @peterwald @JeremyLikness @eiriktsarpalis @ericstj @evgenyfedorov2 reviewed pull requests

Full Changelog: dotnet/extensions@v10.5.2...v10.6.0

10.5.2

This patch release ships a single fix to Microsoft.Extensions.VectorData.Abstractions, correcting StorageName resolution when external serialization is enabled. Microsoft.Extensions.VectorData.ConformanceTests, Microsoft.Extensions.AI.Abstractions, Microsoft.Extensions.AI, and Microsoft.Extensions.AI.OpenAI are published alongside it for version coherency — they contain no code changes from 10.5.1.

Packages in this release

Package	Version
Microsoft.Extensions.VectorData.Abstractions	10.5.2
Microsoft.Extensions.VectorData.ConformanceTests	10.5.2
Microsoft.Extensions.AI.Abstractions	10.5.2
Microsoft.Extensions.AI	10.5.2
Microsoft.Extensions.AI.OpenAI	10.5.2

What's Changed

Microsoft.Extensions.VectorData.Abstractions

Minor fixes to MEVD.Abstractions: correct StorageName behavior when external serialization is enabled, and disable a warning for net462. (by @roji in #7475)

Full Changelog: dotnet/extensions@v10.5.1...v10.5.2

10.5.1

Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.

The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.5.1
Microsoft.Extensions.AI.Abstractions	10.5.1
Microsoft.Extensions.AI.OpenAI	10.5.1
Microsoft.Extensions.AI.Templates	10.5.1-preview.3.26251.3
Microsoft.Agents.AI.ProjectTemplates	1.3.0-preview.1.26251.3

Experimental API Changes

Now Stable

The following types previously emitted the MEAI001 experimental diagnostic and are now stable.

CodeInterpreter and WebSearch tool content types are now stable #7493
- CodeInterpreterToolCallContent
- CodeInterpreterToolResultContent
- WebSearchToolCallContent
- WebSearchToolResultContent
ImageGeneration tool content types and tool are now stable #7476
- ImageGenerationToolCallContent
- ImageGenerationToolResultContent
- HostedImageGenerationTool
- ImageGenerationOptions
- ImageGenerationResponseFormat (the Hosted enum value remains experimental)
- IImageGenerator and the rest of the image generation infrastructure also remain experimental

New Experimental APIs

The following new APIs emit the MEAI001 experimental diagnostic.

New experimental API: HostedToolSearchTool with DeferredTools for tool-search-driven deferred tool loading #7471
New experimental API: OpenAIRequestPolicies extension hook for appending System.ClientModel.PipelinePolicy instances to outgoing OpenAI requests #7495

Breaking Changes to Experimental APIs

WebSearchToolResultContent.Results was renamed to Outputs as part of the stabilization in #7493, aligning with CodeInterpreterToolResultContent.Outputs. The original Results property was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.
```
WebSearchToolResultContent content = ...;
- IList<AIContent>? items = content.Results;
+ IList<AIContent>? items = content.Outputs;
```

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.OpenAI from 10.5.0 to 10.8.1.

Release notes

Sourced from Microsoft.Extensions.AI.OpenAI's releases.

10.8.1

This servicing release updates the Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI packages to 10.8.1 with two targeted fixes: correct tool-call/tool-result ordering when resuming approval-gated functions with service-managed chat history, and preservation of the OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.8.1
Microsoft.Extensions.AI.Abstractions	10.8.1
Microsoft.Extensions.AI.OpenAI	10.8.1

What's Changed

AI

Fix FICC tool_calls/tool ordering with approvals and service-managed chat history #7617 by @westey-m
Roundtrip OpenAI Responses reasoning item id for stateless (store=false) encrypted reasoning #7629 by @rogerbarreto (co-authored by @tarekgh)

Acknowledgements

@jozkee reviewed pull requests

Full Changelog: dotnet/extensions@v10.8.0...v10.8.1

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #7610 by @jozkee (co-authored by @jeffhandley @Copilot)
New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #7549 by @javiercn (co-authored by @Copilot)

What's Changed

AI

Upgrade OpenAI dependency to 2.12.0 #7608 by @jozkee (co-authored by @Copilot)
Auto-detect audio format in OpenAISpeechToTextClient #7575 by @jozkee (co-authored by @Copilot)
Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #7624 by @jozkee (co-authored by @Copilot)

Vector Data

Make all test methods virtual in VectorData.ConformanceTests #7606 by @adamsitnik (co-authored by @Copilot)

Documentation Updates

Remove links to ai-samples repo #7574 by @gewarren
Fix up docs with Copilot (MEVD) #7597 by @gewarren
Fix up docs with Copilot (M.E.ServiceDiscovery) #7598 by @gewarren (co-authored by @Copilot)
Fix up docs with Copilot (MEAI) #7600 by @gewarren
Fix up docs with Copilot #7601 by @gewarren

Test Improvements

Fix flaky StampedeTests and harden related test waits #7572 by @jeffhandley (co-authored by @Copilot)
Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #7579 by @adamsitnik (co-authored by @Copilot)
Removing SemanticKernel Connectors dependency and replacing it #7584 by @adamsitnik (co-authored by @Copilot)
Migrate to xUnit v3 #7607 by @adamsitnik (co-authored by @shyamnamboodiripad @Copilot)

Repository Infrastructure Updates

Update OTel GenAI conventions skill for standalone semconv-genai repo #7519 by @jeffhandley (co-authored by @Copilot)
Bump dotnet-coverage from 18.7.0 to 18.8.0 #7552
[main] Update dependencies from dotnet/arcade #7559
Fix transitive MessagePack vulnerability in AI template AppHost projects #7561 by @adamsitnik (co-authored by @Copilot)
Bump esbuild, @vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7564
Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7569
Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7570
Bump PowerShell from 7.6.2 to 7.6.3 #7576
Remove duplicate 'WebAPI' classification from template #7577 by @danroth27
[main] Update dependencies from dotnet/arcade #7590
Eliminate redundant Correctness CI stage by merging into Build #7594 by @adamsitnik (co-authored by @Copilot)
Update Agent Framework to 1.13.0 #7613 by @jeffhandley (co-authored by @Copilot)
... (truncated)

10.7.0

v10.7.0 graduates the Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package to stable. The package registers a Kubernetes-aware ResourceQuotaProvider that reads the pod's CPU and memory requests and limits and exposes them to Microsoft.Extensions.Diagnostics.ResourceMonitoring as baseline and maximum quotas, which then feed the request and limit dimensions of the published resource utilization metrics. The companion ResourceQuota and ResourceQuotaProvider types in Microsoft.Extensions.Diagnostics.ResourceMonitoring graduate to stable in the same change so that consumers can implement custom quota providers without taking an experimental dependency.

On the AI side, Microsoft.Extensions.AI.OpenAI moves to OpenAI 2.11.0 and fixes a deserialization bug in ToolJson.AdditionalProperties so that JSON Schema additionalProperties values shaped as sub-schema objects (for example {"type":"string"}) are preserved instead of throwing during deserialization. HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt graduate to stable since both values are consistently available across hosted-file providers, while Purpose and Scope remain experimental as provider-shaped vocabulary. FunctionInvokingChatClient drops a backward-compat path that auto-marked ToolApprovalResponseContent entries with InformationalOnly: true; consumers that need to continue accepting sessions serialized before #7468 can use the sample ApprovalHistoryNormalizingChatClient middleware added in the test project.

Experimental API Changes

Now Stable

Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes package is now stable #7253
Resource Monitoring ResourceQuota and ResourceQuotaProvider APIs are now stable (previously EXTEXP0008) #7253
HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt are now stable (previously MEAI001) #7513

What's Changed

AI

Graduate HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt #7513 by @jozkee (co-authored by @Copilot)
Remove backward-compat InformationalOnly case from FICC; suggest middleware workaround #7538 by @jozkee (co-authored by @Copilot)
Upgrade OpenAI package from 2.10.0 to 2.11.0 #7544 by @jozkee (co-authored by @Copilot)
Fix ToolJson.AdditionalProperties to accept sub-schema objects #7546 by @jozkee (co-authored by @Copilot)

Diagnostics, Health Checks, and Resource Monitoring

Move Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes to stable #7253 by @amadeuszl (co-authored by @Copilot)

Repository Infrastructure Updates

[main] Update dependencies from dotnet/arcade #7521
Bump dotnet-reportgenerator-globaltool from 5.5.9 to 5.5.10 #7522
Bump dotnet-coverage from 18.6.2 to 18.7.0 #7530
Bump PowerShell from 7.6.1 to 7.6.2 #7531
Bump qs from 6.15.1 to 6.15.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7532
[main] Update dependencies from dotnet/arcade #7534
Bump tmp from 0.2.5 to 0.2.6 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7537

Acknowledgements

@ericstj submitted issue #7509 (resolved by #7544)
@scottt732 submitted issue #7540 (resolved by #7546)
@DeagleGross @wtgodbe @dariusclay @evgenyfedorov2 @peterwald @PranavSenthilnathan @shyamnamboodiripad @stephentoub @tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.6.0...v10.7.0

10.6.0

Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.

Experimental API Changes

Now Stable

ResponseContinuationToken and background-response APIs are now stable (previously MEAI001) #7512

What's Changed

AI

Stabilize ResponseContinuationToken / background-response APIs #7512 by @jozkee (co-authored by @Copilot)

Repository Infrastructure Updates

Update version to 10.6.0 #7458 by @jeffhandley
[main] Update dependencies from dotnet/arcade #7451
Bump follow-redirects from 1.15.11 to 1.16.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport #7469
Merge release/10.5 into main #7470 by @jeffhandley
Bump microsoft.visualstudio.slngen.tool from 12.0.13 to 12.0.32 #7484
Bump postcss from 8.5.9 to 8.5.12 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #7494
Bump dotnet-reportgenerator-globaltool from 5.5.7 to 5.5.9 #7504
Rename release-notes skill to write-release-notes #7511 by @jeffhandley (co-authored by @Copilot)

Acknowledgements

@wtgodbe @tarekgh @peterwald @JeremyLikness @eiriktsarpalis @ericstj @evgenyfedorov2 reviewed pull requests

Full Changelog: dotnet/extensions@v10.5.2...v10.6.0

10.5.2

This patch release ships a single fix to Microsoft.Extensions.VectorData.Abstractions, correcting StorageName resolution when external serialization is enabled. Microsoft.Extensions.VectorData.ConformanceTests, Microsoft.Extensions.AI.Abstractions, Microsoft.Extensions.AI, and Microsoft.Extensions.AI.OpenAI are published alongside it for version coherency — they contain no code changes from 10.5.1.

Packages in this release

Package	Version
Microsoft.Extensions.VectorData.Abstractions	10.5.2
Microsoft.Extensions.VectorData.ConformanceTests	10.5.2
Microsoft.Extensions.AI.Abstractions	10.5.2
Microsoft.Extensions.AI	10.5.2
Microsoft.Extensions.AI.OpenAI	10.5.2

What's Changed

Microsoft.Extensions.VectorData.Abstractions

Minor fixes to MEVD.Abstractions: correct StorageName behavior when external serialization is enabled, and disable a warning for net462. (by @roji in #7475)

Full Changelog: dotnet/extensions@v10.5.1...v10.5.2

10.5.1

Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.

The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.5.1
Microsoft.Extensions.AI.Abstractions	10.5.1
Microsoft.Extensions.AI.OpenAI	10.5.1
Microsoft.Extensions.AI.Templates	10.5.1-preview.3.26251.3
Microsoft.Agents.AI.ProjectTemplates	1.3.0-preview.1.26251.3

Experimental API Changes

Now Stable

The following types previously emitted the MEAI001 experimental diagnostic and are now stable.

CodeInterpreter and WebSearch tool content types are now stable #7493
- CodeInterpreterToolCallContent
- CodeInterpreterToolResultContent
- WebSearchToolCallContent
- WebSearchToolResultContent
ImageGeneration tool content types and tool are now stable #7476
- ImageGenerationToolCallContent
- ImageGenerationToolResultContent
- HostedImageGenerationTool
- ImageGenerationOptions
- ImageGenerationResponseFormat (the Hosted enum value remains experimental)
- IImageGenerator and the rest of the image generation infrastructure also remain experimental

New Experimental APIs

The following new APIs emit the MEAI001 experimental diagnostic.

New experimental API: HostedToolSearchTool with DeferredTools for tool-search-driven deferred tool loading #7471
New experimental API: OpenAIRequestPolicies extension hook for appending System.ClientModel.PipelinePolicy instances to outgoing OpenAI requests #7495

Breaking Changes to Experimental APIs

WebSearchToolResultContent.Results was renamed to Outputs as part of the stabilization in #7493, aligning with CodeInterpreterToolResultContent.Outputs. The original Results property was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.
```
WebSearchToolResultContent content = ...;
- IList<AIContent>? items = content.Results;
+ IList<AIContent>? items = content.Outputs;
```

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore from 10.0.0 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options.DataAnnotations from 10.0.0 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Options.DataAnnotations's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.8.0 to 4.13.2.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.13.2 What's Changed

Apply reserved-header handling on the request-clone path and cover all X-MS-TOKEN- headers by @iNinja in Apply reserved-header handling on the request-clone path and cover all X-MS-TOKEN- headers AzureAD/microsoft-identity-web#3915
Restore independent PR pipeline + pool-aware MI identity + net462/472 unit tests by @iarekk in Restore independent PR pipeline + pool-aware MI identity + net462/472 unit tests AzureAD/microsoft-identity-web#3935
Post-release 4.13.0: changelog and public API shipped move by @neha-bhargava in Post-release 4.13.0: changelog and public API shipped move AzureAD/microsoft-identity-web#3937
Remove redundant 'Run unit tests' GitHub Action by @iarekk in Remove redundant 'Run unit tests' GitHub Action AzureAD/microsoft-identity-web#3939
Apply consistent redirect-URI validation on AccountController.SignIn by @iNinja in Apply consistent redirect-URI validation on AccountController.SignIn AzureAD/microsoft-identity-web#3940
Fix duplicate logging of MsalUiRequiredException (in-repo copy of #3910) by @iarekk in Fix duplicate logging of MsalUiRequiredException (in-repo copy of #3910) AzureAD/microsoft-identity-web#3941
Use MSAL's recent UserFIC API for agentic flows by @Avery-Dunn in Use MSAL's recent UserFIC API for agentic flows AzureAD/microsoft-identity-web#3842
Restore CustomizeHttpRequestMessage to run after the authorization header by @neha-bhargava in Restore CustomizeHttpRequestMessage to run after the authorization header AzureAD/microsoft-identity-web#3943
Bump Microsoft.IdentityModel.Tokens.Saml from 5.7.0 to 8.19.1 by @dependabot[bot] in Bump Microsoft.IdentityModel.Tokens.Saml from 5.7.0 to 8.19.1 AzureAD/microsoft-identity-web#3909
Revert #3909: keep OWIN Saml/WsFederation on 5.7.0 by @iarekk in Revert #3909: keep OWIN Saml/WsFederation on 5.7.0 AzureAD/microsoft-identity-web#3944
Bump Microsoft.Identity.Abstractions from 12.4.0 to 12.5.0 by @neha-bhargava in Bump Microsoft.Identity.Abstractions from 12.4.0 to 12.5.0 AzureAD/microsoft-identity-web#3947
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to DownstreamApi by @neha-bhargava in Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to DownstreamApi AzureAD/microsoft-identity-web#3942
Update IdentityModelV5Version and SamlPackageVersion to 5.7.1 in proj… by @trwalke in Update IdentityModelV5Version and SamlPackageVersion to 5.7.1 in proj… AzureAD/microsoft-identity-web#3950
Rename retired MSALMSIV2 agent pool to MISEManagedIdentity by @gladjohn with @Copilot in Rename retired MSALMSIV2 agent pool to MISEManagedIdentity AzureAD/microsoft-identity-web#3949
Improve IDW10109 error handling for credential loading failures by @Avery-Dunn in Improve IDW10109 error handling for credential loading failures AzureAD/microsoft-identity-web#3946
Bump MSAL dependencies to 4.86.1 in central props by @gladjohn with @Copilot in Bump MSAL dependencies to 4.86.1 in central props AzureAD/microsoft-identity-web#3953
Bump the notsecurity group with 3 updates by @dependabot[bot] in Bump the notsecurity group with 3 updates AzureAD/microsoft-identity-web#3954

Full Changelog: AzureAD/microsoft-identity-web@4.13.0...4.13.2

4.13.0 What's Changed

Categorize managed-identity E2E tests and exclude them from the PR build by @iarekk in Categorize managed-identity E2E tests and exclude them from the PR build AzureAD/microsoft-identity-web#3923
Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult by @neha-bhargava in Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult AzureAD/microsoft-identity-web#3904
Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI by @RyAuld in Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI AzureAD/microsoft-identity-web#3926
docs: Credential architecture internals documentation by @gladjohn in docs: Credential architecture internals documentation AzureAD/microsoft-identity-web#3886
Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation by @gladjohn in Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation AzureAD/microsoft-identity-web#3929
Register IAuthorizationHeaderProvider2 in DI by @neha-bhargava in Register IAuthorizationHeaderProvider2 in DI AzureAD/microsoft-identity-web#3927
Bump Microsoft.Identity.Client to 4.86.0 by @neha-bhargava in Bump Microsoft.Identity.Client to 4.86.0 AzureAD/microsoft-identity-web#3931
Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 by @iarekk in Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 AzureAD/microsoft-identity-web#3933
Run missing unit test projects in the ADO PR build by @iarekk in Run missing unit test projects in the ADO PR build AzureAD/microsoft-identity-web#3934
Revert PRs #3933 and #3934: restore single-job PR pipeline by @gladjohn with @Copilot in Revert PRs #3933 and #3934: restore single-job PR pipeline AzureAD/microsoft-identity-web#3936

Full Changelog: AzureAD/microsoft-identity-web@4.12.2...4.13.0

4.12.2

Bug fixes

Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #3894.

4.12.1

Bug fixes

Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #3914.

Behavior changes

Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #3906.
Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #3919.

Fundamentals

Build the solution in the PR pipeline before running tests. See #3911.
Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #3912.
Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #3913.

4.12.0

New features

Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #3899.
Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #3905.

Bug fixes

Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #3902.

Dependencies updates

Update Microsoft.Identity.Abstractions to 12.4.0. See #3899, #3905.
Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #3896.
Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #3900.

4.11.0 What's Changed

Bump vitest from 3.2.4 to 4.1.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in Bump vitest from 3.2.4 to 4.1.0 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3836
Bump MSAL.NET to 4.84.2 and align OWIN binding redirects by @gladjohn with @Copilot in Bump MSAL.NET to 4.84.2 and align OWIN binding redirects AzureAD/microsoft-identity-web#3844
docs(design): devex proposal for mTLS PoP on Managed Identity and FIC by @gladjohn in docs(design): devex proposal for mTLS PoP on Managed Identity and FIC AzureAD/microsoft-identity-web#3832
Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values by @iarekk in Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values AzureAD/microsoft-identity-web#3850
Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #3832) by @gladjohn in Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #3832) AzureAD/microsoft-identity-web#3839
docs(design): devex proposal for Bearer tokens with bound credentials by @gladjohn in docs(design): devex proposal for Bearer tokens with bound credentials AzureAD/microsoft-identity-web#3833
Add bound-credential support for Bearer tokens (cert + mTLS) by @gladjohn in Add bound-credential support for Bearer tokens (cert + mTLS) AzureAD/microsoft-identity-web#3835
Upgrade IdWeb Sidecar to .NET 10 (LTS) by @soodt in Upgrade IdWeb Sidecar to .NET 10 (LTS) AzureAD/microsoft-identity-web#3841
MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support by @tlupes in MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support AzureAD/microsoft-identity-web#3815
fix: include isTokenBinding in CCA cache key to prevent bearer/PoP collision by @gladjohn in fix: include isTokenBinding in CCA cache key to prevent bearer/PoP collision AzureAD/microsoft-identity-web#3867
Test + doc: x-ms-tokenboundauth header for AKV mTLS PoP via ExtraHeaderParameters by @gladjohn in Test + doc: x-ms-tokenboundauth header for AKV mTLS PoP via ExtraHeaderParameters AzureAD/microsoft-identity-web#3864
Add mTLS PoP Copilot skill (certificate, MSI, FIC) by @gladjohn in Add mTLS PoP Copilot skill (certificate, MSI, FIC) AzureAD/microsoft-identity-web#3872
Fix CVE-2026-48109: Pin MessagePack to patched version 2.5.301 by @soodt in Fix CVE-2026-48109: Pin MessagePack to patched version 2.5.301 AzureAD/microsoft-identity-web#3865
Sidecar: gate agent identity parameters behind AllowOverrides by @iNinja in Sidecar: gate agent identity parameters behind AllowOverrides AzureAD/microsoft-identity-web#3871
Bump System.Formats.Asn1 base version to 10.0.2 by @iarekk in Bump System.Formats.Asn1 base version to 10.0.2 AzureAD/microsoft-identity-web#3875
Bump Microsoft.IdentityModel.* from 8.18.0 to 8.19.1 by @iarekk in Bump Microsoft.IdentityModel.* from 8.18.0 to 8.19.1 AzureAD/microsoft-identity-web#3879
Use IIdentityLogger for MSAL logging in TokenAcquisition and ManagedIdentityClientAssertion (#3820) by @neha-bhargava in Use IIdentityLogger for MSAL logging in TokenAcquisition and ManagedIdentityClientAssertion (#3820) AzureAD/microsoft-identity-web#3880
Update Microsoft.Identity.Abstractions to 12.2.0 and MSAL to 4.85.0 by @neha-bhargava in Update Microsoft.Identity.Abstractions to 12.2.0 and MSAL to 4.85.0 AzureAD/microsoft-identity-web#3881
Surface MSAL AuthenticationResultMetadata + exception details on AcquireTokenResult by @neha-bhargava in Surface MSAL AuthenticationResultMetadata + exception details on AcquireTokenResult AzureAD/microsoft-identity-web#3856
Flow outgoing request to header providers via AcquireTokenOptions by @neha-bhargava in Flow outgoing request to header providers via AcquireTokenOptions AzureAD/microsoft-identity-web#3876
Throw on Authority vs Instance/TenantId conflict (OIDC + MSAL parity) by @iarekk in Throw on Authority vs Instance/TenantId conflict (OIDC + MSAL parity) AzureAD/microsoft-identity-web#3873
Delete .github/workflows/evergreen.yml by @bgavrilMS in Delete .github/workflows/evergreen.yml AzureAD/microsoft-identity-web#3803
Add comprehensive authority configuration and precedence documentation by @jmprieur with @Copilot in Add comprehensive authority configuration and precedence documentation AzureAD/microsoft-identity-web#3617
Bump js-yaml from 4.1.1 to 4.2.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in Bump js-yaml from 4.1.1 to 4.2.0 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3862
Move authority docs into docs/authority-configu...

Description has been truncated

Bumps Microsoft.AspNetCore.DataProtection from 10.0.7 to 10.0.10 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.7 to 10.0.10 Bumps Microsoft.AspNetCore.OpenApi from 10.0.7 to 10.0.10 Bumps Microsoft.Data.SqlClient from 7.0.0 to 7.0.2 Bumps Microsoft.EntityFrameworkCore from 10.0.7 to 10.0.10 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.7 to 10.0.10 Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.7 to 10.0.10 Bumps Microsoft.Extensions.AI from 10.5.0 to 10.8.1 Bumps Microsoft.Extensions.AI.Abstractions from 10.5.0 to 10.8.1 Bumps Microsoft.Extensions.AI.OpenAI from 10.5.0 to 10.8.1 Bumps Microsoft.Extensions.Configuration.Abstractions from 10.0.7 to 10.0.10 Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.7 to 10.0.10 Bumps Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore from 10.0.0 to 10.0.10 Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.7 to 10.0.10 Bumps Microsoft.Extensions.Options.DataAnnotations from 10.0.0 to 10.0.10 Bumps Microsoft.Identity.Web from 4.8.0 to 4.13.2 Bumps Microsoft.NET.Test.Sdk from 18.4.0 to 18.8.1 Bumps OpenAI from 2.10.0 to 2.12.0 Bumps System.Security.Cryptography.Xml from 10.0.7 to 10.0.10 --- updated-dependencies: - dependency-name: Microsoft.AspNetCore.DataProtection dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: System.Security.Cryptography.Xml dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Data.SqlClient dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Extensions.Configuration.Abstractions dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.EntityFrameworkCore.SqlServer dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Extensions.AI dependency-version: 10.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft - dependency-name: Microsoft.Extensions.AI.Abstractions dependency-version: 10.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft - dependency-name: Microsoft.Extensions.AI.OpenAI dependency-version: 10.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft - dependency-name: OpenAI dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft - dependency-name: Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Extensions.Options.DataAnnotations dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoft - dependency-name: Microsoft.Identity.Web dependency-version: 4.13.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: microsoft ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 22, 2026

This was referenced Jul 22, 2026

Bump the microsoft group with 19 updates #65

Closed

Bump Microsoft.AspNetCore.DataProtection and 16 others #69

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the microsoft group with 19 updates#71

Bump the microsoft group with 19 updates#71
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/microsoft-64ec5f10a7

dependabot Bot commented on behalf of github Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 22, 2026

7.0.2

Companion package release notes

Fixed

Changed

Hardened TDS token parsing with data-length bounds checks

7.0.1

Fixed

Changed

Contributors

Target Platform Support

Dependencies

.NET 9.0

.NET 8.0

10.8.1

Packages in this release

What's Changed

AI

Acknowledgements

10.8.0

Experimental API Changes

New Experimental APIs

What's Changed

AI

Vector Data

Documentation Updates

Test Improvements

Repository Infrastructure Updates

10.7.0

Experimental API Changes

Now Stable

What's Changed

AI

Diagnostics, Health Checks, and Resource Monitoring

Repository Infrastructure Updates

Acknowledgements

10.6.0

Experimental API Changes

Now Stable

What's Changed

AI

Repository Infrastructure Updates

Acknowledgements

10.5.2

Packages in this release

What's Changed

Microsoft.Extensions.VectorData.Abstractions

10.5.1

Packages in this release

Experimental API Changes

Now Stable

New Experimental APIs

Breaking Changes to Experimental APIs

10.8.1

Packages in this release

What's Changed

AI

Acknowledgements

10.8.0

Experimental API Changes

New Experimental APIs

What's Changed

AI

Vector Data

Documentation Updates

Test Improvements

Repository Infrastructure Updates

10.7.0

Experimental API Changes

Now Stable

What's Changed

AI

Diagnostics, Health Checks, and Resource Monitoring

Repository Infrastructure Updates

Acknowledgements

10.6.0

Experimental API Changes

Now Stable

What's Changed