Skip to content

chore: Bump Aspire.Hosting.AppHost and 4 others - #1685

Merged
philcarbone merged 4 commits into
developfrom
dependabot/nuget/develop/aspire-0bc60d63b9
Oct 24, 2026
Merged

chore: Bump Aspire.Hosting.AppHost and 4 others#1685
philcarbone merged 4 commits into
developfrom
dependabot/nuget/develop/aspire-0bc60d63b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Aspire.Hosting.AppHost from 13.6.1 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.ServiceBus from 13.6.1 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.Azure.ServiceBus's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.PostgreSQL from 13.6.1 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.RabbitMQ from 13.6.1 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.RabbitMQ's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.6.1 to 13.6.3.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

@dependabot
dependabot Bot requested a review from a team as a code owner October 23, 2026 11:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file nuget Pull requests that update NuGet packages labels Oct 23, 2026
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

github-actions Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📦 Version Information: 0.2624.0-pr1685.621

Property Value
SemVer 0.2624.0-pr1685.621
Full SemVer 0.2624.0-pr1685.621
Pre-release pr1685.621

@dependabot
chore: Bump Aspire.Hosting.AppHost and 4 others
b93c098 
Bumps Aspire.Hosting.AppHost from 13.6.1 to 13.6.3
Bumps Aspire.Hosting.Azure.ServiceBus from 13.6.1 to 13.6.3
Bumps Aspire.Hosting.PostgreSQL from 13.6.1 to 13.6.3
Bumps Aspire.Hosting.RabbitMQ from 13.6.1 to 13.6.3
Bumps Aspire.Hosting.Testing from 13.6.1 to 13.6.3

---
updated-dependencies:
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aspire
- dependency-name: Aspire.Hosting.Azure.ServiceBus
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aspire
- dependency-name: Aspire.Hosting.PostgreSQL
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aspire
- dependency-name: Aspire.Hosting.RabbitMQ
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aspire
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 13.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: aspire
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore: Bump the aspire group with 5 updates chore: Bump Aspire.Hosting.AppHost and 4 others Oct 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/nuget/develop/aspire-0bc60d63b9 branch from ea844dc to b93c098 Compare October 23, 2026 21:28
@github-actions

This comment has been minimized.

Sign in to view
@philcarbone
build: raise the MessagePack floor to 2.5.307 for Aspire 13.6.3
b4ed278 
Aspire.Hosting 13.6.3 requires MessagePack >= 2.5.307, so the 2.5.303 pin
was a downgrade (NU1605) and every restore failed. Same 2.x line, so the
CVE-2026-48109 patch still holds.

Signed-off-by: Phil Carbone <5216301+philcarbone@users.noreply.github.com>
@philcarbone
Merge remote-tracking branch 'origin/develop' into dependabot/nuget/d…
67713c9 
…evelop/aspire-0bc60d63b9

Signed-off-by: Phil Carbone <5216301+philcarbone@users.noreply.github.com>
@philcarbone
build: regenerate lock files for Aspire 13.6.3 and MessagePack 2.5.307
8aebea3 
Signed-off-by: Phil Carbone <5216301+philcarbone@users.noreply.github.com>
@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

PR review checks

Checked commit 8aebea33c (run). The Gate · Review checks check fails while any finding below is open: fix it, or mark a false positive with review-checks:allow on the line.

No findings.

A maintainer can turn these into a draft review: pwsh scripts/Invoke-PrReviewDraft.ps1 -PullRequest 1685

@sonarqubecloud

sonarqubecloud Bot commented Oct 24, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions

github-actions Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

PR quality gate

Checked commit 8aebea33c at 2026-10-24 18:17 UTC (run)

Check Result
Coverage of new lines 100%, every added library line is executed by a test
Coverage of new branches 100%, every outcome of every added hand-written decision is taken by a test
Sonar findings on new code none
Whole library (gated) Whole library: lines 100%, hand-written branches 100%, every line and every hand-written decision in the library is covered

Reproduce locally: pwsh scripts/Invoke-PrHealth.ps1 -PullRequest 1685
A maintainer can draft these as a review: pwsh scripts/Invoke-PrReviewDraft.ps1 -PullRequest 1685

@philcarbone
philcarbone added this pull request to the merge queue Oct 24, 2026
Merged via the queue into develop with commit 6760979 Oct 24, 2026
70 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@philcarbone philcarbone

Labels

dependencies Pull requests that update a dependency file nuget Pull requests that update NuGet packages

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@philcarbone