[dependabot]

Updated Aspire.Hosting.JavaScript from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.JavaScript's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

• 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

• 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

• 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

• 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

• 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

---

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.14 to 10.0.15.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.11.0 to 11.0.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

11.0.0

Version 11.0.0 ships alongside .NET 11 and with net11 targets added to packages. Highlights of this release include new experimental Documents and Document Extraction abstractions, metric instrument descriptions, and a sliding-window retry budget for HTTP resilience.

Experimental API Changes

Now Stable

• HTTP server latency telemetry (AddHttpServerLatencyTelemetry) APIs are now stable (previously EXTEXP0013) #​7898

New Experimental APIs

• New experimental API: Documents abstractions in the new Microsoft.Extensions.Documents.Abstractions package (EXTEXP0019) #​7835
• New experimental API: Document Extraction in the new Microsoft.Extensions.DocumentExtraction and Microsoft.Extensions.DocumentExtraction.Abstractions packages (MEDE0001) #​7588
• New experimental API: HTTP resilience retry budget (HttpRetryBudgetOptions, HttpRetryResiliencePipelineBuilderExtensions, OnRetryBudgetExhaustedArguments) (EXTEXP0001) #​7867
• New experimental API: Description on metric attributes (EXTEXP0003) #​7837

Obsoleted APIs

• HybridCacheOptions.DisableCompression is now obsolete (EXTOBS0003) #​7885

What's Changed

Telemetry and Logging

• Add Description to metric attributes and describe all instruments #​7837 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Capture trace context, thread ID and message template in buffered logs #​7818 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Allow bool and numeric types for strongly-typed metric tags #​7877 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Fix route parameter redaction when a parameter value contains a delimiter used later in the same path segment #​7828 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Fix lost log records when logging reentrantly on the same thread #​7847 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Fix logging generator stack overflow on type cycles #​7861 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Honor [LogPropertyIgnore] during transitive logging and [LogProperties(Transitive = true)] on properties #​7868 by @​evgenyfedorov2 (co-authored by @​Copilot)
• Make DataClassificationSet static to decrease allocations #​7874 by @​evgenyfedorov2 (co-authored by @​Copilot)

Caching

• Add HybridCache.GetOrCreateAsync overloads for dynamic setting of options #​7568 by @​svick (co-authored by @​Copilot)
• Mark HybridCacheOptions.DisableCompression as obsolete #​7885 by @​slang25
• Fix HybridCache stampede state removal race #​7814 by @​svick (co-authored by @​Copilot)
• Fix HybridCache reservation over-release on DisableUnderlyingData miss #​7879 by @​Eng3bbas

AI

• AI: Restore neutral tool approval rejection message #​7913 by @​jozkee (co-authored by @​Copilot)
• Fix ImageGenerationOptions.Clone dropping StreamingCount #​7829 by @​Empiree
• Fix evaluation context serialization without reflection fallback #​7869 by @​valkiara
• Pin MessagePack 2.5.307 in AI template AppHost project #​7853 by @​evgenyfedorov2 (co-authored by @​Copilot)

Packaging and Target Frameworks

• Condition framework-provided package references for .NET 11 #​7915 by @​jeffhandley (co-authored by @​Copilot)
  ... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.11.0 to 18.12.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.InMemory from 1.20.1 to 1.21.0.

Release notes

Sourced from OpenTelemetry.Exporter.InMemory's releases.

1.21.0

For highlights and announcements pertaining to this release see: Release Notes > 1.21.0.

The following changes are from the previous release 1.21.0-rc.2.

• NuGet: OpenTelemetry v1.21.0

  • OpenTelemetryLoggerOptions is now bound from the Logging:OpenTelemetry
    configuration section using the configuration binding source generator instead
    of reflection, making it fully trim and Native AOT compatible. An empty value
    for a boolean option is now ignored on all target frameworks rather than
    throwing on some, depending on the version of
    Microsoft.Extensions.Configuration.Binder in use.
    (#​8100)

  • Fixed the self-diagnostics environment snapshot leaving a dangling comma in a
    redacted OTEL_RESOURCE_ATTRIBUTES value when it contained empty entries.
    (#​8104)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api v1.21.0

  • Update System.Diagnostics.DiagnosticSource dependency to 11.0.0
    for all target frameworks.
    (#​8066)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.21.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.Console v1.21.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.InMemory v1.21.0

  No notable changes.

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol v1.21.0

  • Hardened the experimental disk retry feature.
    • Breaking: When running on .NET on non-Windows platforms, creating the
      ... (truncated)

1.21.0-rc.2

The following changes are from the previous release 1.21.0-rc.1.

• NuGet: OpenTelemetry v1.21.0-rc.2

  • Fixed an exception when downscaling empty exponential histogram buckets after
    a reset.
    (#​8064)

  • Fixed tracing callbacks continuing after provider shutdown or disposal on older
    target frameworks.
    (#​8065)

  • Fixed initialization failures when environment variable access is denied.
    Configuration reloads retain the last successful values when access is denied.
    (#​8070)

  • Fixed a source, meter or legacy activity name with a trailing line feed
    matching a wildcard pattern which does not end in a wildcard.
    (#​8074)

  • Fixed OTEL_RESOURCE_ATTRIBUTES values being decoded as form data, which
    changed a + to a space. Values are now only percent-decoded, as defined by
    the Resource SDK specification.
    (#​8074)

  • Updated the schema URL of resources created by the SDK to use OpenTelemetry
    Semantic Conventions version 1.45.0.
    (#​8079)

  • Added support for batching the metric points exported by
    PeriodicExportingMetricReader. When a maximum export batch size is set,
    using the new constructor overload or
    PeriodicExportingMetricReaderOptions.MaxExportBatchSize, the metric
    points of each collection are split into batches of at most that many
    metric points, even if that splits up the metric points of a single
    metric. The batches are exported serially with the export timeout
    applying to each export. It can also be configured with the
    OTEL_METRIC_EXPORT_MAX_BATCH_SIZE environment variable.
    (#​8053)

  • Fixed PeriodicExportingMetricReader exporting a collection which was still
    in progress when Shutdown() timed out to its exporter after the exporter
    had been shut down.
    (#​8053)

  • Fixed PeriodicExportingMetricReader not making its final collection when
    Shutdown() was called before its background task had started running on
    platforms where threading is not available, such as browsers.
    (#​8053)

... (truncated)

1.21.0-rc.1

The following changes are from the previous release 1.20.1.

• NuGet: OpenTelemetry v1.21.0-rc.1

  • Fixed a race in the self-diagnostics sink dispatcher where disposing it
    while its pump thread was exiting could throw ArgumentNullException on
    .NET Framework.
    (#​7983)

  • SelfDiagnosticsOptions is now automatically bound from the
    OpenTelemetry:SelfDiagnostics configuration section, when present.
    (#​8008)

  • Fixed a race where collecting a metric with delta temporality concurrently
    with the creation of a new MetricPoint could reclaim the MetricPoint
    while it was being created, losing the measurement.
    (#​8019)

  • Fixed a race where collecting a metric with delta temporality could export
    the same series twice in a single collection.
    (#​8019)

  • Fixed wildcard matching timeouts that could prevent configured source, meter,
    legacy activity, or metric view patterns from matching.
    (#​8014)

  • The timeout passed to MetricReader.Collect() (for example by
    MeterProvider.ForceFlush()), the ExportTimeoutMilliseconds of
    PeriodicExportingMetricReader and the ExporterTimeoutMilliseconds of
    BatchExportProcessor<T> are now made available to the exporter instead of
    being ignored once the export has started, so that the OTLP exporter can
    cancel an export which runs past the timeout. The ExportTimeoutMilliseconds
    of PeriodicExportingMetricReader now also limits exports which are not
    started by the reader itself, such as those of MeterProvider.ForceFlush().
    (#​7996)

  • Fixed a race where collecting a cumulative metric concurrently with the
    creation of a new MetricPoint could export a MetricPoint that was not yet
    fully initialized, could case a NullReferenceException when enumerating Tags.
    (#​8018)

  • Breaking Change Dropped support for net8.0 and net9.0.
    (#​6899)

  • Add support for .NET 11.0.
    (#​6899)

  • Added support for enabling ActivitySources from configuration using the
    Microsoft.Extensions.Diagnostics tracing APIs introduced in .NET 11 (for
    example, services.AddTracing(b => b.AddConfiguration(section))).
    ... (truncated)

1.21.0-beta.1

The following changes are from the previous release 1.20.1-beta.1.

• NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.21.0-beta.1

  • Fixed OpenMetrics scrape responses containing a # UNIT line whose unit is
    not an underscore-separated suffix of the metric family name (for example
    auth.failedlogins with the unit logins), which caused scrapers such as
    Prometheus to reject the whole response. The # UNIT line is now omitted
    for such metrics; exported metric names are unchanged.
    (#​7993)

  • Fixed scrapes that negotiate different response formats within the
    ScrapeResponseCacheDurationMilliseconds window each triggering their own
    metrics collection. A collection now also writes the response for other
    formats whose scrapes arrived alongside a previous collection, so scrapes
    that keep arriving together are served from the cache. Fresh cached responses
    remain available while another format is serialized, even if that
    serialization fails.
    (#​7994)

  • Fixed array- and map-valued attributes being serialized as the .NET type
    name (e.g. System.Byte[], System.Int32[]) instead of being JSON-encoded
    as per the specification. byte[]-valued attributes are now
    Base64-encoded, and other array- and map-valued attributes are now
    JSON-encoded.
    (#​7694)

  • Fixed arrays of string-valued key/value pairs being
    serialized as JSON arrays of strings instead of JSON objects.
    (#​7694)

  • Fixed scrape clients which stop reading their response delaying other
    scrapes until ScrapeResponseTimeoutMilliseconds elapses.
    (#​8041)

  • Breaking Change Dropped support for net8.0 and net9.0.
    (#​6899)

  • Add support for .NET 11.0.
    (#​6899)

  • Fixed a scrape response containing the same series (metric name and labels)
    more than once, which causes Prometheus to reject the whole response, such as
    when metric or tag names are the same once escaped, tag names become the same
    when UTF-8 encoded, or the scope information is disabled. Duplicate series are
    now dropped, and a warning event is written.
    A metric which has the name of a sample that is generated for another one
    (for example _sum of a histogram) is now dropped, and a warning event is
    written.
    (#​8076)
    ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Summary - Code Coverage

Summary

Generated on:	11/12/2026 - 06:06:52
Coverage date:	11/12/2026 - 06:06:47 - 11/12/2026 - 06:06:50
Parser:	MultiReport (2x Cobertura)
Assemblies:	2
Classes:	17
Files:	12
Line coverage:	71.1% (495 of 696)
Covered lines:	495
Uncovered lines:	201
Coverable lines:	696
Total lines:	1246
Branch coverage:	42.1% (97 of 230)
Covered branches:	97
Total branches:	230
Method coverage:	Feature is only available for sponsors
Tag:	1373_43165753972

Coverage

PointerStar.Server - 68%

Name	Line	Branch
PointerStar.Server	68%	43.3%
AspNetCoreGeneratedDocument.Pages_Error	0%	0%
PointerStar.Server.Controllers.ClientConfigController	100%	75%
PointerStar.Server.Controllers.GiphyController	0%	0%
PointerStar.Server.Controllers.GiphyItem	0%
PointerStar.Server.Controllers.GiphySearchResponse	0%
PointerStar.Server.Controllers.PaginationInfo	0%
PointerStar.Server.Controllers.RoomController	100%
PointerStar.Server.Hubs.RoomHub	0%	0%
PointerStar.Server.Pages.ErrorModel	0%	0%
PointerStar.Server.Room.InMemoryRoomManager	97.2%	79.8%
Program	83.6%	50%

PointerStar.Shared - 91.3%

Name	Line	Branch
PointerStar.Shared	91.3%	0%
PointerStar.Shared.Role	50%	0%
PointerStar.Shared.RoomOptions	100%
PointerStar.Shared.RoomState	100%
PointerStar.Shared.User	100%
PointerStar.Shared.UserOptions	100%
PointerStar.Shared.VotingPresets	98.1%