Repository navigation
Bump the minor-and-patch group with 24 updates - #94
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps Aspire.Hosting.AppHost from 13.5.4 to 13.6.5 Bumps Aspire.Hosting.Azure.CosmosDB from 13.5.4 to 13.6.5 Bumps bunit from 2.11.3 to 2.15.2 Bumps Microsoft.Azure.Cosmos from 3.63.1 to 3.64.0 Bumps Microsoft.Data.SqlClient from 7.1.0 to 7.1.1 Bumps Microsoft.Data.Sqlite from 10.0.12 to 10.0.15 Bumps Microsoft.Extensions.AI.Abstractions from 10.10.1 to 10.11.0 Bumps Microsoft.Extensions.Http from 10.0.12 to 10.0.15 Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.12.0 Bumps Microsoft.Playwright from 1.63.0 to 1.64.1 Bumps ModelContextProtocol from 2.2.0 to 2.4.0 Bumps ModelContextProtocol.AspNetCore from 2.2.0 to 2.4.0 Bumps Quartz.Extensions.DependencyInjection from 3.22.3 to 3.22.10 Bumps Quartz.Extensions.Hosting from 3.22.3 to 3.22.10 Bumps SQLitePCLRaw.lib.e_sqlite3 from 2.1.13 to 2.1.14 Bumps StackExchange.Redis from 3.3.1 to 3.4.31 Bumps Swashbuckle.AspNetCore from 10.2.3 to 10.3.1 Bumps Temporalio from 1.20.0 to 1.22.0 Bumps Testcontainers.CosmosDb from 4.15.0 to 4.16.0 Bumps Testcontainers.MsSql from 4.15.0 to 4.16.0 Bumps Testcontainers.PostgreSql from 4.15.0 to 4.16.0 Bumps Testcontainers.Redis from 4.15.0 to 4.16.0 Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1 Bumps xunit.v3 from 4.0.1 to 4.0.3 --- updated-dependencies: - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Aspire.Hosting.Azure.CosmosDB dependency-version: 13.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: bunit dependency-version: 2.15.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.Azure.Cosmos dependency-version: 3.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.Data.SqlClient dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Data.Sqlite dependency-version: 10.0.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.AI.Abstractions dependency-version: 10.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.Playwright dependency-version: 1.64.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ModelContextProtocol dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ModelContextProtocol.AspNetCore dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Quartz.Extensions.DependencyInjection dependency-version: 3.22.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 3.22.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: SQLitePCLRaw.lib.e_sqlite3 dependency-version: 2.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: StackExchange.Redis dependency-version: 3.4.31 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Swashbuckle.AspNetCore dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Temporalio dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Testcontainers.CosmosDb dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Testcontainers.MsSql dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Testcontainers.PostgreSql dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Testcontainers.Redis dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.v3 dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
This was referenced Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Aspire.Hosting.AppHost from 13.5.4 to 13.6.5.
Release notes
Sourced from Aspire.Hosting.AppHost's releases.
13.6.5
What's New in Aspire 13.6.5
Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.
🐛 Fixes
🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#22071, 0b6bfe2, @jamesnk)
🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#22071, f017f66, @karolz-ms)
🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The
aspire sdk generate,aspire sdk dump, andaspire sdk exportcommands use isolated working directories under<ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#22071, 1ecd7cc, @sebastienros)🔒 Agent setup no longer writes configuration content to a shared temporary log —
aspire agent initstops writing agent configuration paths, configuration content, and scan diagnostics toaspire-deprecated-scan.login the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#22071, c408ec5, @mitchdenny)🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#21348, @joperezr)
Full Changelog: v13.6.4...v13.6.5
Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580
13.6.4
What's New in Aspire 13.6.4
Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.
🐛 Fixes
🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature
FailedToStartstate when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured throughDcpPublisher:KubernetesApiTimeout,DcpPublisher:KubernetesInitializationAdditionalTimeout, andDcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #20691. (#20868, backport of #20752, @danegsta)☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a
bicep().parameter(...)expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#20767, backport of #20557, @sebastienros)🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (
0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#21282, backport of #21276, @mitchdenny)Full Changelog: v13.6.3...v13.6.4
Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Updated Aspire.Hosting.Azure.CosmosDB from 13.5.4 to 13.6.5.
Release notes
Sourced from Aspire.Hosting.Azure.CosmosDB's releases.
13.6.5
What's New in Aspire 13.6.5
Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.
🐛 Fixes
🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#22071, 0b6bfe2, @jamesnk)
🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#22071, f017f66, @karolz-ms)
🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The
aspire sdk generate,aspire sdk dump, andaspire sdk exportcommands use isolated working directories under<ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#22071, 1ecd7cc, @sebastienros)🔒 Agent setup no longer writes configuration content to a shared temporary log —
aspire agent initstops writing agent configuration paths, configuration content, and scan diagnostics toaspire-deprecated-scan.login the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#22071, c408ec5, @mitchdenny)🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#21348, @joperezr)
Full Changelog: v13.6.4...v13.6.5
Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580
13.6.4
What's New in Aspire 13.6.4
Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.
🐛 Fixes
🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature
FailedToStartstate when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured throughDcpPublisher:KubernetesApiTimeout,DcpPublisher:KubernetesInitializationAdditionalTimeout, andDcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #20691. (#20868, backport of #20752, @danegsta)☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a
bicep().parameter(...)expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#20767, backport of #20557, @sebastienros)🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (
0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#21282, backport of #21276, @mitchdenny)Full Changelog: v13.6.3...v13.6.4
Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf
13.6.3
What's New in Aspire 13.6.3
Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.
🐛 Fixes
🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#21002, backport of #20972, @danegsta)
🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#21215, @danegsta; includes microsoft/dcp#307)
Full Changelog: v13.6.2...v13.6.3
Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976
13.6.2
Full commit: af07e33f8d1ef733645138b3f8e36067d073148d
What's Changed
Full Changelog: microsoft/aspire@v13.6.1...v13.6.2
13.6.1
What's New in Aspire 13.6.1
Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.
🐛 Fixes
📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #20725. (#20747, backport of #20736, @JamesNK)
📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #20728. (#20762, backport of #20758, @heyysiri)
🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#20545, backport of #20527, @JamesNK)
🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical
Watch task over Kubernetes ContainerExec resources terminated unexpectedlyerror and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#20664, backport of #20466, @radical)🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through
dotnet runordotnet watchnow allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C andaspire stopflows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #20495. (#20514, backport of #20494, @danegsta)Full Changelog: v13.6.0...v13.6.1
Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8
13.6.0
Aspire 13.6.0
Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.
Highlights
WithRepl()commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, whileaspire terminal psandaspire terminal tape playsupport discovery and repeatable terminal interactions.Aspire.Hosting.JavaandAspire.Hosting.Rustpackages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.Aspire.Hosting.Dotnetintegration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standardappsettings.jsonconfiguration and Deno runtime support.aspire runandaspire start, update repository-local CLI manifests withaspire update, create file-based C# AppHosts withaspire init --language csharp --file-based, and export TypeScript API data withaspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, andaspire stop --force --volumesadds explicit cleanup of Aspire-owned volumes.ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from
Aspire.Hosting.TerminalstoAspire.Hosting.ApplicationModel.See the full list and migration guidance in the Aspire 13.6 breaking changes.
📖 Learn more
For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.
Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜
Full Changelog: v13.5.4...v13.6.0
Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f
Commits viewable in compare view.
Updated bunit from 2.11.3 to 2.15.2.
Release notes
Sourced from bunit's releases.
2.15.2
Added
net11.0target now references the final .NET 11 packages and is compiled with runtime async. By @linkdotnet.Changed
bunit.templatenow targetsnet11.0by default.Fixed
bunit.templateoption to choose the target framework is now--sdkas documented, instead of--targetSdk. By @linkdotnet.2.14.0
Changed
Fixed
FindthrewTypeLoadExceptionwith AngleSharp 1.10.0 because the generated element wrappers did not implement the newBeforeToggleevent. Reported by @ryanbaas83-collab in #1968. Fixed by @linkdotnet.2.13.3
Fixed
FindthrewTypeLoadExceptionwith AngleSharp 1.8.6 becauseHtmlSelectElementWrapperdid not implement the newSelectedIndexsetter. Reported by @poxet in #1957. Fixed by @linkdotnet.WaitFor*call whose first check passed left its timeout timer running, which kept the helper, the renderer and everything the renderer holds alive until the timeout elapsed. With a longDefaultWaitTimeout, a test suite could hold every rendered component in memory for its whole run. Fixed by @xaviergxf.2.12.5
Fixed
WrapperBase.WrappedElementcould returnnulland throwNullReferenceExceptionwhen an element was accessed concurrently with component re-renders. Reported by @psu-prog in #1937. Fixed by @Nacl-HCl.DisposeComponentsAsync()could dispose nothing when the renderer's dispatcher was busy, e.g. with a timer callingInvokeAsync. Reported by @xfunc-tim-schneider in #1939. Fixed by @linkdotnet.FindComponentscould recurse until the test host crashed with a stack overflow when a render threw while instantiating a child component. Reported in #1935. Fixed by @linkdotnet.Find()could keep returning DOM nodes from the previous render when a render, e.g. from a timer, happened while the nodes were parsed, causingUnknownEventHandlerIdException. Reported by @xfunc-tim-schneider in #1938. Fixed by @linkdotnet.Commits viewable in compare view.
Updated Microsoft.Azure.Cosmos from 3.63.1 to 3.64.0.
Release notes
Sourced from Microsoft.Azure.Cosmos's releases.
3.64.0
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0
3.64.0-preview.4
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0-preview.4
3.64.0-preview.3
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0-preview.3
3.64.0-preview.2
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0-preview.2
3.64.0-preview.1
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0-preview.1
3.64.0-preview.0
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.64.0-preview.0
3.63.4
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.63.4
3.63.3
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.63.3
3.63.2
See changelog for details.
NuGet: https://www.nuget.org/packages/Microsoft.Azure.Cosmos/3.63.2
Commits viewable in compare view.
Updated Microsoft.Data.SqlClient from 7.1.0 to 7.1.1.
Release notes
Sourced from Microsoft.Data.SqlClient's releases.
7.1.1
This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.
Companion package release notes
Changes Since 7.1.0
Fixed
Fixed an
ArgumentExceptionwhen sending zero-valueddecimalorSqlDecimalparameters whose precision equals their scale. Nonzero precision validation and support for large decimal values are unchanged. (#4715, #4721, #4732)Fixed connection pool V2 handing out pooled connections with expired or nearly expired access tokens. The pool now checks token expiry before reuse, matching the default pool's behavior while preserving transaction-affine reuse. This affects only applications that opt in to connection pool V2. (#4734, #4739)
Fixed connection opens failing when
ClearPoolorClearAllPoolsraces with an in-flight open. Requests already admitted to the cleared pool can finish, and connections returned to the retired pool are discarded rather than reused. (#4714, #4718, #4740)Target Platform Support
Dependencies
.NET 9.0
... (truncated)
Commits viewable in compare view.
Updated Microsoft.Data.Sqlite from 10.0.12 to 10.0.15.
Release notes
Sourced from Microsoft.Data.Sqlite's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.Extensions.AI.Abstractions from 10.10.1 to 10.11.0.
Release notes
Sourced from Microsoft.Extensions.AI.Abstractions's releases.
10.11.0
.NET Extensions 10.11.0
This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.
Experimental API Changes
New Experimental APIs
GlobalLogBufferingOptions.IncludeScopesandPerRequestLogBufferingOptions.IncludeScopes(EXTEXP0003) #7813Breaking Changes to Experimental APIs
AddHttpLatencyTelemetryis renamed toAddHttpServerLatencyTelemetryand moves fromHttpLatencyTelemetryServiceCollectionExtensionstoHttpLoggingServiceCollectionExtensions. It remains experimental underEXTEXP0013in this release. #7730What's Changed
AI
AI Evaluation
Telemetry and Observability
ASP.NET Core Extensions
AI Project Templates
Caching
... (truncated)
Commits viewable in compare view.
Updated Microsoft.Extensions.Http from 10.0.12 to 10.0.15.
Release notes
Sourced from Microsoft.Extensions.Http's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.12.0.
Release notes
Sourced from Microsoft.NET.Test.Sdk's releases.
18.11.0
What's Changed
New Contributors
Full Changelog: microsoft/vstest@v18.10.1...v18.11.0
Commits viewable in compare view.
Updated Microsoft.Playwright from 1.63.0 to 1.64.1.
Release notes
Sourced from Microsoft.Playwright's releases.
1.64.1
Highlights
#3391 - chore(driver): bump bundled Node.js to 24.22.1
Browser Versions
This version was also tested against the following stable channels:
1.64.0
🧰 WebMCP
New page.Webmcp and frame.Webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like
any other part of your app:
Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as
webmcp_<tool>. Pass--no-webmcpto opt out.playwright-cliexposes them as well:playwright-cli webmcp-list playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'🎬 Better videos
Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:
RecordVideoFpsoption and newFpsoption in Screencast.StartAsync(). Firefox and WebKit currently capture up to 25 frames per second.Styleoption takes CSS declarations for thePointmarker, the targetHighlightand the actionTitle. It replaces theFontSizeoption, which is now deprecated.... (truncated)
Commits viewable in compare view.
Updated ModelContextProtocol from 2.2.0 to 2.4.0.
Release notes
Sourced from ModelContextProtocol's releases.
2.4.0
Version 2.4.0 adds experimental MCP Skills support through the new ModelContextProtocol.Extensions.Skills package, alongside OAuth hardening and reliability improvements for transport, session, and discovery flows. MCP Apps also now match protocol property names case-sensitively.
What's Changed
Documentation Updates
Test Improvements
Repository Infrastructure Updates
Acknowledgements
... (truncated)
2.3.1
This patch release includes a security fix for authenticated stateful sessions.
What's Changed
bfbd893) by @halter73 (co-authored by @Copilot @jeffhandley @tarekgh)Repository Infrastructure Updates
Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1
2.3.0
This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a
TimeProviderfor deterministic client timeout tests. It also corrects optional server-identity handling; applications readingMcpClient.ServerInfoshould adopt nullable handling.Breaking Changes
Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.
McpClient.ServerInfois nullable — #1903ImplementationtoImplementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.2026-07-28connections,ServerInfoisnullwhen the server omits optional identity metadata fromserver/discover. Legacyinitializestill requiresserverInfo. Reading the property before connecting still throwsInvalidOperationException.client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.What's Changed
ServerInfonullable #1903 by @Coding-ProfessionalDiscoverProbeTimeout, exposeMcpClientOptions.TimeProviderfor deterministic timeout tests, and default SSE to legacy initialization #1719 by @halter73 (co-authored by @Copilot)InitializationTimeoutand caller cancellation; it is excluded only from the short discovery-probe budget.HttpTransportMode.SseandProtocolVersion = "2026-07-28"; pinning the version withAutoDetectis not equivalent.RequestOptionsserialization #1832 by @dfedoryshchevDocumentation Updates
Test Improvements
Repository Infrastructure Updates
McpServerFactoryreferences in Copilot instructions #1892 by @Zir0-93Acknowledgements
... (truncated)
Commits viewable in compare view.
Updated ModelContextProtocol.AspNetCore from 2.2.0 to 2.4.0.
Updated Quartz.Extensions.DependencyInjection from 3.22.3 to 3.22.10.
Release notes
Sourced from Quartz.Extensions.DependencyInjection's releases.
3.22.10
11 fixes for the 3.x line. There is no public API change and no schema change.
Fixed
Invalid cron expression: …, the reason the preview already gave, and leaves the page and the trigger as they were. Thanks @EnesKartal. (#4190, closes #4188)CronTriggerImplclone has a job data map of its own. It usedMemberwiseClonerather than the base clone that every other trigger type uses, so the clone shared the original'sJobDataMap.RAMJobStorestores and hands out clones, so a write to a retrieved cron trigger's map reached the stored trigger. (#4205)FailedJobOriginalTrigger*markers.IJobExecutionContext.RecoveringTriggerKeythen named the spent recovery trigger (RECOVERING_JOBS.recover_…) instead of the original trigger, and the fire-time markers named the first replay's times. Both paths now keep the markers the recovery trigger already carries. (#4205)doubleto thedecimalnearest its exact binary value. So when a driver returns theDEC_PROP_1/2columns as adouble, as SQLite's does,12.34came back as12.339999999999999857891452848. Quartz now rounds to 15 (double) or 7 (float) significant digits, as every earlier runtime did. (#4219, from #4210)NativeJobpasses its parameters to the shell on Linux. The command and its parameters were joined into oneArgumentsstring that .NET splits on whitespace, so the parameters never reached the command. (#4220, from #4212)NativeJobkills the process tree, and the job ends as cancelled rather than withError launching native command. (#4220)NativeJobreads output without foreground threads, so a child that holds its pipes open no longer keeps the host alive after shutdown. All output is still logged before the job completes, unless a process the command started holds the streams open more than 5 seconds after it exits. (#4220)NativeJobruns the system directory'scmd.exeon Windows, never one thatPATHor the working directory finds first. (#4220)<base href>sent it under the dashboard path, where onlyblazor.web.jsandopaque-redirectwere mirrored. So it failed, and the Blazor circuit never started. The dashboard now serves the whole_frameworktree under its path. Thanks to the Marten Studio maintainers for the report. (#4227, from #4224)ObjectDisposedExceptionwhen asked for the connection of a transaction its broken connector disposed. The store's disconnected-transaction check let that escape in place of the real error, from rollbacks, row-lock retries and the enlisted-transaction checks. A failed fire-batch or check-in commit now goes through its validator and retry as it does on other databases, and the cluster manager no longer logsError managing cluster: NpgsqlTransaction. Thanks @mrreddevil2412. (#4261, from #4255)Packaging
Quartz.Jobsgains anet8.0build, which .NET 8 and later now pick up instead ofnetstandard2.0. The Linux parameter fix and the process-tree kill need APIs only that build has. Thenetstandard2.0and .NET Framework builds keep their old Linux command line, and leave a cancelled job's process running as before. They do get the otherNativeJobchanges.Compatibility
On Linux with .NET 8 or later, a
NativeJobcommand that wrapped itself in quotes to work around the old whitespace split now passes those quotes to the shell. Remove the quotes, or move the arguments toparameters.The integration tests move to MySqlConnector 2.6.1, the first version fixed for GHSA-473q-m89c-ghf8 (#4198). No 3.x package references the driver.
What's Changed
Fixes
O...
Description has been truncated
Dependabot will...
Description has been truncated