Repository navigation
[release/13.5] Fix deprecated Homebrew cask DSL usage - #20119
Merged
Jose Perez Rodriguez (joperezr) merged 1 commit intoSep 14, 2026
Merged
Jose Perez Rodriguez (joperezr) merged 1 commit into
Jose Perez Rodriguez (joperezr) merged 1 commit into
Conversation
Co-authored-by: James Newton-King <james@newtonking.com> (cherry picked from commit 12847d4) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> # Conflicts: # .github/workflows/homebrew-validate-release.yml # docs/release-process.md # eng/homebrew/README.md
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20119Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20119" |
github-actions
Bot
added
the
area-engineering-systems
Contributor
Tests selector (audit mode)The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement. 2 / 100 test projects · 3 jobs, from 5 changed files. Selected test projects (2 / 100)
Selected jobs (3)
How these were chosen — grouped by what changed📄 📄 📄 📄 🧪 Job reasons
Selection computed for commit |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The implementation and regression coverage are sound; remaining feedback concerns minor inaccuracies in the validation rationale.
Review tier: Balanced
Findings: 2
Open findings (2)
What changed in this PR
Backports Homebrew 6 compatibility fixes to release/13.5 while preserving release notarization validation.
Changes:
- Migrates the cask template to current Homebrew DSL.
- Updates audit flags and adds explicit notarization verification.
- Updates release documentation and regression tests.
| File | Description |
|---|---|
eng/homebrew/aspire.rb.template |
Updates deprecated cask DSL. |
eng/homebrew/dogfood.sh |
Simplifies local URL rewriting. |
eng/homebrew/validate-cask-artifact.sh |
Revises audits and verifies notarization. |
eng/homebrew/README.md |
Documents validation modes. |
eng/pipelines/release-publish-nuget.yml |
Updates release-pipeline comments. |
docs/release-process.md |
Documents the notarization gate. |
tests/Aspire.Acquisition.Tests/Scripts/PRScriptInstallerModeTests.cs |
Covers audit and notarization behavior. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Jose Perez Rodriguez (joperezr)
merged commit Sep 14, 2026
9c1b401
into
release/13.5
345 checks passed
Jose Perez Rodriguez (joperezr)
deleted the
joperezr-homebrew-13-5-backport
branch
September 14, 2026 18:13
Contributor
|
✅ No documentation update needed. Step 5 branch taken: This PR is a backport of #19965 to Triggered signals (2, both from No documentation PR was drafted. |
This was referenced Sep 15, 2026
Closed
This was referenced Oct 14, 2026
Rene Bentes Pinto (renebentes)
pushed a commit
to renebentes/3054
that referenced
this pull request
Oct 14, 2026
…to 13.6.1 (#275) Updated [Aspire.Npgsql.EntityFrameworkCore.PostgreSQL](https://github.com/microsoft/aspire) from 13.5.3 to 13.6.1. <details> <summary>Release notes</summary> _Sourced from [Aspire.Npgsql.EntityFrameworkCore.PostgreSQL's releases](https://github.com/microsoft/aspire/releases)._ ## 13.6.1 ## What's New in Aspire 13.6.1 Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows. ### 🐛 Fixes - 📊 **Dashboard CPU usage could increase during long-running metric ingestion** — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes [#20725](microsoft/aspire#20725). ([#20747](microsoft/aspire#20747), backport of [#20736](microsoft/aspire#20736), @JamesNK) - 📈 **The Metrics tree could not be scrolled** — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes [#20728](microsoft/aspire#20728). ([#20762](microsoft/aspire#20762), backport of [#20758](microsoft/aspire#20758), @heyysiri) - 🧭 **Dashboard navigation could fail after a browser disconnect** — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. ([#20545](microsoft/aspire#20545), backport of [#20527](microsoft/aspire#20527), @JamesNK) - 🖥️ **Container exec watches could terminate shortly after AppHost startup** — A stalled DCP watch connection could produce a critical `Watch task over Kubernetes ContainerExec resources terminated unexpectedly` error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. ([#20664](microsoft/aspire#20664), backport of [#20466](microsoft/aspire#20466), @radical) - 🪟 **Session-scoped containers could remain running after stopping a .NET AppHost on Windows** — AppHosts launched through `dotnet run` or `dotnet watch` now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and `aspire stop` flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes [#20495](microsoft/aspire#20495). ([#20514](microsoft/aspire#20514), backport of [#20494](microsoft/aspire#20494), @danegsta) --- *Full Changelog: [v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)* *Full commit: [3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)* ## 13.6.0 # Aspire 13.6.0 Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages. ## Highlights - 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail. - 🖥️ **AppHost-owned terminals and database REPLs** — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in `WithRepl()` commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while `aspire terminal ps` and `aspire terminal tape play` support discovery and repeatable terminal interactions. - 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java` and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit. - 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet` integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard `appsettings.json` configuration and Deno runtime support. - ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire run` and `aspire start`, update repository-local CLI manifests with `aspire update`, create file-based C# AppHosts with `aspire init --language csharp --file-based`, and export TypeScript API data with `aspire sdk export`. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and `aspire stop --force --volumes` adds explicit cleanup of Aspire-owned volumes. - 💻 **More capable VS Code tooling** — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable. - ☁️ **New Azure options in preview** — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning. - ☸️ **More expressive, reliable deployments** — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup. - 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard. ##⚠️ Breaking changes Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from `Aspire.Hosting.Terminals` to `Aspire.Hosting.ApplicationModel`. See the full list and migration guidance in the [Aspire 13.6 breaking changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes). ## 📖 Learn more For complete details, examples, migration guidance, and everything new in this release, read [What's new in Aspire 13.6](https://aspire.dev/whats-new/aspire-13-6/). Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜 --- _Full Changelog: [v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_ _Full commit: [56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_ ## 13.5.4 ## What's New in Aspire 13.5.4 Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates. ### 🐛 Fixes - 📨 **Kafka health checks leaked producers and polling threads** — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes [#20091](microsoft/aspire#20091). ([#20094](microsoft/aspire#20094), backport of [#20092](microsoft/aspire#20092), @davidfowl) - 🌐 **DevTunnels could fail when the region was selected automatically** — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes [#18790](microsoft/aspire#18790). ([#19853](microsoft/aspire#19853), backport of [#19230](microsoft/aspire#19230), @Vladipz) - ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The dashboard now hides the `azure-environment` resource when no Azure resources require cloud provisioning, instead of leaving it visible in **Not started**. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes [#19617](microsoft/aspire#19617). ([#19998](microsoft/aspire#19998), backport of [#19843](microsoft/aspire#19843), @eerhardt) - 🧩 **Starter app generation could alter unrelated JavaScript values** — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to `localhost:` URLs, preserving the original library files while still configuring the requested ports. Fixes [#20030](microsoft/aspire#20030). ([#20110](microsoft/aspire#20110), backport of [#20031](microsoft/aspire#20031), @bart-vmware, @JamesNK) - 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. ([#20119](microsoft/aspire#20119), backport of [#19965](microsoft/aspire#19965), @askpt, @joperezr) - 🧪 **Radius cloud-provider callback interfaces now carry the experimental diagnostic** — `IAwsRadiusProviderBuilder` and `IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`, matching the existing `WithAwsProvider` and `WithAzureProvider` methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. ([#19874](microsoft/aspire#19874), @sebastienros) --- *Full Changelog: [v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)* *Full commit: [9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)* Commits viewable in [compare view](microsoft/aspire@v13.5.3...v13.6.1). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Rene Bentes Pinto (renebentes)
pushed a commit
to renebentes/3054
that referenced
this pull request
Oct 14, 2026
Updated [Aspire.Hosting.Testing](https://github.com/microsoft/aspire) from 13.5.3 to 13.6.1. <details> <summary>Release notes</summary> _Sourced from [Aspire.Hosting.Testing's releases](https://github.com/microsoft/aspire/releases)._ ## 13.6.1 ## What's New in Aspire 13.6.1 Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows. ### 🐛 Fixes - 📊 **Dashboard CPU usage could increase during long-running metric ingestion** — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes [#20725](microsoft/aspire#20725). ([#20747](microsoft/aspire#20747), backport of [#20736](microsoft/aspire#20736), @JamesNK) - 📈 **The Metrics tree could not be scrolled** — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes [#20728](microsoft/aspire#20728). ([#20762](microsoft/aspire#20762), backport of [#20758](microsoft/aspire#20758), @heyysiri) - 🧭 **Dashboard navigation could fail after a browser disconnect** — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. ([#20545](microsoft/aspire#20545), backport of [#20527](microsoft/aspire#20527), @JamesNK) - 🖥️ **Container exec watches could terminate shortly after AppHost startup** — A stalled DCP watch connection could produce a critical `Watch task over Kubernetes ContainerExec resources terminated unexpectedly` error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. ([#20664](microsoft/aspire#20664), backport of [#20466](microsoft/aspire#20466), @radical) - 🪟 **Session-scoped containers could remain running after stopping a .NET AppHost on Windows** — AppHosts launched through `dotnet run` or `dotnet watch` now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and `aspire stop` flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes [#20495](microsoft/aspire#20495). ([#20514](microsoft/aspire#20514), backport of [#20494](microsoft/aspire#20494), @danegsta) --- *Full Changelog: [v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)* *Full commit: [3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)* ## 13.6.0 # Aspire 13.6.0 Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages. ## Highlights - 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail. - 🖥️ **AppHost-owned terminals and database REPLs** — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in `WithRepl()` commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while `aspire terminal ps` and `aspire terminal tape play` support discovery and repeatable terminal interactions. - 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java` and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit. - 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet` integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard `appsettings.json` configuration and Deno runtime support. - ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire run` and `aspire start`, update repository-local CLI manifests with `aspire update`, create file-based C# AppHosts with `aspire init --language csharp --file-based`, and export TypeScript API data with `aspire sdk export`. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and `aspire stop --force --volumes` adds explicit cleanup of Aspire-owned volumes. - 💻 **More capable VS Code tooling** — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable. - ☁️ **New Azure options in preview** — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning. - ☸️ **More expressive, reliable deployments** — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup. - 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard. ##⚠️ Breaking changes Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from `Aspire.Hosting.Terminals` to `Aspire.Hosting.ApplicationModel`. See the full list and migration guidance in the [Aspire 13.6 breaking changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes). ## 📖 Learn more For complete details, examples, migration guidance, and everything new in this release, read [What's new in Aspire 13.6](https://aspire.dev/whats-new/aspire-13-6/). Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜 --- _Full Changelog: [v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_ _Full commit: [56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_ ## 13.5.4 ## What's New in Aspire 13.5.4 Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates. ### 🐛 Fixes - 📨 **Kafka health checks leaked producers and polling threads** — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes [#20091](microsoft/aspire#20091). ([#20094](microsoft/aspire#20094), backport of [#20092](microsoft/aspire#20092), @davidfowl) - 🌐 **DevTunnels could fail when the region was selected automatically** — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes [#18790](microsoft/aspire#18790). ([#19853](microsoft/aspire#19853), backport of [#19230](microsoft/aspire#19230), @Vladipz) - ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The dashboard now hides the `azure-environment` resource when no Azure resources require cloud provisioning, instead of leaving it visible in **Not started**. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes [#19617](microsoft/aspire#19617). ([#19998](microsoft/aspire#19998), backport of [#19843](microsoft/aspire#19843), @eerhardt) - 🧩 **Starter app generation could alter unrelated JavaScript values** — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to `localhost:` URLs, preserving the original library files while still configuring the requested ports. Fixes [#20030](microsoft/aspire#20030). ([#20110](microsoft/aspire#20110), backport of [#20031](microsoft/aspire#20031), @bart-vmware, @JamesNK) - 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. ([#20119](microsoft/aspire#20119), backport of [#19965](microsoft/aspire#19965), @askpt, @joperezr) - 🧪 **Radius cloud-provider callback interfaces now carry the experimental diagnostic** — `IAwsRadiusProviderBuilder` and `IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`, matching the existing `WithAwsProvider` and `WithAzureProvider` methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. ([#19874](microsoft/aspire#19874), @sebastienros) --- *Full Changelog: [v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)* *Full commit: [9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)* Commits viewable in [compare view](microsoft/aspire@v13.5.3...v13.6.1). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 14, 2026
github-actions Bot
pushed a commit
to BenjaminMichaelis/DotnetTemplates
that referenced
this pull request
Oct 14, 2026
Updated [aspire.cli](https://github.com/microsoft/aspire) from 13.4.2 to 13.6.1. <details> <summary>Release notes</summary> _Sourced from [aspire.cli's releases](https://github.com/microsoft/aspire/releases)._ ## 13.6.1 ## What's New in Aspire 13.6.1 Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows. ### 🐛 Fixes - 📊 **Dashboard CPU usage could increase during long-running metric ingestion** — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes [#20725](microsoft/aspire#20725). ([#20747](microsoft/aspire#20747), backport of [#20736](microsoft/aspire#20736), @JamesNK) - 📈 **The Metrics tree could not be scrolled** — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes [#20728](microsoft/aspire#20728). ([#20762](microsoft/aspire#20762), backport of [#20758](microsoft/aspire#20758), @heyysiri) - 🧭 **Dashboard navigation could fail after a browser disconnect** — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. ([#20545](microsoft/aspire#20545), backport of [#20527](microsoft/aspire#20527), @JamesNK) - 🖥️ **Container exec watches could terminate shortly after AppHost startup** — A stalled DCP watch connection could produce a critical `Watch task over Kubernetes ContainerExec resources terminated unexpectedly` error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. ([#20664](microsoft/aspire#20664), backport of [#20466](microsoft/aspire#20466), @radical) - 🪟 **Session-scoped containers could remain running after stopping a .NET AppHost on Windows** — AppHosts launched through `dotnet run` or `dotnet watch` now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and `aspire stop` flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes [#20495](microsoft/aspire#20495). ([#20514](microsoft/aspire#20514), backport of [#20494](microsoft/aspire#20494), @danegsta) --- *Full Changelog: [v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)* *Full commit: [3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)* ## 13.6.0 # Aspire 13.6.0 Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages. ## Highlights - 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail. - 🖥️ **AppHost-owned terminals and database REPLs** — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in `WithRepl()` commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while `aspire terminal ps` and `aspire terminal tape play` support discovery and repeatable terminal interactions. - 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java` and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit. - 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet` integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard `appsettings.json` configuration and Deno runtime support. - ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire run` and `aspire start`, update repository-local CLI manifests with `aspire update`, create file-based C# AppHosts with `aspire init --language csharp --file-based`, and export TypeScript API data with `aspire sdk export`. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and `aspire stop --force --volumes` adds explicit cleanup of Aspire-owned volumes. - 💻 **More capable VS Code tooling** — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable. - ☁️ **New Azure options in preview** — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning. - ☸️ **More expressive, reliable deployments** — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup. - 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard. ##⚠️ Breaking changes Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from `Aspire.Hosting.Terminals` to `Aspire.Hosting.ApplicationModel`. See the full list and migration guidance in the [Aspire 13.6 breaking changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes). ## 📖 Learn more For complete details, examples, migration guidance, and everything new in this release, read [What's new in Aspire 13.6](https://aspire.dev/whats-new/aspire-13-6/). Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜 --- _Full Changelog: [v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_ _Full commit: [56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_ ## 13.5.4 ## What's New in Aspire 13.5.4 Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates. ### 🐛 Fixes - 📨 **Kafka health checks leaked producers and polling threads** — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes [#20091](microsoft/aspire#20091). ([#20094](microsoft/aspire#20094), backport of [#20092](microsoft/aspire#20092), @davidfowl) - 🌐 **DevTunnels could fail when the region was selected automatically** — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes [#18790](microsoft/aspire#18790). ([#19853](microsoft/aspire#19853), backport of [#19230](microsoft/aspire#19230), @Vladipz) - ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The dashboard now hides the `azure-environment` resource when no Azure resources require cloud provisioning, instead of leaving it visible in **Not started**. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes [#19617](microsoft/aspire#19617). ([#19998](microsoft/aspire#19998), backport of [#19843](microsoft/aspire#19843), @eerhardt) - 🧩 **Starter app generation could alter unrelated JavaScript values** — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to `localhost:` URLs, preserving the original library files while still configuring the requested ports. Fixes [#20030](microsoft/aspire#20030). ([#20110](microsoft/aspire#20110), backport of [#20031](microsoft/aspire#20031), @bart-vmware, @JamesNK) - 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. ([#20119](microsoft/aspire#20119), backport of [#19965](microsoft/aspire#19965), @askpt, @joperezr) - 🧪 **Radius cloud-provider callback interfaces now carry the experimental diagnostic** — `IAwsRadiusProviderBuilder` and `IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`, matching the existing `WithAwsProvider` and `WithAzureProvider` methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. ([#19874](microsoft/aspire#19874), @sebastienros) --- *Full Changelog: [v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)* *Full commit: [9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)* ## 13.5.3 ## What's New in Aspire 13.5.3 Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources. ### 🐛 Fixes - 📊 **Dashboard Graph view could crash for Azure Blob resources** — Resources such as those created with `AddBlobs` use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes [#19489](microsoft/aspire#19489). ([#19585](microsoft/aspire#19585), backport of [#19579](microsoft/aspire#19579), `@sebastienros`) - 🌐 **DevTunnel public URLs were missing from the Dashboard and MCP snapshots** — DevTunnel port resources could report `Running` and `Healthy` while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes [#19496](microsoft/aspire#19496). ([#19625](microsoft/aspire#19625), backport of [#19590](microsoft/aspire#19590), `@karolz-ms`, `@danegsta`) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.5.3 --- *Full Changelog: [v13.5.2...v13.5.3](microsoft/aspire@v13.5.2...v13.5.3)* *Full commit: [b5f143315ffb6968ea939a9978797a5b20e4c688](microsoft/aspire@b5f143315ffb6968ea939a9978797a5b20e4c688)* ## 13.5.2 ## What's New in Aspire 13.5.2 Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet. ### 🐛 Fixes - 🪟 **Windows CLI archives shipped an unused ~4.9 MB `hex1bpty.exe`** — The Windows CLI archives (`aspire-cli-win-{x64,arm64}-*.zip`) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([[#19557](https://github.com/microsoft/aspire/pull/19557)](https://github.com/microsoft/aspire/pull/19557), backport of #19554, `@mitchdenny`) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.5.2 *Full Changelog: [[v13.5.1...v13.5.2](https://github.com/microsoft/aspire/compare/v13.5.1...v13.5.2)](https://github.com/microsoft/aspire/compare/v13.5.1...v13.5.2)* *Full commit: [[a22cec24d76e764b3681977e314ab4a0aeed0240](https://github.com/microsoft/aspire/commit/a22cec24d76e764b3681977e314ab4a0aeed0240)](https://github.com/microsoft/aspire/commit/a22cec24d76e764b3681977e314ab4a0aeed0240)* ## 13.5.1 ## What's New in Aspire 13.5.1 Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping. ### 🐛 Fixes - 🍎 **Polyglot AppHosts could crash on startup on macOS** — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([[#19528](https://github.com/microsoft/aspire/pull/19528)](https://github.com/microsoft/aspire/pull/19528)) - 🔗 **Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with `MissingMethodException`** — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called `Aspire.TypeSystem` members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #19365. Fixes #19503. ([[#19524](https://github.com/microsoft/aspire/pull/19524)](https://github.com/microsoft/aspire/pull/19524), backport of #19506, `@adamint`) ### 🏷️ Housekeeping - 📦 Updated DCP (Developer Control Plane) to 0.25.13 ([[#19528](https://github.com/microsoft/aspire/pull/19528)](https://github.com/microsoft/aspire/pull/19528)) - 🔧 Restored WinGet publication using .NET 9 `wingetcreate` ([[#19509](https://github.com/microsoft/aspire/pull/19509)](https://github.com/microsoft/aspire/pull/19509)) - 🧹 Removed the pipeline-scoped `Publish-Build-Assets` group from the release pipeline ([[#19523](https://github.com/microsoft/aspire/pull/19523)](https://github.com/microsoft/aspire/pull/19523), [[#19163](https://github.com/microsoft/aspire/pull/19163)](https://github.com/microsoft/aspire/pull/19163)) - 🚀 Bumped branding to 13.5.1 ([[#19531](https://github.com/microsoft/aspire/pull/19531)](https://github.com/microsoft/aspire/pull/19531)) *Full Changelog: [[v13.5.0...v13.5.1](https://github.com/microsoft/aspire/compare/v13.5.0...v13.5.1)](https://github.com/microsoft/aspire/compare/v13.5.0...v13.5.1)* *Full commit: [[69db530a4816698cf1d5fa4557933e0ac4f127c6](https://github.com/microsoft/aspire/commit/69db530a4816698cf1d5fa4557933e0ac4f127c6)](https://github.com/microsoft/aspire/commit/69db530a4816698cf1d5fa4557933e0ac4f127c6)* ## 13.5.0 # Aspire 13.5.0 Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements. ## Highlights - 💬 **Richer AppHost interactions** — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options. - 🖥️ **Interactive terminal sessions** — The experimental `WithTerminal()` API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in `aspire terminal` CLI command for attaching from your shell. - 🌐 **TypeScript AppHost is generally available** — Polyglot AppHosts no longer require the `ASPIREATS001` experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#. - 🛠️ **CLI installation and reliability** — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while `aspire stop --force`, `aspire update --migrate`, `aspire doctor`, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows. - 🎨 **Refreshed dashboard** — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active. - 💻 **Rebranded VS Code extension** — The extension is now named **Aspire** and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery. - ☸️ **More expressive deployments** — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory. - ☁️ **Expanded hosting integrations** — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new `Aspire.Hosting.Dotnet` package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities. ##⚠️ Breaking changes Notable changes include hosting context `ServiceProvider` properties being renamed to `Services`, `PublishAsConnectionString` becoming obsolete in favor of `AddConnectionString`, removal of `aspire ps --resources` and `--include-hidden` in favor of `aspire describe`, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension. See the full list and migration guidance in the [Aspire 13.5 breaking changes](https://aspire.dev/whats-new/aspire-13-5/#breaking-changes). ## 📖 Learn more For complete details, examples, migration guidance, and everything new in this release, read [What's new in Aspire 13.5](https://aspire.dev/whats-new/aspire-13-5/). Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜 --- _Full Changelog: [v13.4.6...v13.5.0](microsoft/aspire@v13.4.6...v13.5.0)_ _Full commit: [e076d8e427cb3afb528dbd605acd74c3aea69f94](microsoft/aspire@e076d8e427cb3afb528dbd605acd74c3aea69f94)_ ## 13.4.6 ## What's New in Aspire 13.4.6 Patch release for Aspire 13.4 fixing polyglot AppHost code generation binding when CLI and SDK versions diverge, resource service port collision in `--isolated` mode, and a MongoDB.Driver dependency update. ### 🐛 Fixes - 🔗 **Polyglot AppHost code generation silently failed when CLI and SDK versions diverged** — `Aspire.TypeSystem` used a floating strong-name `AssemblyVersion` that changed with every build. When the installed Aspire CLI was built at a different version than the AppHost's SDK, the CLR couldn't satisfy the strong-name bind and every code generator (TypeScript, Python, Java, Go, Rust) was silently dropped, surfacing as `No code generator found for language: <lang>`. The `AssemblyVersion` is now frozen at a stable constant so any compatible CLI/SDK pair on 13.4 binds successfully. Relates to #18110 and #17910. ([#18160](microsoft/aspire#18160), `@sebastienros`) - 🔌 **Multiple AppHosts started with `--isolated` collided on the resource service port** — Both instances tried to bind to the same fixed port from `ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL`, causing an "address already in use" error on the second instance. `DashboardServiceHost` now binds to port 0 on loopback when `RandomizePorts` is true (set by `--isolated`), letting the OS assign a unique port per instance. ([#18341](microsoft/aspire#18341), `@JamesNK`) - 🍃 **MongoDB.Driver updated to 3.9.0** — Removes a wrongly pinned `SharpCompress` transitive dependency and uses the corrected `Snappier` transitive. Fixes #17981. ([#18279](microsoft/aspire#18279), `@Falco20019`) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.4.6 ([#18343](microsoft/aspire#18343)) --- _Full Changelog: [v13.4.5...v13.4.6](microsoft/aspire@v13.4.5...v13.4.6)_ _Full commit: [87fe259e4fc244c599019a7b1304c85a1488f248](microsoft/aspire@87fe259e4fc244c599019a7b1304c85a1488f248)_ > Generated by [Generate release notes for a new stable Aspire release](https://github.com/microsoft/aspire/actions/runs/27855270514) · 131 AIC · ⌖ 13.5 AIC · ⊞ 37.4K <!-- gh-aw-agentic-workflow: Generate release notes for a new stable Aspire release, engine: copilot, version: 1.0.60, model: claude-sonnet-4.6, id: 27855270514, workflow_id: release-notes-generate, run: https://github.com/microsoft/aspire/actions/runs/27855270514 --> ## 13.4.5 ## What's New in Aspire 13.4.5 Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry. ### 🐛 Fixes - 🛡️ **Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory** — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use `MessagePackFormatter` or LZ4 — all StreamJsonRpc calls use `SystemTextJsonFormatter` over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the `Aspire.Hosting` package. ([#18204](microsoft/aspire#18204), `@mitchdenny`) - 🎭 **`playwrightCliVersion` values that are not valid SemVer 2.0 now fail fast with a clear diagnostic** — Previously an invalid override (range expression, dist-tag like `latest`, or a `v`-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. ([#18205](microsoft/aspire#18205), `@mitchdenny`) - 🤖 **CLI telemetry now detects and reports the calling coding agent** — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as `copilot-cli`. ([#18240](microsoft/aspire#18240), `@damianedwards`) ### 🏷️ Housekeeping - 📄 Refreshed the `@microsoft/aspire-cli` npm package README to be TypeScript-only — updated examples to the current `ts-starter` template (`apphost.mts` / `aspire.mjs`), added a backing-services snippet showing `aspire add` for PostgreSQL and Redis, and documented `aspire dashboard run` as a standalone dashboard option. ([#18221](microsoft/aspire#18221), `@adamint`) --- _Full Changelog: [v13.4.4...v13.4.5](microsoft/aspire@v13.4.4...v13.4.5)_ _Full commit: [73114e86c64aeb9f3f3c7da8e37df1ae4281b27e](microsoft/aspire@73114e86c64aeb9f3f3c7da8e37df1ae4281b27e)_ > Generated by [Generate release notes for a new stable Aspire release](https://github.com/microsoft/aspire/actions/runs/27667814104/agentic_workflow) · ● 4.4M <!-- gh-aw-agentic-workflow: Generate release notes for a new stable Aspire release, engine: copilot, version: 1.0.40, model: claude-sonnet-4.6, id: 27667814104, workflow_id: release-notes-generate, run: https://github.com/microsoft/aspire/actions/runs/27667814104 --> ## 13.4.4 ## What's New in Aspire 13.4.4 Patch release for Aspire 13.4 with improved DCP connection reliability during request execution and consistent `ExcludeFromMcp()` filtering across all CLI MCP tools. ### 🐛 Fixes * 🔌 **DCP requests could fail permanently when the connection dropped mid-request** — If the underlying DCP channel closed while a request was in flight, the error was surfaced directly instead of being retried. Reconnection is now attempted as part of the DCP request retry path so transient disconnections recover automatically without surfacing errors. ([#18096](microsoft/aspire#18096), `@karolz-ms`) * 🔍 **Resources marked with `ExcludeFromMcp()` were not consistently filtered from CLI MCP tools** — Resources with the `resource.excludeFromMcp` property were not excluded uniformly from all CLI MCP tool results. `list_resources`, `list_console_logs`, `execute_resource_command`, `list_structured_logs`, `list_traces`, and `list_trace_structured_logs` all now honor the exclusion, preventing excluded resources and their telemetry from appearing in agent context. ([#18150](microsoft/aspire#18150), `@JamesNK`) ### 🏷️ Housekeeping * 📦 Improved npm CLI package metadata and hardened npm publish validation in the release pipeline. ([#18093](microsoft/aspire#18093), `@adamratzman`) * * * _Full Changelog: [v13.4.3...v13.4.4](microsoft/aspire@v13.4.3...v13.4.4)_ _Full commit: [ccc566c5ab3285c9beb8f38ede34734bb477c029](microsoft/aspire@ccc566c5ab3285c9beb8f38ede34734bb477c029)_ ## 13.4.3 ## What's New in Aspire 13.4.3 Patch release for Aspire 13.4 with a fix for persistent container endpoint allocation regressions introduced in 13.4. ### 🐛 Fixes - 🔌 **Persistent container endpoints had incorrect default behavior** — Persistent containers were defaulting to proxyless endpoint behavior instead of the proxied behavior used by normal containers. This caused integrations that depend on endpoint allocation before resource startup (such as the KeyVault emulator) to fail. Persistent containers now default to proxied endpoints matching normal container behavior; opt out with `isProxied: false` or `WithEndpointProxySupport(false)`. Proxyless container endpoints with only a `targetPort` specified now also resolve immediately to that port instead of waiting for delayed allocation. (#17960, `@danegsta`) ### 🏷️ Housekeeping - 🛠️ Unblocked WinGet manifest publishing on locked-down 1ES agents and updated manifest tags (#17958) --- *Full Changelog: microsoft/aspire@v13.4.2...v13.4.3* *Full commit: [4f218933552e18ff2874d1b6d5dc3fe671e3b6d9](microsoft/aspire@4f218933552e18ff2874d1b6d5dc3fe671e3b6d9)* > Generated by [Generate release notes for a new stable Aspire release](https://github.com/microsoft/aspire/actions/runs/27173824611/agentic_workflow) · ● 4.7M <!-- gh-aw-agentic-workflow: Generate release notes for a new stable Aspire release, engine: copilot, version: 1.0.40, model: claude-sonnet-4.6, id: 27173824611, workflow_id: release-notes-generate, run: https://github.com/microsoft/aspire/actions/runs/27173824611 --> Commits viewable in [compare view](microsoft/aspire@v13.4.2...v13.6.1). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of #19965 to
release/13.5, cherry-picked from12847d472bd65282485fd102d449077e0bd66ff3.Homebrew 6.x rejects the deprecated
verified:cask URL parameter, blocking Homebrew validation on release-branch builds (including #20094 and #20110). This preserves the complete source fix: removeverified:, migratepostflight/File.writetopostflight_steps/write_file, simplify dogfood URL rewriting, and remove obsoletebrew audit --signing/--no-signingarguments.Conflict resolutions
.github/workflows/homebrew-validate-release.yml; retain release/13.5's Azure DevOpsHomebrewValidateJoband update both relevant pipeline comments.docs/release-process.mdandeng/homebrew/README.mdusing the release branch's existing orchestration, documenting the updated audit and explicit notarization gate without importing main's release-process migration.HomebrewValidateJobcomment.Security considerations
Preserves release-binary signature/notarization validation explicitly with
codesign --verify -R=notarized --check-notarizationon the installed Caskroom binary. Homebrew no longer runs its signing audit automatically for our temporary third-party tap. A failed notarization check remains fatal and invokes the existing uninstall/cleanup path. Regression coverage for invocation and failure cleanup is included; actual macOS verification was not run on this Windows host.Fixes # (issue)
Customer Impact
Unblocks Homebrew cask preparation/validation for release/13.5 with current Homebrew, while preserving install-channel metadata and the release notarization gate. No public API changes.
Testing
bd4a8e2efccc86a00ba9ff0df890a326f0318146.PRScriptInstallerModeTests: 11 Windows-compatible tests passed, 0 failed.bash -npassed fordogfood.sh,validate-cask-artifact.sh, andprepare-cask-artifact.sh.git diff --checkpassed.Risk
Low: scoped to Homebrew packaging/validation, related tests, and documentation. Existing release orchestration and cleanup behavior are retained. Real Homebrew/macOS execution remains the principal validation gap.
Regression?
Compatibility regression with current Homebrew: release PR #19998 passed September 9, while #20094 and #20110 failed September 13–14 on the deprecated
verifiedparameter. No specific Aspire-introduced regression has been identified.Checklist
<remarks />and<code />elements on your triple slash comments?