[Jose Perez Rodriguez (joperezr)]

Description

Refresh the .NET dependencies and bundled runtimes for Aspire 13.6.5 to pick up servicing fixes, including fixes relevant to Native AOT process startup failures.

• Update .NET 10, 9, and 8 servicing package versions to 10.0.14, 9.0.22, and 8.0.33, respectively. Keep .NET 8 libraries that do not publish on the shared-framework servicing cadence at their latest published 8.x versions.
• Update both repository SDK pins to 11.0.100-rc.3.26522.148 and the .NET 11 package versions to 11.0.0-rc.3.26522.148.
• Refresh the test runtimes and corresponding .NET 8/9/10 SDK versions, and update explicit package pins in tools and playground projects.
• Set PatchVersion to 5, producing Aspire 13.6.5.

Two directly related compatibility adjustments are included:

• Update Microsoft.Azure.Cosmos to 3.63.1, required by the serviced EF Core Cosmos assemblies; retaining 3.63.0 causes CS1705.
• Align the dashboard's unknown-culture test with ASP.NET Core RC3's predefined-culture-only parent fallback, and add coverage that valid en-US still falls back to supported en. The existing test passes on RC1 but not RC3 because the framework now uses CultureInfo.GetCultureInfo(..., predefinedOnly: true).

Fixes # (issue)

Validation

Verified that the new SDK selects runtime packs 8.0.33 / 9.0.22 / 10.0.14 and the .NET 11 RC3 packs. Restored CLI assets select Microsoft.DotNet.ILCompiler/10.0.14, and dashboard assets select 11.0.0-rc.3.26522.148. The successfully published self-contained managed host's runtime manifest includes Microsoft.NETCore.App 10.0.14 and Microsoft.AspNetCore.App 10.0.14.

Passed:

Command	Result
.\restore.cmd /p:SkipNativeBuild=true /p:SkipPlaygroundProjects=true /p:SkipTestProjects=true	Passed; existing unrelated dependency-audit warnings.
dotnet publish src\Aspire.Managed\Aspire.Managed.csproj -c Release -r win-x64 --self-contained --nologo -v minimal	Passed; bundles 10.0.14.
dotnet build src\Components\Aspire.Microsoft.EntityFrameworkCore.Cosmos\Aspire.Microsoft.EntityFrameworkCore.Cosmos.csproj --nologo -v minimal	Passed for net8.0, net9.0, and net10.0 after the Cosmos update.
dotnet build src\Aspire.Dashboard\Aspire.Dashboard.csproj --nologo -v minimal	Passed with RC3.
dotnet build playground\AzureKusto\AzureKusto.Worker\AzureKusto.Worker.csproj --nologo -v minimal	Passed.
dotnet build playground\BlazorHosted\BlazorHosted.Client\BlazorHosted.Client.csproj --nologo -v minimal	Passed.
dotnet build playground\BlazorStandalone\BlazorStandalone\BlazorStandalone.csproj --nologo -v minimal	Passed.
dotnet build tools\CreateFailingTestIssue\CreateFailingTestIssue.csproj --nologo -v minimal	Passed.

Tests were run with $project = Join-Path $PWD '<project path>' followed by:

dotnet test --project $project --no-launch-profile -- --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true'

Project path	Result
tests\ConfigurationSchemaGenerator.Tests\ConfigurationSchemaGenerator.Tests.csproj	Passed: 396 tests across net8.0/net9.0/net10.0.
tests\Aspire.Managed.Tests\Aspire.Managed.Tests.csproj	Passed: 6 tests, 1 Unix-only skip.
tests\Aspire.Cli.Tests\Aspire.Cli.Tests.csproj	Initial full run: 5,974 passed, 4 failed, 88 skipped. The four failures were caused by discovery reaching ambient user configuration; all four passed when rerun with isolated temp workspaces. A full isolated-temp rerun encountered separate path-length/casing and timeout failures; this is not a clean full-suite result.
tests\Aspire.Dashboard.Tests\Aspire.Dashboard.Tests.csproj	Initial full run: 1,934 passed and the unknown-culture case failed. Confirmed the behavior difference against RC1 and RC3; the expectation and new valid-parent-fallback test are included here. The post-adjustment full rerun was interrupted, so final coverage is left to PR CI.

Remaining validation is delegated to PR CI rather than extending local validation:

• dotnet publish src\Aspire.Cli\Aspire.Cli.csproj -c Release -r win-x64 --nologo -v minimal was blocked by the missing Visual Studio C++ linker.
• .\build.cmd -build /p:SkipNativeBuild=true /p:SkipPlaygroundProjects=true /p:SkipTestProjects=true /p:SkipBundleDeps=true exposed the corrected Cosmos mismatch and was also blocked by missing Windows SDK makecat.exe for template catalogs.
• dotnet restore playground\AspireWithMaui\AspireWithMaui.MauiClient\AspireWithMaui.MauiClient.csproj --nologo -v minimal was blocked by the missing maui-android workload.
• The original macOS signal/startup scenario has not been reproduced locally.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21348

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21348"

[Copilot]

🔵 Needs a closer look

The shipped SDK/runtime refresh still needs final CI confirmation, including Native AOT publishing and clean CLI/dashboard results, while the targeted macOS startup scenario remains unverified.

No open issues 🎉

What changed in this PR

Prepares Aspire 13.6.5 with serviced .NET dependencies and bundled runtimes, including updates intended to address Native AOT startup failures.

Changes:

• Updates .NET 8/9/10 servicing versions, .NET 11 RC3 SDK/package pins, and the Aspire patch version.
• Refreshes tool and playground dependencies, including the Cosmos compatibility update.
• Adjusts dashboard culture tests for RC3 behavior and adds valid parent-culture fallback coverage.

File	Description
tools/​CreateFailingTestIssue/​Directory.Packages.props	Updates System.IO.Hashing to 10.0.14.
tests/​ConfigurationSchemaGenerator.Tests/​ConfigurationSchemaGenerator.Tests.csproj	Uses the shared System.Text.Json version.
tests/​Aspire.Dashboard.Tests/​GlobalizationHelpersTests.cs	Updates unknown-culture expectations and tests supported-parent fallback.
src/​Tools/​ConfigurationSchemaGenerator/​ConfigurationSchemaGenerator.csproj	Uses the shared System.Text.Json version.
playground/​BlazorStandalone/​Directory.Packages.props	Updates WebAssembly packages to 10.0.14.
playground/​BlazorStandalone/​BlazorStandalone/​BlazorStandalone.csproj	Uses the shared environment-configuration package version.
playground/​BlazorHosted/​Directory.Packages.props	Updates WebAssembly packages to 10.0.14.
playground/​BlazorHosted/​BlazorHosted.Client/​BlazorHosted.Client.csproj	Uses the shared environment-configuration package version.
playground/​AzureKusto/​AzureKusto.Worker/​AzureKusto.Worker.csproj	Uses the shared .NET 9 System.Text.Json version.
playground/​AspireWithMaui/​AspireWithMaui.MauiClient/​AspireWithMaui.MauiClient.csproj	Updates explicit .NET package pins to 10.0.14.
global.json	Updates both repository SDK pins to .NET 11 RC3.
eng/​Versions.props	Sets Aspire 13.6.5 and refreshes package, runtime, and test SDK versions.
Directory.Packages.props	Updates Cosmos, SQLite, and hashing dependencies.

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

🔵 Needs a closer look

Native CLI publishing, macOS startup verification, and final dashboard regression results remain unconfirmed for this release-wide SDK/runtime update.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching 'Directory.Packages.props' selects ALL

---

Selection computed for commit 19b3a45.

[Copilot]

🔵 Needs a closer look

The Native AOT toolchain and runtime changes still lack confirmed cross-platform publish/startup validation, including the original macOS startup/signal scenario.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Maddy Montaquila (maddymontaquila)]

PR Testing Report

PR Information

• PR: microsoft/aspire#21348
• Title: [release/13.6] Update .NET servicing dependencies for Aspire 13.6.5
• Head tested: 19b3a4509eb123287562cd36cbfaf3fe9eb5a3ed
• Tested at: 2026-10-28T10:33:27Z
• Environment: macOS ARM64, local isolated PR installation.
• Live PR head matched the clean source checkout before and after testing. No tracked files were changed.

Artifact Version Verification

• Installed CLI: 13.6.5-pr.21348.g19b3a450, matching the PR head.
• Artifact-producing workflow: 40614319186, attempt 3, successful, matching the same head.
• Source-built CLI: 13.6.5, built directly from the verified checkout.
• SDK: 11.0.100-rc.3.26522.148.
• Installed .NET and ASP.NET Core runtimes: 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.26522.148.
• The downloaded single-file managed host's embedded dependency manifest contains runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/10.0.14 and runtimepack.Microsoft.AspNetCore.App.Runtime.osx-arm64/10.0.14.
• Resolved CLI ILCompiler: 10.0.14; dashboard ILCompiler: 11.0.0-rc.3.26522.148.

Status: Verified.

Changes Analyzed

All 17 changed files were inspected using local per-file diffs against merge base c89352703f78ae46de90fbf751ed8b52b77b89bf:

• Directory.Packages.props and eng/Versions.props: servicing packages, Cosmos compatibility, test SDK/runtime versions, and 13.6.5 version.
• global.json: RC3 SDK pins.
• src/Aspire.Cli/Aspire.Cli.csproj and src/Aspire.Dashboard/Aspire.Dashboard.csproj: Native AOT XML documentation publishing workaround.
• src/Tools/ConfigurationSchemaGenerator/ConfigurationSchemaGenerator.csproj and its test project: serviced System.Text.Json pin.
• MAUI, AzureKusto, BlazorHosted, and BlazorStandalone playground project/package files, and tools/CreateFailingTestIssue/Directory.Packages.props: explicit package pins.
• Dashboard test context/globalization tests and dotnet-tool functional test: RC3 and package-cache compatibility.

Categories: CLI/dashboard native publishing, shared dependencies/build configuration, playground/tool dependencies, and test compatibility. No hosting implementation, template source, client implementation, or VS Code extension changes.

Commands and Results

Commands below use these exact paths:

repo=/Users/maddy/source/copilot-worktrees/aspire/joperezr-dotnet-servicing-update-fb1
evidence=/Users/maddy/.copilot/session-state/9fb7abc8-e845-43c3-9006-a1bd7943029f/files/pr-21348-testing
testDir=/tmp/aspire-pr21348.XdDM2q
cli="$testDir/dogfood/pr-21348/bin/aspire"
hive="$testDir/hives/pr-21348/packages"
app=/private/tmp/aspire-pr21348.XdDM2q/CanonicalSmoke/CanonicalSmoke.AppHost/CanonicalSmoke.AppHost.csproj
export DOTNET_ROOT="$repo/.dotnet" PATH="$repo/.dotnet:$PATH" MSBUILDTERMINALLOGGER=false

1. Installation and runtime verification

./restore.sh /p:SkipNativeBuild=true /p:SkipPlaygroundProjects=true /p:SkipTestProjects=true
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21348 --install-path "$testDir" --skip-path --skip-extension
"$cli" --version
./.dotnet/dotnet --info
./.dotnet/dotnet --list-runtimes

Result: Isolated PR installation and SDK/runtime verification passed. Initial artifact acquisition timed out; an intervening retry and the broad restore were interrupted by the session interruption. The resumed installer completed successfully. The broad restore installed the SDK/runtimes and restored many projects, but has no completed whole-restore result. All final targeted build/test/publish commands performed their own restores successfully.

Evidence: install.log, install-retry.log, install-resumed.log, restore.log, pr-cli-version.log, sdk-and-native-version.log, bundle-runtimes.json.

2. Focused compatibility tests

Each command was run from the verified checkout, using absolute project paths, without --no-build.

dotnet test --project "$repo/tests/Aspire.Dashboard.Tests/Aspire.Dashboard.Tests.csproj" --no-launch-profile -- --filter-class "*.GlobalizationHelpersTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
dotnet test --project "$repo/tests/Aspire.Dashboard.Components.Tests/Aspire.Dashboard.Components.Tests.csproj" --no-launch-profile -- --filter-class "*.LogViewerTests" --filter-class "*.StructuredLogsTests" --filter-class "*.ConsoleLogsTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
dotnet test --project "$repo/tests/ConfigurationSchemaGenerator.Tests/ConfigurationSchemaGenerator.Tests.csproj" --no-launch-profile -- --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
dotnet test --project "$repo/tests/Aspire.Hosting.DotnetTool.Tests/Aspire.Hosting.DotnetTool.Tests.csproj" --no-launch-profile -- --filter-method "*.VerifyNonExistentDotnetToolResource" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"

Coverage	Result
Globalization, including unknown en-XX and valid en-US parent fallback	Passed: 19
Dashboard log virtualization/component compatibility	Passed: 62
Schema generator on net8.0/net9.0/net10.0	Passed: 396, 132 per framework
Nonexistent unique dotnet-tool package with invalid feed	Passed: 1
Total	478 passed, 0 failed, 0 skipped

Earlier attempts were invalidated by RC3 relative-project-path resolution and overlapping dashboard builds contending on rpswa.dswa.cache.json. Sequential absolute-path reruns passed. These initial harness errors are not counted as successful test executions or attributed to product regressions.

Evidence: globalization-final.log, components-final.log, schema-final.log, dotnet-tool-final.log, source-test-final-results.json.

3. Serviced-project builds

dotnet build src/Components/Aspire.Microsoft.EntityFrameworkCore.Cosmos/Aspire.Microsoft.EntityFrameworkCore.Cosmos.csproj --nologo -v minimal
dotnet build playground/AzureKusto/AzureKusto.Worker/AzureKusto.Worker.csproj --nologo -v minimal
dotnet build playground/BlazorHosted/BlazorHosted.Client/BlazorHosted.Client.csproj --nologo -v minimal
dotnet build playground/BlazorStandalone/BlazorStandalone/BlazorStandalone.csproj --nologo -v minimal
dotnet build tools/CreateFailingTestIssue/CreateFailingTestIssue.csproj --nologo -v minimal

Result: All five commands passed with zero warnings and zero errors. Cosmos built successfully for net8.0, net9.0, and net10.0, exercising the updated Cosmos dependency.

Evidence: cosmos.log, kusto.log, blazor-hosted.log, blazor-standalone.log, issue-tool.log, build-results.json.

4. Native AOT publishing and macOS startup

dotnet publish src/Aspire.Cli/Aspire.Cli.csproj -c Release -r osx-arm64 --nologo -v minimal
dotnet publish src/Aspire.Dashboard/Aspire.Dashboard.csproj -c Release -r osx-arm64 --nologo -v minimal

Result: Both publishes passed and produced ARM64 Mach-O executables, validating the RC3 XML-documentation workaround through native generation/linking. The dashboard publish emitted the documented framework-owned IL2026, Xcode command-line-tools diagnostics, and native debug-information/module-cache warnings; none failed publishing.

The downloaded PR CLI and source-published CLI each ran --version 25 consecutive times: 50 successful starts, no nonzero exits or observed startup crashes. This is a startup smoke test, not proof that every original intermittent signal failure is fixed.

An active "$cli" logs apiservice --follow --non-interactive --apphost "$app" stream received SIGINT after producing output and exited within the deadline with exit code 0.

Evidence: aot-cli.log, aot-dashboard.log, aot-dashboard-result.json, native-startup.json, dogfood-startup.json, sigint-result.json, sigint-logs.log.

5. Fresh PR-template application and dashboard

"$cli" new aspire-starter --name CanonicalSmoke --output /private/tmp/aspire-pr21348.XdDM2q/CanonicalSmoke --source /private/tmp/aspire-pr21348.XdDM2q/hives/pr-21348/packages --version 13.6.5-pr.21348.g19b3a450 --test-framework None --use-redis-cache false --localhost-tld false --suppress-agent-init --non-interactive
"$cli" start --non-interactive --isolated --apphost "$app" --format Json
"$cli" wait webfrontend --status healthy --timeout 120 --non-interactive --apphost "$app"
"$cli" wait apiservice --status healthy --timeout 120 --non-interactive --apphost "$app"
"$cli" describe --format Json --non-interactive --apphost "$app"
"$cli" resource apiservice restart --non-interactive --apphost "$app"
"$cli" wait apiservice --status healthy --timeout 120 --non-interactive --apphost "$app"
"$cli" stop --non-interactive --apphost "$app"
"$cli" ps --format Json --non-interactive

Result: Passed using the canonical /private/tmp path. Both project resources were Running/Healthy. In isolated Edge Beta, the authenticated PR dashboard displayed both resources without console errors. The frontend weather page displayed five records fetched from the API. API restart recovered to Healthy. Exact-AppHost stop succeeded, and the test AppHost was absent afterward; unrelated running applications were left untouched.

Negative case:

"$cli" start --non-interactive --apphost /private/tmp/aspire-pr21348.XdDM2q/missing.csproj

Result: Expected safe failure: exit code 7, "The --apphost option specified a project that does not exist."

Evidence: canonical-create.log, canonical-start.log, sanitized resources.json, dashboard-resources.png, starter-weather.png, weather-snapshot.yml, weather-console.log, missing-apphost.log, starter-stop.log, sanitized after-stop.json.

Issues Observed and Coverage Limits

1. Unclassified macOS path failure: The first fresh starter, generated and launched using /tmp/aspire-pr21348.XdDM2q/Pr21348Smoke, failed with 18 CS0234 errors for missing Pr21348Smoke.Web.Components. Output mixed /tmp and its canonical /private/tmp alias. A separately generated fresh starter launched successfully with canonical /private/tmp paths throughout. The path change was not the only variable (the project name also changed), and no baseline SDK comparison was run, so attribution to this PR is not established. Evidence: starter-create.log, starter-start.log, and successful canonical logs.
2. Non-blocking frontend diagnostic: The working weather page requested /_framework/dotnet-browser-tools/hot-reload-settings.json and received 404. Weather rendering and backend calls worked. Hot reload itself was not tested; baseline attribution is unknown.
3. No MAUI workloads installed: dotnet workload list was empty. MAUI build/runtime validation was not attempted; no workloads were installed.
4. No Windows/Linux execution, full repository build/full test suite, or official Azure DevOps signing/packaging/release validation was performed. No pipeline/workflow source changed. Local native publishes verify the changed publishing settings but do not validate official signing/release behavior.
5. Startup repetition and streaming SIGINT passed, but the original intermittent macOS startup/signal issue was not first reproduced on a baseline.

Summary

Scenario	Status	Notes
PR artifact identity and bundled runtime	Passed	Correct head; managed bundle includes .NET/ASP.NET Core 10.0.14
Focused compatibility tests	Passed	478 tests
Targeted builds	Passed	Five commands; Cosmos covers three frameworks
Native AOT publish	Passed	CLI and dashboard, osx-arm64
Native startup and SIGINT	Passed	25 starts per CLI; log-stream SIGINT exits 0
Canonical-path starter E2E	Passed	Healthy resources, dashboard, backend data, restart and stop
Missing-AppHost validation	Passed	Expected exit 7
/tmp-alias starter	Failed, unclassified	Canonical-path fresh starter succeeds; baseline attribution unknown
MAUI / other OS / official release pipeline	Not validated	Environment and scope limits

Overall Result

Targeted servicing validation passed, with an unclassified macOS /tmp-path starter failure and a non-blocking hot-reload-settings 404 recorded above. This is not an unconditional full-platform sign-off.

No source changes were made. The test AppHost and isolated browser were stopped. Screenshots, command logs, and structured results are preserved beside this report; the temporary PR installation/generated applications are cleaned up separately.

PR comment posting requires explicit user confirmation. Local evidence paths are not publicly accessible attachments.