Bump the all-nuget group with 32 updates

[dependabot]

Updated AngleSharp from 1.5.2 to 1.8.2.

Release notes

Sourced from AngleSharp's releases.

1.8.2

Released on Friday, September 18 2026

What's Changed

• Improved attribute selector serialization to write only the case-sensitivity modifier that was specified (#​1351)
• Improved id/name lookup on collections (document.forms["x"], form.elements["x"], ...) to enumerate the underlying sequence once instead of twice
• Improved performance of form.elements / fieldset.elements by walking the tree directly (#​1350)
• Improved GetElementsByTagName / GetElementsByClassName traversal to stop double-scanning each element's children
• Improved selector specificity (Selectors.Specificity, ComplexSelector.Specificity) to be computed once instead of recomputed on every read
• Improved ListSelector.GetMatchingSelector to sort its selectors once instead of on every call
• Improved performance of HTML tree construction by keeping mutation logic out of it (#​1347)
• Improved performance of DOM mutations by building a mutation record only when an observer will consume it (#​1347)
• Improved performance of parser attribute duplication check
• Fixed Document.Forms allocating a new collection instance per read, contradicting its own [DomSameObject] contract
• Fixed classList and the other reflected token lists writing their content attribute without running the attribute change steps or queueing a mutation record
• Fixed clearing a reflected boolean attribute such as disabled removing it without running the attribute change steps or queueing a mutation record
• Fixed vulnerability via SVG style serialization (GHSA-cgp3-27rh-pcp2)
• Fixed a StackOverflowException when parsing a document with deeply nested unclosed <template> elements
• Added Document.MutationVersion, a synchronous counter of DOM mutations that a parse leaves unchanged (#​1344, #​1347)
• Released 1.8.2 by @​FlorianRappl in Release 1.8.2 AngleSharp/AngleSharp#1353

New Contributors

• @​RichardJansma made their first contribution in Fix broken image download URLs in FAQ AngleSharp/AngleSharp#1352

Full Changelog: AngleSharp/AngleSharp@v1.8.1...v1.8.2

1.8.1

Released on Thursday, September 10 2026

What's Changed

• Updated DoFocus and DoBlur to apply to form elements
• Improved explicit form ownership to take precedence over ancestor forms for connected controls (#​1323) @​sebastienros
• Fixed HTML hyperlink pseudo-classes omitting empty href and matching link elements (#​1337) @​sebastienros
• Fixed HTML-namespace element creation losing local-name case (#​1327) @​sebastienros
• Fixed :enabled incorrectly matching HTML links with nonempty href (#​1324) @​sebastienros
• Fixed changing focus of elements
• Released 1.8.1 by @​FlorianRappl in Release 1.8.1 AngleSharp/AngleSharp#1343

New Contributors

• @​sebastienros made their first contribution in Fix HTML hyperlink pseudo-class classification AngleSharp/AngleSharp#1338

Full Changelog: AngleSharp/AngleSharp@v1.8.0...v1.8.1

1.8.0

Released on Saturday, September 5 2026

What's Changed

• Improved AngleSharp's test website
• Fixed script data escaped state potentially not bouncing back correctly
• Added the DomSameObject annotation for the respective IDL members (#​1314) @​lahma
• Added the DomReturnType annotation for methods returning a different IDL type (#​1318)
• Released 1.8.0 by @​FlorianRappl in Release 1.8.0 AngleSharp/AngleSharp#1317

Full Changelog: AngleSharp/AngleSharp@v1.7.3...v1.8.0

1.7.3

Released on Thursday, September 3 2026

What's Changed

• Improved tracking of parse exceptions in the HtmlParser (#​1315) @​lahma
• Fixed tokenizer buffer overrun on encoding change (#​1290) @​jafin
• Fixed selector text dropping the nth-child of clause (#​1292) @​jafin
• Fixed selector text dropping the case-insensitive (#​1291) @​jafin
• Fixed selector specificity carrying between fields instead of saturating (#​1300) @​meziantou
• Fixed condition check for disposed state in ReturnToPool (#​1296) @​meziantou
• Fixed ArgumentOutOfRangeException CSS escapes (#​1299) @​meziantou
• Fixed whitespace around An+B CSS selector notations (#​1297)
• Fixed unsupported pseudo-classes matching everything (#​1295)
• Fixed DomException for invalid foreign attribute names such as xml:lang[ (#​1294)
• Fixed script data escaped state leaving escaped mode too early (#​1298)
• Fixed CurrentScript not indicating the currently executing script (#​1308) @​lahma
• Fixed returned missing attribute-properties to use empty string instead of null (#​1313) @​lahma
• Fixed removal of data-* attributes (#​1310) @​lahma
• Added missing DomName/DomAccessor annotations (#​1301) @​meziantou
• Added missing DomLiterals attribute to AdjacentPosition (#​1311) @​lahma
• Released 1.7.3 by @​FlorianRappl in Release 1.7.3 AngleSharp/AngleSharp#1302

Full Changelog: AngleSharp/AngleSharp@v1.7.2...v1.7.3

1.7.2

Released on Sunday, August 23 2026

What's Changed

• Fixed matching of annotation-xml encoding to be case-insensitive (#​1284) @​arpitjain099
• Fixed <xmp> usage in <select> elements
• Added ability to parse immutable byte buffers without a stream (#​1286) @​dv00d00
• Released 1.7.2 by @​FlorianRappl in Release 1.7.2 AngleSharp/AngleSharp#1288

New Contributors

• @​arpitjain099 made their first contribution in Match the annotation-xml encoding case-insensitively AngleSharp/AngleSharp#1284

Full Changelog: AngleSharp/AngleSharp@1.7.1...v1.7.2

1.7.1

Released on Wednesday, August 5 2026

• Migrated the build system from NUKE to Fallout by @​jafin in Migrate the build system from NUKE to Fallout AngleSharp/AngleSharp#1275
• Improved WHATWG Url specification (#​802) @​jafin
• Improved tokenizer read performance (#​1274) @​dv00d00
• Fixed auxiliary browsing context lifetime (#​1278) @​jafin
• Fixed duplicated DomName attributes on DOM geometry
• Fixed document.open() destroying the DOM tree in case of encoding problems (#​1276)
• Fixed source references having wrong line (#​1280)
• Released 1.7.1 by @​FlorianRappl in Release 1.7.1 AngleSharp/AngleSharp#1281

Full Changelog: AngleSharp/AngleSharp@1.7.0...v1.7.1

1.7.0

Released on Friday, July 31 2026

• Improved CSS selector performance (#​1270, #​929) @​lahma
• Added support for the :host pseudo selector (#​1271)
• Added support for the DomGeometry spec (#​1193)

1.6.0

Released on Sunday, July 26 2026

• Improved performance for text tokenization (#​1262) @​dv00d00
• Improved CSS selector performance
• Improved observer dispatch during HTML parsing (#​1266) @​dv00d00
• Improved declaration of unsupported pseudo elements
• Fixed inconsistent behavior and segfaults on Android Release build (#​1252) @​DevGitPit
• Fixed CSS attribute selector modifier handling for i / I (case-insensitive) and s / S (case-sensitive)
• Added API enhancements to expose asynchronous HTML token source (#​1265) @​dv00d00
• Added bounded stream parsing mode (#​1263) @​dv00d00
• Added canonicalization of decimal, octal, or hexadecimal IPv4 literals in Url
• Added parsing of / checks for IPv6 literals in Url
• Added support for the CSS column combinator (||) selector syntax
• Added correct identification of CurrentSource in CssMediaElement

Commits viewable in compare view.

Updated Asp.Versioning.Http from 10.0.0 to 10.2.3.

Release notes

Sourced from Asp.Versioning.Http's releases.

10.2.0

This release includes some big new features but is fully backward compatible with 10.0.0. The new features include versioned model member filtering, Roslyn analyzers, gRPC preview support, and a number of servicing patches since the previous release.

Fixes

All Platforms

• Parsing an API version whose status ends in '.' no longer succeeds silently
• Very large padding values in a format string no longer cause a stack overflow
• Incorrect lower and upper bounds when matching API version ranges
• Parsing a positive integer no longer allows whitespace or a leading '-'

ASP.NET Core

• Routes are no longer incorrectly evicted from the route table (#​1138)
• Fixed routing of unversioned endpoints
• Fixed extracting an API version that includes a status when versioning by URL segment (#​1187)
• A user-registered IProblemDetailsWriter is preserved by AddApiVersioning() (#​1191)

ASP.NET Core OpenAPI

• Support for more XML comment tags (#​1205)
• Fixed the error message reported for an unmapped JSON property
• Fixed descriptions applied to filtered members

Features

All Platforms

• New ApiVersionRange type for matching a set of API versions using the same interval notation as a package version
  • 1.0 → x ≥ 1.0
  • [1.0] → x == 1.0
  • (1.0,) → x > 1.0
  • (,1.0] → x ≤ 1.0
  • [1.0,2.0) → 1.0 ≤ x < 2.0
  • Multiple rules are combined as a logical or; ApiVersionRange.Any and ApiVersionRange.Empty are provided for
    the degenerate cases
  • A range matches API versions; it does not define them. API versions must still be explicitly declared
• New VisibleInApiVersionAttribute indicates the range of API versions a data member is visible in; for example,
  [VisibleInApiVersion("2.0")]
• New IAnnotation<TKey, TValue> abstraction for associating out-of-band metadata with a member
• [StringSyntax] is now applied to API version inputs so the IDE and analyzers understand them; the recognized
  syntaxes are ApiVersion, ApiVersionRange, and ApiVersionFormat

Analyzers

API Versioning now ships Roslyn analyzers. There is no new package to install — the core rules are packed into Asp.Versioning.Abstractions and the API rules are packed into Asp.Versioning.Http, so any application that already references API Versioning picks them up transitively.

There is an initial set of 31 rules. You can find all of the rule information in the new diagnostics wiki topic.

Notes:
... (truncated)

Commits viewable in compare view.

Updated Aspire.Hosting from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated Aspire.Hosting.MongoDB from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.MongoDB's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.4.6 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

13.5.3

What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

• 📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #​19489. (#​19585, backport of #​19579, @​sebastienros)

• 🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #​19496. (#​19625, backport of #​19590, @​karolz-ms, @​danegsta)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.5.3

---

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2

What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

• 🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#​19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #​19554, @​mitchdenny)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1

What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

• 🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

• 🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #​19365. Fixes #​19503. ([#​19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #​19506, @​adamint)

🏷️ Housekeeping

• 📦 Updated DCP (Developer Control Plane) to 0.25.13 ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

• 🔧 Restored WinGet publication using .NET 9 wingetcreate ([#​19509]([release/13.5] fix(release): Restore WinGet publication with .NET 9 wingetcreate microsoft/aspire#19509))

• 🧹 Removed the pipeline-scoped Publish-Build-Assets group from the release pipeline ([#​19523]([release/13.5] Remove pipeline-scoped Publish-Build-Assets group microsoft/aspire#19523), [#​19163](Remove Publish-Build-Assets variable group from release/13.5 microsoft/aspire#19163))

• 🚀 Bumped branding to 13.5.1 ([#​19531](Increment patch version from 0 to 1 microsoft/aspire#19531))

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

13.5.0

Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements.

Highlights

• 💬 Richer AppHost interactions — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options.
• 🖥️ Interactive terminal sessions — The experimental WithTerminal() API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in aspire terminal CLI command for attaching from your shell.
• 🌐 TypeScript AppHost is generally available — Polyglot AppHosts no longer require the ASPIREATS001 experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#.
• 🛠️ CLI installation and reliability — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while aspire stop --force, aspire update --migrate, aspire doctor, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows.
• 🎨 Refreshed dashboard — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active.
• 💻 Rebranded VS Code extension — The extension is now named Aspire and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery.
• ☸️ More expressive deployments — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory.
• ☁️ Expanded hosting integrations — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new Aspire.Hosting.Dotnet package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities.

⚠️ Breaking changes

Notable changes include hosting context ServiceProvider properties being renamed to Services, PublishAsConnectionString becoming obsolete in favor of AddConnectionString, removal of aspire ps --resources and --include-hidden in favor of aspire describe, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the Aspire 13.5 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.5.

Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜

---

Full Changelog: v13.4.6...v13.5.0

Full commit: e076d8e427cb3afb528dbd605acd74c3aea69f94

Commits viewable in compare view.

Updated Auth0.AspNetCore.Authentication from 1.7.0 to 1.11.0.

Release notes

Sourced from Auth0.AspNetCore.Authentication's releases.

1.11.0

Added

• Mutual TLS (mTLS) support #​279 (kailash-b) - applications can now authenticate to Auth0 with a client certificate instead of a client secret or client assertion (RFC 8705). Access tokens can additionally be certificate-bound, so a stolen token cannot be replayed without the corresponding private key - aimed at highly-regulated, holder-of-key scenarios. The feature is opt-in and additive; the application owns and manages the certificate. Misconfiguration (combining mTLS with a client secret, client assertion, or custom backchannel) is caught at startup.
• Impersonation via Session Transfer #​273 (kailash-b) - builds on the existing Custom Token Exchange support to let an initiator app (e.g. a support/admin console) start an authenticated session in a target app as a customer, with the agent recorded in the act claim. The initiator requests a short-lived, single-use Session Transfer Token and redirects the agent's browser to the target app carrying that token.

Security

• chore(deps): Bump System.Text.Encodings.Web from 10.0.10 to 10.0.11 #​278 (dependabot[bot])

1.10.0

Added

• Upstream IdP session expiry (IPSIE SL1) enforcement #​272 (tanya732) - when Auth0 brokers an upstream identity provider that enforces its own session lifetime, that ceiling now caps the session in the application too, so a user is not kept signed in past the point the upstream IdP considers their session over. Enforcement is automatic and requires no code opt-in; it activates only when the connection emits a session_expiry claim (Unix seconds) on the ID token (connection option id_token_session_expiry_supported).

Security

• Bump dependencies #​274 (dependabot[bot]) - consolidates several Dependabot bumps (supersedes #​267, #​271): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.2 → 8.22.0.
• Dependency updates #​266 (kailash-b) - bundles a set of routine Dependabot updates keeping both the NuGet package references and GitHub Actions workflow versions current.
  • NuGet packages: Microsoft.AspNetCore.Mvc.Testing 10.0.9 → 10.0.10, Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.1 → 8.19.2, Microsoft.NET.Test.Sdk 18.6.0 → 18.8.1, System.Text.Encodings.Web 10.0.9 → 10.0.10.

1.9.0

Added

• Token Vault support #​255 (kailash-b) - web apps can now obtain a third-party API access token for a federated connection (e.g. Google, GitHub, Slack) on behalf of the logged-in user by exchanging the session's refresh token, without running a separate provider OAuth flow.
  • New HttpContext.GetAccessTokenForConnectionAsync(AccessTokenForConnectionRequest, string? scheme = null) extension serves an unexpired connection token from the session cache when possible, and otherwise exchanges the refresh token and persists the result.
  • AccessTokenForConnectionRequest carries Connection (required), an optional LoginHint (the provider-side IdP user ID), and ForceRefresh to bypass the cache.
  • Returns null rather than throwing when no refresh token is present (fires OnMissingRefreshToken) or the exchange is rejected (fires OnAccessTokenRefreshFailed).
• Custom Token Exchange support #​258 (kailash-b) - applications can exchange an existing external/custom security token for Auth0 tokens without a browser redirect (RFC 8693), enabling delegation/impersonation and agent-identity scenarios. Requires a Custom Token Exchange Profile and a validation Action configured in the tenant.
  • New HttpContext.CustomTokenExchangeAsync(CustomTokenExchangeRequest) extension performs the exchange. CustomTokenExchangeRequest takes SubjectToken and SubjectTokenType (required), plus optional Audience, Scope, an ActorToken/ActorTokenType delegation pair, and Organization.
  • CustomTokenExchangeResult returns the exchanged tokens (AccessToken, IdToken, RefreshToken, ExpiresIn, Scope) and the decoded act (actor) claim for delegation flows.
  • Stateless by design - the exchange returns tokens but has no session side-effects: it does not sign the user in or write any cookie, leaving the caller to decide what to persist.
  • Client-side validation runs before any network call (subject_token must be non-empty and un-prefixed; subject_token_type must be a valid 10–100 character URI, rejecting the reserved urn:ietf: and urn:auth0: namespaces; an actor token requires its matching type). Failures surface as CustomTokenExchangeException, which carries StatusCode, Error, and ErrorDescription but never token-bearing bytes.
• Claims refresh and OnTokensRefreshed event on token refresh #​254 (kailash-b) - previously, refreshing an expired access token persisted the new tokens but left the ClaimsPrincipal at its login-time snapshot for the life of the refresh token. Two opt-in additions let applications react to a successful primary refresh (fixes #​174).
  • New Auth0WebAppWithAccessTokenOptions.RebuildPrincipalOnRefresh (default false) rebuilds the ClaimsPrincipal from the refreshed id_token so User.Claims and User.Identity.Name reflect current user information.
  • New Auth0WebAppWithAccessTokenOptions.RefreshClaimsValidationType controls how the refreshed id_token is validated before its claims replace the principal (only consulted when RebuildPrincipalOnRefresh is true): Full (default) validates signature against the cached JWKS plus issuer/audience and business-rule checks, while SkipSignature trusts the back-channel TLS exchange and runs only the business-rule checks.
  • New Auth0WebAppWithAccessTokenEvents.OnTokensRefreshed event fires after every successful primary refresh; the AccessTokenRefreshedContext carries the refreshed AccessToken, IdToken, RefreshToken (null when not rotated), and ExpiresAt. It fires independently of RebuildPrincipalOnRefresh, and after the principal is rebuilt when both are used.
  • Graceful degradation - if the refresh succeeds but rebuilding the principal fails (signature failure, malformed token, or business-rule failure), the SDK keeps the refreshed tokens, retains the existing (stale) principal, logs a warning, and still fires OnTokensRefreshed.
  • Both additions apply only to the primary (login-time) refresh path; tokens fetched for additional audiences via MRRT do not rebuild the principal or fire OnTokensRefreshed.

1.8.0

Added

• Multi-Resource Refresh Token (MRRT) support #​249, #​251 (kailash-b) - applications can now obtain access tokens for additional audiences and scopes on demand by exchanging the session's refresh token, without forcing the user through another interactive login.
  • New HttpContext.GetAccessTokenAsync(AccessTokenRequest) extension returns an access token for a requested audience and/or scope, served from the session cache when possible and otherwise via a refresh-token exchange.
  • Configure default scopes per audience with Auth0WebAppWithAccessTokenOptions.ScopeByAudience.
  • The new OnAccessTokenRefreshFailed event surfaces refresh failures, letting callers distinguish terminal failures (warranting re-login) from transient ones.
  • MFA challenge handling - when a refresh requires MFA, a new MfaRequiredException surfaces the challenge, and IAuthenticationApiClient (registered via WithAuthenticationApiClient()) lets the application complete OTP, OOB, or recovery-code grants and manage authenticators.
• Configurable access-token expiration leeway #​247 (kailash-b) - new Auth0WebAppWithAccessTokenOptions.AccessTokenExpirationLeeway (TimeSpan, default 60s) controls how far ahead of expiry the SDK proactively refreshes the access token. Previously hard-coded to 60 seconds; the default preserves prior behavior. Applies to both primary and additional (MRRT) cached tokens, and only takes effect when UseRefreshTokens is enabled.
• Configurable server-side session store #​246 (kailash-b) - new WithSessionStore method on Auth0WebAppAuthenticationBuilder stores the authentication session server-side (via ITicketStore) instead of in the cookie. It attaches the store to the SDK's own resolved cookie scheme, so it works even with a custom CookieAuthenticationScheme. Two overloads are provided: WithSessionStore<TStore>() (resolved from DI) and WithSessionStore(ITicketStore instance). Opt-in and additive; the default stateless cookie session is unchanged.

Fixed

• Remove duplicate trailing slash from client_assertion audience #​236 (samjetski) - fixes a regression introduced in 1.7.0 (#​206) where the Private Key JWT client assertion aud claim was built as https://{tenant}// (double slash), causing Auth0's /oauth/token endpoint to reject the assertion with 401 invalid_client and leaving affected apps (any using ClientAssertionSecurityKey) in a callback loop.
• Wire OnValidatePrincipal to the configured cookie scheme #​248 (kailash-b) - fixes a scheme mismatch where the access-token refresh hook was registered against the default "Cookies" scheme rather than the configured CookieAuthenticationScheme.

Security

• Bump dependencies #​250 (kailash-b) - consolidates several Dependabot bumps (supersedes #​240, #​242, #​243, #​244): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.18.0 → 8.19.1, Microsoft.AspNetCore.Mvc.Testing 10.0.8 → 10.0.9, Microsoft.AspNetCore.Mvc.ViewFeatures 2.3.10 → 2.3.11, System.Text.Encodings.Web 10.0.8 → 10.0.9.
• Pin GitHub Actions to commit SHAs #​241 (jcchavezs) - pins all third-party actions in the workflow files to commit SHAs for improved supply-chain security and reproducibility.

1.7.1

Security

• chore: Upgrade dependencies #​237 (kailash-b)
• chore(deps): Bump System.Text.Encodings.Web from 10.0.6 to 10.0.7 #​228 (dependabot[bot])
• chore(deps): Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.6 to 10.0.7 #​227 (dependabot[bot])
• chore(deps): Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #​229 (dependabot[bot])
• chore(deps): Bump Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.17.0 to 8.18.0 #​230 (dependabot[bot])
• chore(deps): Bump System.Text.Encodings.Web from 10.0.5 to 10.0.6 #​225 (dependabot[bot])
• chore(deps): Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.5 to 10.0.6 #​224 (dependabot[bot])
• chore(deps): Bump Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0 #​222 (dependabot[bot])
• chore(deps): Bump Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.16.0 to 8.17.0 #​221 (dependabot[bot])

Commits viewable in compare view.

Updated bunit from 2.7.2 to 2.11.3.

Release notes

Sourced from bunit's releases.

2.11.3

Fixed

• InvokeOnSpacerBeforeVisible now uses 4 parameters on .NET 11.0. Reported by @​vnbaaij in #​1915. Fixed by @​vnbaaij in #​1919.
• A JSInterop timeout elapsing while a result was set could crash the test host with InvalidOperationException: Nullable object must have a value. Reported by @​calebcwells in #​1920. Fixed by @​linkdotnet.

2.10.3

Fixed

• BunitHtmlParser.Dispose() no longer throws InvalidOperationException: Collection was modified when a parse is in flight on another thread during test teardown. Reported by @​thimobuchheister in #​1892. Fixed by @​linkdotnet.

2.9.0

Changed

• Update to stable package of AngleSharp.Css

2.8.6

Added

• New overloads to WaitForHelpers to have async assertions and predicates. Reported by @​radmorecameron in #​1833. Fixed by @​linkdotnet.
• AddAsset to BunitContext to seed the ResourceAssetCollection exposed via ComponentBase.Assets. Reported by LasseHerget in #​1846. Implemented by @​linkdotnet.

Commits viewable in compare view.

Updated FluentAssertions from 8.10.0 to 8.11.0.

Release notes

Sourced from FluentAssertions's releases.

8.11.0

What's Changed

New features

• Add ThatSatisfy for methods and properties by @​jnyrup in Add ThatSatisfy for methods and properties fluentassertions/fluentassertions#3257
• Add BeSupersetOf, BeProperSubsetOf and BeProperSupersetOf collection assertions by @​dennisdoomen in Add BeSupersetOf, BeProperSubsetOf and BeProperSupersetOf collection assertions fluentassertions/fluentassertions#3271
• Add BeJsonSerializable round-trip assertions by @​dennisdoomen in Add BeJsonSerializable round-trip assertions fluentassertions/fluentassertions#3293
• Support asserting on delegates that return a value task by @​dennisdoomen in Support asserting on delegates that return a value task fluentassertions/fluentassertions#3301

Improvements

• BeEmpty for IEnumerable assertions now lists the first 10 items in… by @​Xceed-DelvaJB in BeEmpty for IEnumerable<T> assertions now lists the first 10 items in… fluentassertions/fluentassertions#3198
• Clean-up the stack trace further by @​jnyrup in Clean-up the stack trace further fluentassertions/fluentassertions#3290
• Add HaveLineCount()/NotHaveLineCount() and ContainLine()/NotContainLine() to StringAssertions by @​dennisdoomen in Add HaveLineCount()/NotHaveLineCount() and ContainLine()/NotContainLine() to StringAssertions fluentassertions/fluentassertions#3297
• Add public ValueTypeAssertions<TSubject, TAssertions> base class by @​dennisdoomen in Add public ValueTypeAssertions<TSubject, TAssertions> base class fluentassertions/fluentassertions#3308

Fixes

• Fix JsonNodeAssertions.HaveProperty/NotHaveProperty for properties with explicit null values by @​dennisdoomen with @​Copilot in Fix JsonNodeAssertions.HaveProperty/NotHaveProperty for properties with explicit null values fluentassertions/fluentassertions#3282
• Fix exception on HaveProperty on JsonArray by @​jnyrup in Fix exception on HaveProperty on JsonArray fluentassertions/fluentassertions#3295
• Fix potential NREs when using AssertionScope (#​3178) by @​dennisdoomen in Fix potential NREs when using AssertionScope (#3178) fluentassertions/fluentassertions#3323

Documentation

• Fix typos by @​jnyrup in Fix typos fluentassertions/fluentassertions#3310
• Fix typo in exceptions page by @​jpgomezv in Fix typo in exceptions page fluentassertions/fluentassertions#3317

Others

• Simplify GetMinValue/GetMaxValue by @​jnyrup in Simplify GetMinValue/GetMaxValue fluentassertions/fluentassertions#3210
• Revert "Bump coverlet.collector from 6.0.4 to 8.0.1" by @​jnyrup in Revert "Bump coverlet.collector from 6.0.4 to 8.0.1" fluentassertions/fluentassertions#3218
• Update nugets by @​jnyrup in Update nugets fluentassertions/fluentassertions#3226
• Convert the build pipeline from Nuke to Fallout by @​dennisdoomen in Convert the build pipeline from Nuke to Fallout fluentassertions/fluentassertions#3234
• Expose ShouldThrowOnCyclicReference on IEquivalencyValidationContext by @​dennisdoomen in Expose ShouldThrowOnCyclicReference on IEquivalencyValidationContext fluentassertions/fluentassertions#3242
• Prevent pwn-request RCE via the Qodana workflow by @​dennisdoomen in Prevent pwn-request RCE via the Qodana workflow fluentassertions/fluentassertions#3217
• Harden NPM install by @​jnyrup in Harden NPM install fluentassertions/fluentassertions#3258
• Pin System.Security.Cryptography.Xml to patched version to fix build restore failures by @​dennisdoomen in Pin System.Security.Cryptography.Xml to patched version to fix build restore failures fluentassertions/fluentassertions#3283
• Exclude dependabot PRs from auto-generated release notes by @​dennisdoomen in Exclude dependabot PRs from auto-generated release notes fluentassertions/fluentassertions#3294
• Fix Qodana PR scans failing on pull requests from forks by @​dennisdoomen in Fix Qodana PR scans failing on pull requests from forks fluentassertions/fluentassertions#3299
• Cancel duplicate CI runs when a push triggers both push and pull_request events by @​dennisdoomen in Cancel duplicate CI runs when a push triggers both push and pull_request events fluentassertions/fluentassertions#3298
• Fix Qodana-flagged possible multiple enumeration and unused auto-property warnings by @​dennisdoomen in Fix Qodana-flagged possible multiple enumeration and unused auto-property warnings fluentassertions/fluentassertions#3300
• Document lessons learned from #​3291 in agents.md by @​dennisdoomen in Document lessons learned from #3291 in agents.md fluentassertions/fluentassertions#3307
• Pin SDK to workaround 10.0.400 by @​jnyrup in Pin SDK to workaround 10.0.400 fluentassertions/fluentassertions#3309
• Stop the Build workflow from running twice on same-repo PRs by @​dennisdoomen in Stop the Build workflow from running twice on same-repo PRs fluentassertions/fluentassertions#3311
• Update NuGet.Frameworks to workaround Fallout issue by @​jnyrup in Update NuGet.Frameworks to workaround Fallout issue fluentassertions/fluentassertions#3318
• Prefer Count > 0 over Any() by @​jnyrup in Prefer Count > 0 over Any() fluentassertions/fluentassertions#3321
• Correct the arguments passed to string.Format on failure by @​jnyrup in Correct the arguments passed to string.Format on failure fluentassertions/fluentassertions#3325
• Migrate xunit v3 test projects off the VSTest pipeline by @​dennisdoomen in Migrate xunit v3 test projects off the VSTest pipeline fluentassertions/fluentassertions#3320
• Include PackageGuard risk report and SBOM in pipeline by @​dennisdoomen in Include PackageGuard risk report and SBOM in pipeline fluentassertions/fluentassertions#3324

New Contributors

• @​jpgomezv made their first contribution in Fix typo in exceptions page fluentassertions/fluentassertions#3317

Full Changelog: fluentassertions/fluentassertions@8.10.0...8.11.0

Commits viewable in compare view.

Updated MessagePack from 3.1.8 to 3.1.9.

Release notes

Sourced from MessagePack's releases.

3.1.9

What's Changed

Security fix

• Fix Nested arrays can blow past buffer length limits via 7fd78bbf3476

Other fixes

• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @​BertanAygun in Update DynamicAssembly usage to honor different AssemblyLoadContext's MessagePack-CSharp/MessagePack-CSharp#2183
• Update v2.x to build again by @​AArnott in Update v2.x to build again MessagePack-CSharp/MessagePack-CSharp#2264
• Add more types to the default disallow list of named types to be deserialized by @​AArnott in Add more types to the default disallow list of named types to be deserialized MessagePack-CSharp/MessagePack-CSharp#2263
• Add several known unsafe 'gadgets' to the disallow list by @​AArnott in Add several known unsafe 'gadgets' to the disallow list MessagePack-CSharp/MessagePack-CSharp#2269
• Revise end-of-life date for version 2.x by @​AArnott in Revise end-of-life date for version 2.x MessagePack-CSharp/MessagePack-CSharp#2282
• Fix OldSpec byte[] encoding emitting unsupported str8 headers by @​AArnott with @​Copilot in Fix OldSpec byte[] encoding emitting unsupported str8 headers MessagePack-CSharp/MessagePack-CSharp#2287
• v2 to master by @​AArnott in v2 to master MessagePack-CSharp/MessagePack-CSharp#2295
• Fix build warning and Windows build break by @​AArnott in Fix build warning and Windows build break MessagePack-CSharp/MessagePack-CSharp#2300
• Fix source generator snapshot ordering by @​AArnott in Fix source generator snapshot ordering MessagePack-CSharp/MessagePack-CSharp#2303
• Test before versioned release build by @​AArnott in Test before versioned release build MessagePack-CSharp/MessagePack-CSharp#2304

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.8...v3.1.9

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.6.0 to 10.10.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

• OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

• Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
• Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
• OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

• Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
• Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

• Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
• Bump PowerShell from 7.6.4 to 7.6.5 #​7702
• [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
• Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
• Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
• Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
• Do not validate extension during publish step #​7725 by @​peterwaltonwork
• Add skill for upgrading OpenAI #​7728 by @​jozkee
• Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

• @​Lroca88 made their first contribution in #​7718
• @​thaildhe172591 made their first contribution in #​7735
• @​ANcpLua submitted issue #​7665 (resolved by #​7735)
• @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

10.9.0

Version 10.9.0 is headlined by changes in these areas:

• AI: New experimental routing APIs center on the abstract RoutingChatClient base class, with SemanticRoutingChatClient as a concrete semantic-routing implementation. Separately, the abstract FailoverChatClient specialization and its concrete OrderedFailoverChatClient implementation add failover routing.
• AI Evaluation: The generated report gains redesigned Overview, Cases, History, and Comparison views.
• ASP.NET Core and HTTP diagnostics: The release adds HTTP request latency log enrichment and fixes configuration binding, response-body logging, request-path redaction, and resilience package version handling.
• Source-generated logging and service discovery: Fixes cover classification type qualification, thread-local state cleanup, and DNS query suffix handling.

Experimental API Changes

New Experimental APIs

• New experimental API: HTTP request latency log enrichment (EXTEXP0013) #​7602
• New experimental API: Chat client routing and failover (MEAI001) #​7662

What's Changed

AI (Microsoft.Extensions.AI, Microsoft.Extensions.AI.Abstractions, and Microsoft.Extensions.AI.OpenAI)

• Add extensible chat client routing #​7662 by @​joshuajyue (co-authored by @​Copilot)
• Pass the request's options to the selected client #​7685 by @​joshuajyue (co-authored by @​jozkee @​Copilot)
• AI.Abstractions: fix ExcludeFromSchema dropped under concurrent AIFunction creation #​7677 by @​jozkee (co-authored by @​Copilot)
• Cap OpenAI dependency version (b10f9c0) by @​jeffhandley (co-authored by @​Copilot)

Note: Microsoft.Extensions.AI.OpenAI constrains its dependency for OpenAI to 2.12.x, preventing OpenAI updates to 2.13.0+ due to an incompatibility. We expect to release Microsoft.Extensions.AI.OpenAI version 10.9.1 during the week of August 17 to address this issue.

HTTP Resilience and Diagnostics (Microsoft.Extensions.Http.Resilience and Microsoft.Extensions.Http.Diagnostics)

• Fix Grpc.Net.ClientFactory version range check - Fixes #​7565 #​7566 by @​Ghost93
• Fix response body logging under debugger #​7678 by @​Rimobul
• Redact outgoing path when route is unknown #​7687 by @​Rimobul
• Fix HTTP client logging config binding #​7691 by @​Rimobul

ASP.NET Core Extensions (Microsoft.AspNetCore.Diagnostics.Middleware)

• Rename HttpLatencyTelemetry extensions class and drop redundant TFM guard #​7645 by @​EasyL0ver (co-authored by @​Copilot)
• Add HTTP request latency log enricher (experimental) #​7602 by @​EasyL0ver (co-authored by @​Copilot)

Logging Source Generator (Microsoft.Gen.Logging)

• [Microsoft.Gen.Logging] Clear thread-local state when logging throws #​7682 by @​Rimobul
• [Microsoft.Gen.Logging] Fully qualify classification types #​7689 by @​Rimobul

AI Evaluation (Microsoft.Extensions.AI.Evaluation.Reporting)

• [...

Description has been truncated

Dependabot...

Description has been truncated

[github-actions]

Test Results Summary

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 4d9508a.

[mpaulosky]

Replaced by #216, which takes these updates plus the two fixes restore needed (Microsoft.OpenApi held at 2.12.2, Microsoft.AspNetCore.Components.Web raised to 10.0.12).

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml