Skip to content

Bump the nuget-all group with 16 updates - #526

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-all-644f9a43f9
Open

Bump the nuget-all group with 16 updates#526
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-all-644f9a43f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor

Updated Aspire.Hosting.AppHost from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

  • 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

  • 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

  • ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

  • 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

  • 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

  • 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated bunit from 2.10.3 to 2.11.3.

Release notes

Sourced from bunit's releases.

2.11.3

Fixed

  • InvokeOnSpacerBeforeVisible now uses 4 parameters on .NET 11.0. Reported by @​vnbaaij in #​1915. Fixed by @​vnbaaij in #​1919.
  • A JSInterop timeout elapsing while a result was set could crash the test host with InvalidOperationException: Nullable object must have a value. Reported by @​calebcwells in #​1920. Fixed by @​linkdotnet.

Commits viewable in compare view.

Updated Dapper from 2.1.79 to 2.1.89.

Release notes

Sourced from Dapper's releases.

2.1.89

What's Changed

New Contributors

Full Changelog: DapperLib/Dapper@2.1.86...2.1.89

2.1.86

What's Changed

Full Changelog: DapperLib/Dapper@2.1.79...2.1.86

Commits viewable in compare view.

Updated FluentAssertions from 8.10.0 to 8.11.0.

Release notes

Sourced from FluentAssertions's releases.

8.11.0

What's Changed

New features

Improvements

Fixes

Documentation

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@8.10.0...8.11.0

Commits viewable in compare view.

Updated Markdig from 1.3.2 to 1.4.0.

Release notes

Sourced from Markdig's releases.

1.4.0

Changes

✨ New Features

  • Add strict GFM pipe table parsing mode (14cd25c7)

🐛 Bug Fixes

  • Fix heading auto-link hijacking nested link labels (#​668) (PR #​949) by @​dualfroz
  • Fix: keep trailing content out of an unmatched emphasis closer (#​743) (PR #​950) by @​dualfroz
  • Fix indent on first list item (#​482) (PR #​953) by @​boxofyellow
  • Add Normalization Support for PipeTables (GFM) (PR #​954) by @​boxofyellow
  • Fix partially empty pipe table separator regression (PR #​955) by @​vicancy
  • Reject emoji-parsing if the slice ends with ** (PR #​947) by @​bstordrup
  • Fix strict GFM tables against native cmark-gfm (86866b91)

🚀 Enhancements

  • Update 3rd party extensions (PR #​945) by @​Kryptos-FR

🏭 Tests

  • Fix tests warnings (96b024c2)

📦 Dependencies

  • Bump deps (c6b186b4)

🧰 Misc

  • Use NuGet Trusted Publishing via dotnet-releaser (56e9c238)

Full Changelog: 1.3.2...1.4.0

Published with dotnet-releaser

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Resilience from 10.9.0 to 10.10.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

  • OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

  • Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
  • Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
  • OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

  • Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
  • Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

  • Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
  • Bump PowerShell from 7.6.4 to 7.6.5 #​7702
  • [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
  • Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
  • Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
  • Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
  • Do not validate extension during publish step #​7725 by @​peterwaltonwork
  • Add skill for upgrading OpenAI #​7728 by @​jozkee
  • Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

  • @​Lroca88 made their first contribution in #​7718
  • @​thaildhe172591 made their first contribution in #​7735
  • @​ANcpLua submitted issue #​7665 (resolved by #​7735)
  • @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.9.0 to 10.10.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

  • OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

  • Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
  • Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
  • OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

  • Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
  • Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

  • Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
  • Bump PowerShell from 7.6.4 to 7.6.5 #​7702
  • [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
  • Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
  • Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
  • Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
  • Do not validate extension during publish step #​7725 by @​peterwaltonwork
  • Add skill for upgrading OpenAI #​7728 by @​jozkee
  • Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

  • @​Lroca88 made their first contribution in #​7718
  • @​thaildhe172591 made their first contribution in #​7735
  • @​ANcpLua submitted issue #​7665 (resolved by #​7735)
  • @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.14.2 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.15.0

Federated credentials and proof of possession

  • Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
  • The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
  • Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

  • EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
  • Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

  • OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
  • Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
  • Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

  • Invalid selected AgentUserId values return HTTP 400. #​4011
  • Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
  • Non-local Host headers are rejected outside Development except on /healthz. #​4023
  • Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

  • Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
  • Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.Identity.Web.UI from 4.14.2 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.15.0

Federated credentials and proof of possession

  • Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
  • The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
  • Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

  • EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
  • Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

  • OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
  • Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
  • Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

  • Invalid selected AgentUserId values return HTTP 400. #​4011
  • Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
  • Non-local Host headers are rejected outside Development except on /healthz. #​4023
  • Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

  • Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
  • Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.Testing.Extensions.CodeCoverage from 18.11.0 to 18.11.2.

Release notes

Sourced from Microsoft.Testing.Extensions.CodeCoverage's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.18.0 to 1.19.1.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.19.1

For highlights and announcements pertaining to this release see: Release Notes > 1.19.1.

The following changes are from the previous release 1.19.0.

1.19.1-rc.1

The following changes are from the previous release 1.19.0.

1.19.1-beta.1

The following changes are from the previous release 1.19.0-beta.1.

1.19.0

For highlights and announcements pertaining to this release see: Release Notes > 1.19.0.

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0

... (truncated)

1.19.0-rc.1

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0-rc.1

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0-rc.1

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0-rc.1

    • Extended key/value list attribute handling to cover additional dictionary shapes (IEnumerable<KeyValuePair<string, string?>> and IDictionary). These attributes will be serialized as JSON objects.
      (#​7679)
      ... (truncated)

1.19.0-beta.1

The following changes are from the previous release 1.18.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusAspNetCoreTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • A scrape request whose connection is aborted, or whose X-Prometheus-Scrape-Timeout-Seconds deadline elapses, now stops waiting for an in-progress metrics collection instead of continuing to wait for it to finish. The collection itself is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusHttpListenerTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • Added PrometheusHttpListenerOptions.ScrapeResponseTimeoutMilliseconds (default 60000) which bounds how long a scrape request waits for its response. X-Prometheus-Scrape-Timeout-Seconds request header values may only shorten this limit. The limit bounds the request's wait only: a metrics collection already running when it is reached is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.19.0-beta.1

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.18.0 to 1.19.1.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.19.1

For highlights and announcements pertaining to this release see: Release Notes > 1.19.1.

The following changes are from the previous release 1.19.0.

1.19.1-rc.1

The following changes are from the previous release 1.19.0.

1.19.1-beta.1

The following changes are from the previous release 1.19.0-beta.1.

1.19.0

For highlights and announcements pertaining to this release see: Release Notes > 1.19.0.

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0

... (truncated)

1.19.0-rc.1

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0-rc.1

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0-rc.1

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0-rc.1

    • Extended key/value list attribute handling to cover additional dictionary shapes (IEnumerable<KeyValuePair<string, string?>> and IDictionary). These attributes will be serialized as JSON objects.
      (#​7679)
      ... (truncated)

1.19.0-beta.1

The following changes are from the previous release 1.18.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusAspNetCoreTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • A scrape request whose connection is aborted, or whose X-Prometheus-Scrape-Timeout-Seconds deadline elapses, now stops waiting for an in-progress metrics collection instead of continuing to wait for it to finish. The collection itself is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusHttpListenerTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • Added PrometheusHttpListenerOptions.ScrapeResponseTimeoutMilliseconds (default 60000) which bounds how long a scrape request waits for its response. X-Prometheus-Scrape-Timeout-Seconds request header values may only shorten this limit. The limit bounds the request's wait only: a metrics collection already running when it is reached is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.19.0-beta.1

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.18.0 to 1.19.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.19.0

1.19.0-rc.1

1.19.0-beta.1

1.19.0-alpha.1

1.18.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.18.0 to 1.19.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.19.0

1.19.0-rc.1

1.19.0-beta.1

1.19.0-alpha.1

1.18.1

Commits viewable in compare view.

Updated Polly from 8.7.0 to 8.8.0.

Release notes

Sourced from Polly's releases.

8.8.0

Highlights

  • Add EnableReloadsWithMonitor() accepting custom IOptionsMonitor by @​arashzjahangiri in https://github....

_Descr...

Description has been truncated

@dependabot
Bump the nuget-all group with 16 updates
3676f86 
Bumps Aspire.Hosting.AppHost from 13.5.3 to 13.5.4
Bumps bunit from 2.10.3 to 2.11.3
Bumps Dapper from 2.1.79 to 2.1.89
Bumps FluentAssertions from 8.10.0 to 8.11.0
Bumps Markdig from 1.3.2 to 1.4.0
Bumps Microsoft.Extensions.Http.Resilience from 10.9.0 to 10.10.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.9.0 to 10.10.0
Bumps Microsoft.Identity.Web from 4.14.2 to 4.15.0
Bumps Microsoft.Identity.Web.UI from 4.14.2 to 4.15.0
Bumps Microsoft.Testing.Extensions.CodeCoverage from 18.11.0 to 18.11.2
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.18.0 to 1.19.1
Bumps OpenTelemetry.Extensions.Hosting from 1.18.0 to 1.19.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.18.0 to 1.19.0
Bumps OpenTelemetry.Instrumentation.Http from 1.18.0 to 1.19.0
Bumps Polly from 8.7.0 to 8.8.0
Bumps xunit.v3.mtp-v2 from 4.0.0 to 4.0.1

---
updated-dependencies:
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: bunit
  dependency-version: 2.11.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Dapper
  dependency-version: 2.1.89
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: FluentAssertions
  dependency-version: 8.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Markdig
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Identity.Web
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Identity.Web.UI
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Testing.Extensions.CodeCoverage
  dependency-version: 18.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Polly
  dependency-version: 8.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: xunit.v3.mtp-v2
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 23, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Sep 23, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rvanmaanen rvanmaanen Awaiting requested review from rvanmaanen rvanmaanen is a code owner
@rajbos rajbos Awaiting requested review from rajbos rajbos is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

0 participants