Skip to content

Bump the minor-and-patch group with 29 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Aspire/minor-and-patch-ece5e01f49
Open

Bump the minor-and-patch group with 29 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Aspire/minor-and-patch-ece5e01f49

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown

Updated Arc4u from 9.0.0-preview38 to 9.0.0.

Release notes

Sourced from Arc4u's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Aspire.Hosting.AppHost from 13.6.2 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

Commits viewable in compare view.

Updated Aspire.Hosting.MongoDB from 13.6.2 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.MongoDB's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

Commits viewable in compare view.

Updated Aspire.Hosting.RabbitMQ from 13.6.2 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.RabbitMQ's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.6.2 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)

Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

Commits viewable in compare view.

Updated CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector from 13.6.0 to 13.6.1.

Release notes

Sourced from CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector's releases.

13.6.1

Small servicing release. Main one is bumping to Aspire 13.6.4 which means we don't have the MessagePack error when building.

A few small changes on other package and container versions, as well as expanding what Floci supports.

What's Changed

New Contributors

Full Changelog: CommunityToolkit/Aspire@v13.6.0...v13.6.1

Commits viewable in compare view.

Updated Dapr.AspNetCore from 1.18.10 to 1.19.1.

Release notes

Sourced from Dapr.AspNetCore's releases.

1.19.0

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0

1.19.0-rc.6

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.6

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.4...v1.19.0-rc.6

1.19.0-rc.4

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.3...v1.19.0-rc.4

1.19.0-rc.3

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.2...v1.19.0-rc.3

1.19.0-rc.2

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.1...v1.19.0-rc.2

1.19.0-rc.1

What's Changed

Support for Dapr Runtime changes ahead of v1.19:

General Improvements

Bug Fixes

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.1

1.19.0-preview.2

Dapr.Actors.Next is a ground-up re-implementation of the Dapr Actors building block for .NET, shipping as a preview throughout the 1.18 release cycle, with a stable release planned alongside Dapr runtime v1.19. The actor model itself is unchanged: actors remain virtual, addressed by type and ID, and support reentrancy, timers, reminders, proxying, etc. However, the way the SDK connects to the runtime and the way you write actor code have been modernized.

Highlights

  • Streaming runtime connectivity
    Actor callbacks (invoke, reminder, timer, deactivate) now arrive over a long-lived bidirectional gRPC stream instead of inbound, per-call HTTP requests into mapped actor-handler endpoints. This is the same pattern already used for Dapr workflows and streaming pub/sub subscriptions. There are no actor handlers to map, though your app will still need to expose a port for inbound gRPC connections from the Dapr runtime.
  • No reflection, trim-clean and AOT-ready
    Source generators produce the proxy, dispatcher, activation factory, registration and actor registry from your interface and implementation. Actors are discovered rather than registered by hand, and the runtime packages can be used in applications building for Native AOT.
  • Compile-time safety
    The public surface is annotated for nullable reference types, and new analyzers and code fixes catch actor-specific mistakes as you type: non-serializable or non-task-returning methods, blocking calls inside a turn, state changes that would break deserialization, using a callback method in a reminder that doesn't exist in the specified type, reading time from the clock instead of an injected TimeProvider, and more!
  • Consistent with the rest of the modern Dapr .NET SDK packages
    This release features per-activation DI scopes, use of the options pattern (IOptions<DaprActorsOptions>), and the same pluggable IDaprSerializer (System.Text.Json by default) used by Dapr.StateManagement and Dapr.Workflow.
  • New capabilities
    State-envelope schema versioning with upcaster chains, a first-class StateMachineActor<TState, TData> model, pub/sub-driven actors via [Subscribe] applied to the method to call instead of requiring external startup subscription and invocation, dynamic invocation by type/id/method with no compile-time contract, and an in-memory deterministic test runtime with optional Coyote integration.

Performance
Replacing the reflection-based proxy and dispatch machinery with source generators shows up directly in the numbers. In our benchmarks, creating an actor proxy drops from roughly 725 ns and 3.4 KB allocated under Dapr.Actors to about 14 ns and 48 B under Dapr.Actors.Next: a ~50x improvement in time and ~70x in allocation. A warm actor call is about 20% faster (≈484 ns -> ≈375 ns) and allocates roughly 30% less (1,264 B -> 912 B). The largest end-to-end win is in startup: building the provider, resolving the actor runtime, and dispatching the first call takes ~284 µs under Dapr.Actors versus ~37 µs under Dapr.Actors.Next, an ~8x reduction that holds steady as the number of registered actor types grows because registration and dispatch are generated at compile time rather than discovered and emitted on first use. Container construction itself is marginally more expensive on the new SDK (~6.0 µs vs ~4.7 µs) as more is wired up front, but that cost is repaid many times over on the first invocation.

We expect further optimizations before the 1.19 GA.

Benchmarks run with BenchmarkDotNet; figures are means from a single machine and are indicative rather than a guarantee. Feel free to run them yourself from here.

Compatibility notes

  • This package requires the Dapr runtime v1.18 or later.
  • This package is not API compatible with the original Dapr.Actors. Because actors are addressed by the same type names, you can migrate one actor type at a time, but it's easier to do that across separate projects than to mix both SDKs in one.
  • Serialization is a clean break: there's a single serialization path and no built-in DataContract support (supply and register your own implementation of IDaprSerializer if you need it). Verify that existing persisted state still deserializes before migrating a type.
  • Dapr.Actors and its associated packages are now in maintenance mode and will receive security and bug fixes only. No deprecation date has been set.

Getting started
Add the package to your project:

dotnet add package Dapr.Actors.Next --prerelease

Then register it in DI with builder.Services.AddDaprActors().

Documentation is available along with a six-part tutorial spanning different implementation examples.

Please reach out in the .NET channel on Discord or file an issue if you encounter problems, have feature suggestions, or just want to share feedback about this new functionality!

Commits viewable in compare view.

Updated Grpc.AspNetCore from 2.84.0 to 2.85.0.

Release notes

Sourced from Grpc.AspNetCore's releases.

2.85.0

What's Changed

Full Changelog: grpc/grpc-dotnet@v2.84.0...v2.85.0

Commits viewable in compare view.

Updated Grpc.AspNetCore.Server.Reflection from 2.84.0 to 2.85.0.

Release notes

Sourced from Grpc.AspNetCore.Server.Reflection's releases.

2.85.0

What's Changed

Full Changelog: grpc/grpc-dotnet@v2.84.0...v2.85.0

Commits viewable in compare view.

Updated Grpc.Tools from 2.84.0 to 2.85.0.

Release notes

Sourced from Grpc.Tools's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Hangfire.Mongo from 1.16.3 to 1.17.1.

Release notes

Sourced from Hangfire.Mongo's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.OpenIdConnect from 11.0.0-rc.3.26522.148 to 11.0.0.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.OpenIdConnect's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Build.Tasks.Core from 18.10.1 to 18.12.2.

Release notes

Sourced from Microsoft.Build.Tasks.Core's releases.

18.12.2

What's Changed

18.11.0

What's Changed

Description has been truncated

Dependabo...

Description has been truncated

@dependabot
Bump the minor-and-patch group with 29 updates
e5929c2 
Bumps Arc4u from 9.0.0-preview38 to 9.0.0
Bumps Aspire.Hosting.AppHost from 13.6.2 to 13.6.5
Bumps Aspire.Hosting.MongoDB from 13.6.2 to 13.6.5
Bumps Aspire.Hosting.RabbitMQ from 13.6.2 to 13.6.5
Bumps Aspire.Hosting.Redis from 13.6.2 to 13.6.5
Bumps CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector from 13.6.0 to 13.6.1
Bumps Dapr.AspNetCore from 1.18.10 to 1.19.1
Bumps Grpc.AspNetCore from 2.84.0 to 2.85.0
Bumps Grpc.AspNetCore.Server.Reflection from 2.84.0 to 2.85.0
Bumps Grpc.Tools from 2.84.0 to 2.85.0
Bumps Hangfire.Mongo from 1.16.3 to 1.17.1
Bumps Microsoft.AspNetCore.Authentication.OpenIdConnect from 11.0.0-rc.3.26522.148 to 11.0.0
Bumps Microsoft.Build.Tasks.Core from 18.10.1 to 18.12.2
Bumps Microsoft.Extensions.Http.Resilience from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.ServiceDiscovery.Yarp from 10.10.0 to 10.11.0
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.12.0
Bumps MongoDB.Bson from 3.12.0 to 3.14.0
Bumps MongoDB.Driver to 3.13.0, 3.14.0
Bumps NSwag.AspNetCore from 14.7.1 to 14.8.0
Bumps NSwag.MSBuild from 14.7.1 to 14.8.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.19.1 to 1.21.0
Bumps OpenTelemetry.Extensions.Hosting from 1.19.1 to 1.21.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.19.0 to 1.21.0
Bumps OpenTelemetry.Instrumentation.Http from 1.19.0 to 1.21.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.19.0 to 1.21.0
Bumps SharpCompress from 0.50.4 to 0.50.9
Bumps SonarAnalyzer.CSharp from 10.35.0.4138 to 10.36.0.15337
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1

---
updated-dependencies:
- dependency-name: Arc4u
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.MongoDB
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.RabbitMQ
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Aspire.Hosting.Redis
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector
  dependency-version: 13.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Dapr.AspNetCore
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Grpc.AspNetCore
  dependency-version: 2.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Grpc.AspNetCore.Server.Reflection
  dependency-version: 2.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Grpc.Tools
  dependency-version: 2.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Hangfire.Mongo
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.Authentication.OpenIdConnect
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Build.Tasks.Core
  dependency-version: 18.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ServiceDiscovery.Yarp
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Bson
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: NSwag.AspNetCore
  dependency-version: 14.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: NSwag.MSBuild
  dependency-version: 14.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SharpCompress
  dependency-version: 0.50.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.36.0.15337
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

A single timed-out or 504 DCP Create call permanently fails the resource (FailedToStart); not retried since 13.6.0

0 participants