Skip to content

Bump the dotnet-dependencies group with 22 updates - #1357

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/backend/Menu.ApiServiceDefaults/dotnet-dependencies-228f54ef8a
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/backend/Menu.ApiServiceDefaults/dotnet-dependencies-228f54ef8a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor

Updated Aspire.Hosting.JavaScript from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.JavaScript's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)


Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)


Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Aspire.Hosting.SqlServer from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.SqlServer's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)


Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)


Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Aspire.Microsoft.EntityFrameworkCore.SqlServer from 13.6.4 to 13.6.5.

Release notes

Sourced from Aspire.Microsoft.EntityFrameworkCore.SqlServer's releases.

13.6.5

What's New in Aspire 13.6.5

Patch release for Aspire 13.6 with dashboard and CLI security hardening and .NET runtime servicing updates.

🐛 Fixes

  • 🖥️ Dashboard authentication is enforced on missing and unauthorized routes — Secured dashboards now check authorization before rendering the main layout for missing routes or denied access. In browser-token mode, unauthenticated users are redirected to login with the original route preserved. Additional authentication checks protect layout, dialog, interaction, and standalone terminal-window initialization; unsecured mode is unchanged. (#​22071, 0b6bfe2, @​jamesnk)

  • 🔒 Container telemetry no longer implicitly exposes the dashboard frontend — When the Aspire container tunnel is enabled, automatic dashboard tunneling exposes only the OTLP gRPC and HTTP endpoints. Explicit references to other dashboard endpoints remain supported, and tunneling for ordinary host-resource dependencies is unchanged. (#​22071, f017f66, @​karolz-ms)

  • 🔒 CLI-generated builds and SDK working directories are isolated — Generated AppHost server and integration builds now ignore automatic MSBuild response files without changing user-authored builds or support for explicitly supplied response files. The aspire sdk generate, aspire sdk dump, and aspire sdk export commands use isolated working directories under <ASPIRE_HOME>/tmp/sdk/<unique-id>, with owner-only Unix permissions, local configuration isolation, and cleanup when the command finishes. Normal AppHost caches are unchanged. (#​22071, 1ecd7cc, @​sebastienros)

  • 🔒 Agent setup no longer writes configuration content to a shared temporary log — aspire agent init stops writing agent configuration paths, configuration content, and scan diagnostics to aspire-deprecated-scan.log in the operating system's temporary directory. Deprecated MCP command detection, migration prompts, configuration updates, and existing structured debug logging are preserved. Previously written temporary log files are not removed by this update. (#​22071, c408ec5, @​mitchdenny)

  • 🛠️ Updated .NET runtimes and dependencies for startup reliability — Refreshes bundled runtimes and .NET servicing dependencies, including .NET 10.0.14, 9.0.22, and 8.0.33, to pick up servicing fixes relevant to Native AOT process startup. (#​21348, @​joperezr)


Full Changelog: v13.6.4...v13.6.5

Full commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.14 to 10.0.15.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.14 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.14 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.14 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ApiDescription.Server from 10.0.10 to 11.0.0.

Release notes

Sourced from Microsoft.Extensions.ApiDescription.Server's releases.

10.0.404

You can build .NET 10.0 from the repository by cloning the release tag v10.0.404 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Important

Please use https://builds.dotnet.microsoft.com/dotnet/source-build/dotnet-source-10.0.404-servicing.26529.119.tar.gz instead of the GitHub-generated sources tarball. This is due to a discrepancy in the ownership metadata. The signatures were generated from build-produced source archives with ownership normalized to UID/GID 2001:2001, while GitHub’s automatically generated archives use 0:0. The source contents are identical, but the ownership metadata changes the archive bytes, causing signature verification to fail.

10.0.403

You can build .NET 10.0 from the repository by cloning the release tag v10.0.403 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.402

You can build .NET 10.0 from the repository by cloning the release tag v10.0.402 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.401

Release

What's Changed

... (truncated)

10.0.400

You can build .NET 10.0 from the repository by cloning the release tag v10.0.400 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.303

You can build .NET 10.0 from the repository by cloning the release tag v10.0.303 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.302

You can build .NET 10.0 from the repository by cloning the release tag v10.0.302 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.301

You can build .NET 10.0 from the repository by cloning the release tag v10.0.301 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.300

You can build .NET 10.0 from the repository by cloning the release tag v10.0.300 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.204

You can build .NET 10.0 from the repository by cloning the release tag v10.0.204 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.203

You can build .NET 10.0 from the repository by cloning the release tag v10.0.203 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.202

You can build .NET 10.0 from the repository by cloning the release tag v10.0.202 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.201

You can build .NET 10.0 from the repository by cloning the release tag v10.0.201 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.200

You can build .NET 10.0 from the repository by cloning the release tag v10.0.200 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.115

You can build .NET 10.0 from the repository by cloning the release tag v10.0.115 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Important

Please use https://builds.dotnet.microsoft.com/dotnet/source-build/dotnet-source-10.0.115-servicing.26529.108.tar.gz instead of the GitHub-generated sources tarball. This is due to a discrepancy in the ownership metadata. The signature was generated from a build-produced source archive with ownership normalized to UID/GID 2001:2001, while GitHub’s automatically generated archive uses 0:0. The source contents are identical, but the ownership metadata changes the archive bytes, causing signature verification to fail.

10.0.114

You can build .NET 10.0 from the repository by cloning the release tag v10.0.114 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Important

Please use https://builds.dotnet.microsoft.com/dotnet/source-build/dotnet-source-10.0.114-servicing.26522.126.tar.gz instead of the GitHub-generated sources tarball. This is due to a discrepancy in the ownership metadata. The signatures were generated from build-produced source archives with ownership normalized to UID/GID 2001:2001, while GitHub’s automatically generated archives use 0:0. The source contents are identical, but the ownership metadata changes the archive bytes, causing signature verification to fail.

10.0.113

You can build .NET 10.0 from the repository by cloning the release tag v10.0.113 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.112

You can build .NET 10.0 from the repository by cloning the release tag v10.0.112 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.111

You can build .NET 10.0 from the repository by cloning the release tag v10.0.111 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.110

You can build .NET 10.0 from the repository by cloning the release tag v10.0.110 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.109

You can build .NET 10.0 from the repository by cloning the release tag v10.0.109 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.108

You can build .NET 10.0 from the repository by cloning the release tag v10.0.108 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.107

You can build .NET 10.0 from the repository by cloning the release tag v10.0.107 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.106

You can build .NET 10.0 from the repository by cloning the release tag v10.0.106 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.105

You can build .NET 10.0 from the repository by cloning the release tag v10.0.105 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.104

You can build .NET 10.0 from the repository by cloning the release tag v10.0.104 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.103

You can build .NET 10.0 from the repository by cloning the release tag v10.0.103 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached is the PGP signature for the GitHub generated tarball. You can find the public key at https://dot.net/release-key-2023

10.0.102-sb1

You can build .NET 10.0 from the repository by cloning the release tag v10.0.102-sb1 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.101

You can build .NET 10.0 from the repository by cloning the release tag v10.0.101 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.100

You can build .NET 10.0 from the repository by cloning the release tag v10.0.100 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

To produce artifacts with the .NET 10 GA version strings, users must pass the branding argument to the build: --branding rtm.

10.0.100-rc.2.25502.107

You can build .NET 10.0 RC 2 from the repository by cloning the release tag v10.0.100-rc.2.25502.107 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Note: GitHub automatically generates the "Source code (tar.gz/zip)" archives included in this release. Please download the official source code from:

10.0.100-rc.1.25451.107

You can build .NET 10.0 RC 1 from the repository by cloning the release tag v10.0.100-rc.1.25451.107 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.100-preview.7.25380.108

You can build .NET 10.0 Preview 7 from the repository by cloning the release tag v10.0.100-preview.7.25380.108 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Resilience from 10.11.0 to 11.0.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

11.0.0

Version 11.0.0 ships alongside .NET 11 and with net11 targets added to packages. Highlights of this release include new experimental Documents and Document Extraction abstractions, metric instrument descriptions, and a sliding-window retry budget for HTTP resilience.

Experimental API Changes

Now Stable

  • HTTP server latency telemetry (AddHttpServerLatencyTelemetry) APIs are now stable (previously EXTEXP0013) #​7898

New Experimental APIs

  • New experimental API: Documents abstractions in the new Microsoft.Extensions.Documents.Abstractions package (EXTEXP0019) #​7835
  • New experimental API: Document Extraction in the new Microsoft.Extensions.DocumentExtraction and Microsoft.Extensions.DocumentExtraction.Abstractions packages (MEDE0001) #​7588
  • New experimental API: HTTP resilience retry budget (HttpRetryBudgetOptions, HttpRetryResiliencePipelineBuilderExtensions, OnRetryBudgetExhaustedArguments) (EXTEXP0001) #​7867
  • New experimental API: Description on metric attributes (EXTEXP0003) #​7837

Obsoleted APIs

  • HybridCacheOptions.DisableCompression is now obsolete (EXTOBS0003) #​7885

What's Changed

Telemetry and Logging

  • Add Description to metric attributes and describe all instruments #​7837 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Capture trace context, thread ID and message template in buffered logs #​7818 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Allow bool and numeric types for strongly-typed metric tags #​7877 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix route parameter redaction when a parameter value contains a delimiter used later in the same path segment #​7828 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix lost log records when logging reentrantly on the same thread #​7847 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix logging generator stack overflow on type cycles #​7861 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Honor [LogPropertyIgnore] during transitive logging and [LogProperties(Transitive = true)] on properties #​7868 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Make DataClassificationSet static to decrease allocations #​7874 by @​evgenyfedorov2 (co-authored by @​Copilot)

Caching

  • Add HybridCache.GetOrCreateAsync overloads for dynamic setting of options #​7568 by @​svick (co-authored by @​Copilot)
  • Mark HybridCacheOptions.DisableCompression as obsolete #​7885 by @​slang25
  • Fix HybridCache stampede state removal race #​7814 by @​svick (co-authored by @​Copilot)
  • Fix HybridCache reservation over-release on DisableUnderlyingData miss #​7879 by @​Eng3bbas

AI

  • AI: Restore neutral tool approval rejection message #​7913 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGenerationOptions.Clone dropping StreamingCount #​7829 by @​Empiree
  • Fix evaluation context serialization without reflection fallback #​7869 by @​valkiara
  • Pin MessagePack 2.5.307 in AI template AppHost project #​7853 by @​evgenyfedorov2 (co-authored by @​Copilot)

Packaging and Target Frameworks

  • Condition framework-provided package references for .NET 11 #​7915 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery from 10.11.0 to 11.0.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery's releases.

11.0.0

Version 11.0.0 ships alongside .NET 11 and with net11 targets added to packages. Highlights of this release include new experimental Documents and Document Extraction abstractions, metric instrument descriptions, and a sliding-window retry budget for HTTP resilience.

Experimental API Changes

Now Stable

  • HTTP server latency telemetry (AddHttpServerLatencyTelemetry) APIs are now stable (previously EXTEXP0013) #​7898

New Experimental APIs

  • New experimental API: Documents abstractions in the new Microsoft.Extensions.Documents.Abstractions package (EXTEXP0019) #​7835
  • New experimental API: Document Extraction in the new Microsoft.Extensions.DocumentExtraction and Microsoft.Extensions.DocumentExtraction.Abstractions packages (MEDE0001) #​7588
  • New experimental API: HTTP resilience retry budget (HttpRetryBudgetOptions, HttpRetryResiliencePipelineBuilderExtensions, OnRetryBudgetExhaustedArguments) (EXTEXP0001) #​7867
  • New experimental API: Description on metric attributes (EXTEXP0003) #​7837

Obsoleted APIs

  • HybridCacheOptions.DisableCompression is now obsolete (EXTOBS0003) #​7885

What's Changed

Telemetry and Logging

  • Add Description to metric attributes and describe all instruments #​7837 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Capture trace context, thread ID and message template in buffered logs #​7818 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Allow bool and numeric types for strongly-typed metric tags #​7877 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix route parameter redaction when a parameter value contains a delimiter used later in the same path segment #​7828 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix lost log records when logging reentrantly on the same thread #​7847 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix logging generator stack overflow on type cycles #​7861 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Honor [LogPropertyIgnore] during transitive logging and [LogProperties(Transitive = true)] on properties #​7868 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Make DataClassificationSet static to decrease allocations #​7874 by @​evgenyfedorov2 (co-authored by @​Copilot)

Caching

  • Add HybridCache.GetOrCreateAsync overloads for dynamic setting of options #​7568 by @​svick (co-authored by @​Copilot)
  • Mark HybridCacheOptions.DisableCompression as obsolete #​7885 by @​slang25
  • Fix HybridCache stampede state removal race #​7814 by @​svick (co-authored by @​Copilot)
  • Fix HybridCache reservation over-release on DisableUnderlyingData miss #​7879 by @​Eng3bbas

AI

  • AI: Restore neutral tool approval rejection message #​7913 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGenerationOptions.Clone dropping StreamingCount #​7829 by @​Empiree
  • Fix evaluation context serialization without reflection fallback #​7869 by @​valkiara
  • Pin MessagePack 2.5.307 in AI template AppHost project #​7853 by @​evgenyfedorov2 (co-authored by @​Copilot)

Packaging and Target Frameworks

  • Condition framework-provided package references for .NET 11 #​7915 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Testing.Platform from 2.5.1 to 2.5.3.

Release notes

Sourced from Microsoft.Testing.Platform's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Testing.Platform from 2.5.2 to 2.5.3.

Release notes

Sourced from Microsoft.Testing.Platform's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.20.1 to 1.21.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.21.0

For highlights and announcements pertaining to this release see: Release Notes > 1.21.0.

The following changes are from the previous release 1.21.0-rc.2.

1.21.0-rc.2

The following changes are from the previous release 1.21.0-rc.1.

  • NuGet: OpenTelemetry v1.21.0-rc.2

    • Fixed an exception when downscaling empty exponential histogram buckets after
      a reset.
      (#​8064)

    • Fixed tracing callbacks continuing after provider shutdown or disposal on older
      target frameworks.
      (#​8065)

    • Fixed initialization failures when environment variable access is denied.
      Configuration reloads retain the last successful values when access is denied.
      (#​8070)

    • Fixed a source, meter or legacy activity name with a trailing line feed
      matching a wildcard pattern which does not end in a wildcard.
      (#​8074)

    • Fixed OTEL_RESOURCE_ATTRIBUTES values being decoded as form data, which
      changed a + to a space. Values are now only percent-decoded, as defined by
      the Resource SDK specification.
      (#​8074)

    • Updated the schema URL of resources created by the SDK to use OpenTelemetry
      Semantic Conventions version 1.45.0.
      (#​8079)

    • Added support for batching the metric points exported by
      PeriodicExportingMetricReader. When a maximum export batch size is set,
      using the new constructor overload or
      PeriodicExportingMetricReaderOptions.MaxExportBatchSize, the metric
      points of each collection are split into batches of at most that many
      metric points, even if that splits up the metric points of a single
      metric. The batches are exported serially with the export timeout
      applying to each export. It can also be configured with the
      OTEL_METRIC_EXPORT_MAX_BATCH_SIZE environment variable.
      (#​8053)

    • Fixed PeriodicExportingMetricReader exporting a collection which was still
      in progress when Shutdown() timed out to its exporter after the exporter
      had been shut down.
      (#​8053)

    • Fixed PeriodicExportingMetricReader not making its final collection when
      Shutdown() was called before its background task had started running on
      platforms where threading is not available, such as browsers.
      (#​8053)

... (truncated)

1.21.0-rc.1

The following changes are from the previous release [1.20.1](https:/...

_Description has been tru...

Description has been truncated

Bumps Aspire.Hosting.JavaScript from 13.6.4 to 13.6.5
Bumps Aspire.Hosting.Redis from 13.6.4 to 13.6.5
Bumps Aspire.Hosting.SqlServer from 13.6.4 to 13.6.5
Bumps Aspire.Hosting.Testing from 13.6.4 to 13.6.5
Bumps Aspire.Microsoft.EntityFrameworkCore.SqlServer from 13.6.4 to 13.6.5
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.14 to 10.0.15
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.14 to 10.0.15
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.14 to 10.0.15
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.14 to 10.0.15
Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.10 to 11.0.0
Bumps Microsoft.Extensions.Http.Resilience from 10.11.0 to 11.0.0
Bumps Microsoft.Extensions.ServiceDiscovery from 10.11.0 to 11.0.0
Bumps Microsoft.Testing.Platform to 2.5.3
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.20.1 to 1.21.0
Bumps OpenTelemetry.Extensions.Hosting from 1.20.1 to 1.21.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.20.2 to 1.21.0
Bumps OpenTelemetry.Instrumentation.Http from 1.20.2 to 1.21.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.20.1 to 1.21.0
Bumps OwaspHeaders.Core from 10.5.1 to 11.0.0
Bumps Swashbuckle.AspNetCore from 10.3.1 to 11.0.1
Bumps System.Security.Cryptography.Pkcs to 10.0.14, 11.0.0
Bumps xunit.v3.mtp-v2 from 4.0.2 to 4.0.3

---
updated-dependencies:
- dependency-name: Aspire.Hosting.JavaScript
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Aspire.Hosting.Redis
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Aspire.Hosting.SqlServer
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 13.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Extensions.ApiDescription.Server
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Testing.Platform
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Testing.Platform
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Testing.Platform
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: OwaspHeaders.Core
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: Swashbuckle.AspNetCore
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: xunit.v3.mtp-v2
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: xunit.v3.mtp-v2
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: xunit.v3.mtp-v2
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Nov 13, 2026
@sonarqubecloud

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor

Test coverage

No coverage report was produced for this run. Tests may have been skipped or stopped early.

View the test run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants