Bump the routine-minor-patch group with 5 updates

[dependabot]

Summary

Updates five routine dependencies across Parts 2, 3, and 8:

• Microsoft.Agents.AI from 1.15.0 to 1.20.0
• Microsoft.Extensions.AI and Microsoft.Extensions.AI.OpenAI from 10.8.1 to 10.9.0
• Microsoft.Extensions.Configuration.UserSecrets and Microsoft.Extensions.Logging.Console from 10.0.10 to 10.0.11

Microsoft.Bcl.Memory remains pinned at 10.0.10 and SQLitePCLRaw.bundle_e_sqlite3 remains pinned at 3.0.4 as documented security overrides. Their updates were removed from this routine group and should be evaluated separately under the dependency policy.

Validation

• All five affected projects build in Release with zero warnings
• The Part 3 MEDI checkpoint dependency graph reports no known vulnerabilities
• git diff --check passes
• Repository CI and CLA checks pass

This Dependabot PR was repaired in commit e5fa0a1 to keep protected dependency updates isolated from routine updates.

[jongalloway]

Repair applied in e5fa0a1: removed the Microsoft.Bcl.Memory 10.0.11 and SQLitePCLRaw.bundle_e_sqlite3 3.0.5 updates from this routine group and retained the documented security overrides. All five affected projects build in Release with zero warnings, git diff --check passes, and the MEDI checkpoint dependency graph reports no known vulnerabilities.

[Copilot]

🟡 Changes recommended

The PR description lists protected dependency updates that are not present in the actual changes, which needs to be corrected before the update can be validated and approved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This Dependabot PR updates routine minor/patch NuGet dependencies used by the workshop snapshots in Parts 2, 3 (including checkpoint verification projects), and 8 to keep the exercises current and buildable on the .NET 10 baseline.

Changes:

• Bumped Microsoft.Agents.AI from 1.15.0 to 1.20.0 (Part 8 AgentApp).
• Bumped Microsoft.Extensions.AI and Microsoft.Extensions.AI.OpenAI from 10.8.1 to 10.9.0 (Parts 2/3/8 snapshots).
• Bumped .NET 10 patch packages (Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Logging.Console) from 10.0.10 to 10.0.11 where referenced.

Dependency Update Disposition (policy-based)

Disposition: repair

Scope (packages + workshop parts):

• Packages updated: Microsoft.Agents.AI, Microsoft.Extensions.AI, Microsoft.Extensions.AI.OpenAI, Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Logging.Console
• Parts / projects touched: Part 02 (ChatApp), Part 03 (RagChatApp + verify checkpoints), Part 08 (AgentApp)

Classification (per DEPENDENCY_POLICY.md):

Package / Set	Old → New	Classification	Notes
Microsoft.Agents.AI	1.15.0 → 1.20.0	routine update	Minor update within workshop snapshot scope.
Microsoft.Extensions.AI	10.8.1 → 10.9.0	routine update	Minor update; may introduce new APIs but expected additive.
Microsoft.Extensions.AI.OpenAI	10.8.1 → 10.9.0	routine update	Minor update; watch for transitive dependency constraints.
Microsoft.Extensions.Configuration.UserSecrets	10.0.10 → 10.0.11	routine update	Patch-level runtime package.
Microsoft.Extensions.Logging.Console	10.0.10 → 10.0.11	routine update	Patch-level runtime package.

Findings (blockers/risks):

• Blocker: The PR description claims additional updates (notably Microsoft.Bcl.Memory and SQLitePCLRaw.bundle_e_sqlite3), but those pins are not updated in the repo state (and are protected/security-related per policy). This mismatch needs to be resolved to avoid incorrect review/validation expectations.

Validation (run status):

• Not run in this review (recommended commands below).

Required action (smallest next step):

• Fix the PR description to reflect only the dependencies actually updated or include the missing protected-pin updates as a separate, policy-compliant change; then run dotnet restore + dotnet build -c Release --no-restore for each touched project (and dotnet list package --vulnerable --include-transitive at least for Part 3 checkpoints).

File summaries

File	Description
Part 08 - Agent Framework Basics/AgentApp/AgentApp.csproj	Updates Agent Framework + Extensions.AI package versions for Part 8 snapshot.
Part 03 - Add RAG/RagChatApp/RagChatApp.csproj	Updates Extensions.AI + patch runtime packages for Part 3 app snapshot.
Part 03 - Add RAG/checkpoints/verify/MediCheckpoint/MediCheckpoint.csproj	Updates Extensions.AI + patch runtime packages for Part 3 MEDI compile-only checkpoint.
Part 03 - Add RAG/checkpoints/verify/ManualCheckpoint/ManualCheckpoint.csproj	Updates Extensions.AI + patch runtime packages for Part 3 manual compile-only checkpoint.
Part 02 - Build Chat App/ChatApp/ChatApp.csproj	Updates Extensions.AI + patch runtime packages for Part 2 snapshot.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.