Skip to content

deps: Bump the dotnet group with 14 updates - #100

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/dotnet-48892ddc92
Open

deps: Bump the dotnet group with 14 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/dotnet-48892ddc92

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Updated Aspire.Hosting from 13.5.4 to 13.6.4.

Release notes

Sourced from Aspire.Hosting's releases.

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

13.6.1

What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during sustained metric ingestion, restores scrolling in the Metrics tree, improves dashboard navigation, fixes container exec watch failures, and ensures session-scoped containers are cleaned up when stopping .NET AppHosts on Windows.

🐛 Fixes

  • 📊 Dashboard CPU usage could increase during long-running metric ingestion — Metric retention repeatedly scanned retained history on every insertion, causing steadily increasing CPU usage even with a fixed workload. Cleanup now skips dimensions below capacity and removes only the oldest surplus points when needed. Existing retention limits and exemplar behavior are unchanged, and no configuration changes are required. Regression introduced in 13.6. Fixes #​20725. (#​20747, backport of #​20736, @​JamesNK)

  • 📈 The Metrics tree could not be scrolled — The meter and instrument tree now scrolls when it exceeds the viewport, allowing you to reach and select instruments below the fold. Regression introduced in 13.6. Fixes #​20728. (#​20762, backport of #​20758, @​heyysiri)

  • 🧭 Dashboard navigation could fail after a browser disconnect — Pending page-state updates now persist session state before navigating and skip navigation when the browser has disconnected, avoiding an unhandled navigation failure. The navigation rail's overflow button also has consistent sizing, icon alignment, and hover styling in expanded and collapsed layouts and both light and dark themes. (#​20545, backport of #​20527, @​JamesNK)

  • 🖥️ Container exec watches could terminate shortly after AppHost startup — A stalled DCP watch connection could produce a critical Watch task over Kubernetes ContainerExec resources terminated unexpectedly error and stop subsequent terminal state and log updates from being observed. Watch connection attempts now retry after timeouts, and periodic restarts correctly recreate connections without swallowing unrelated cancellation. Regression introduced in 13.6.0. (#​20664, backport of #​20466, @​radical)

  • 🪟 Session-scoped containers could remain running after stopping a .NET AppHost on Windows — AppHosts launched through dotnet run or dotnet watch now allow DCP to finish resource cleanup during shutdown, including existing Ctrl+C and aspire stop flows. Persistent resources remain unaffected, while direct .NET launches and TypeScript/polyglot AppHosts retain their existing process protection. Fixes #​20495. (#​20514, backport of #​20494, @​danegsta)

Full Changelog: v13.6.0...v13.6.1

Full commit: 3751e615ad660621f2a7aa4c390ef48e08a0eed8

13.6.0

Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more interactive dashboard, first-party Java and Rust hosting, and new Azure deployment options. Coordinated .NET builds, portable volume paths, sharper CLI workflows, and more capable editor tooling make it easier to build, debug, and deploy applications across languages.

Highlights

  • 🗃️ Persistent, refreshed dashboard — SQLite-backed telemetry and resource snapshots let you revisit up to ten application runs, with read-only access to completed runs and default retention limits of 100,000 console log messages, structured logs, and traces each. The dashboard now ships as Native AOT and adopts Fluent UI v5 with a collapsible navigation rail.
  • 🖥️ AppHost-owned terminals and database REPLs — Experimental terminal APIs let AppHosts create interactive sessions in a dashboard dock, dialog, or separate window. Opt-in WithRepl() commands open bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and Valkey, while aspire terminal ps and aspire terminal tape play support discovery and repeatable terminal interactions.
  • 🌐 First-party Java and Rust hosting — New Aspire.Hosting.Java and Aspire.Hosting.Rust packages bring Maven, Gradle, Spring Boot, Quarkus, and Cargo applications into the app model, with generated container builds and VS Code debugging. These integrations build on work that originated in the Aspire Community Toolkit.
  • 🛠️ More flexible AppHosts — The prerelease Aspire.Hosting.Dotnet integration coordinates compatible projects into shared restore and build groups and supports .NET SDK container publishing. Portable volume-path environment variables work across local execution and deployment, while TypeScript AppHosts gain standard appsettings.json configuration and Deno runtime support.
  • ⌨️ Sharper CLI workflows — Select launch profiles with aspire run and aspire start, update repository-local CLI manifests with aspire update, create file-based C# AppHosts with aspire init --language csharp --file-based, and export TypeScript API data with aspire sdk export. Terminal commands no longer need a feature flag, Linux certificate trust includes Firefox NSS databases, and aspire stop --force --volumes adds explicit cleanup of Aspire-owned volumes.
  • 💻 More capable VS Code tooling — Coding agents can start and stop AppHosts through the extension, and the Aspire pane exposes deploy, publish, and pipeline actions. Multi-root discovery, worktree-scoped lifecycle operations, preserved launch arguments, clearer debug logs, and missing-debugger guidance make complex workspaces more predictable.
  • ☁️ New Azure options in preview — Azure Connector Namespace models external-service connections and managed MCP server configurations. Azure Container Apps Sandboxes adds isolated sandbox deployments with configurable resource tiers and lifecycle policies, while Azure Container Apps Express offers a simplified environment option for rapid provisioning.
  • ☸️ More expressive, reliable deployments — Experimental Azure Provisioning SDK proxies let polyglot AppHosts customize infrastructure. Deployment state is isolated under ASPIRE_HOME, Kubernetes preserves inherited hostnames and embedded parameter values, and AKS gains persistent-volume provisioning and more reliable cleanup.
  • 🔌 Expanded integrations — Experimental Deno hosting and MongoDB replica sets join Foundry Toolboxes, remote Foundry Local endpoints, Blazor WebAssembly debugging, and configurable Dev Tunnel expiration. Azure Cosmos DB and AI Inference client integrations gain health checks, and the vNext Cosmos DB emulator sends its own telemetry to the dashboard.

⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a certificate is available, the Linux-based vNext Cosmos DB emulator becoming the default, new Azure Front Door origin names that can require cleanup of existing origins, portable connection-string environment-variable aliases on stricter deployment targets, and experimental terminal types moving from Aspire.Hosting.Terminals to Aspire.Hosting.ApplicationModel.

See the full list and migration guidance in the Aspire 13.6 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.6.

Thank you to all the community contributors who helped make Aspire 13.6 possible! 💜

Full Changelog: v13.5.4...v13.6.0

Full commit: 56f3e9c0d216c0c7069dabb49dd0464e4827744f

Commits viewable in compare view.

Updated Azure.Security.KeyVault.Secrets from 4.11.1 to 4.11.2.

Release notes

Sourced from Azure.Security.KeyVault.Secrets's releases.

4.11.2

4.11.2 (2026-10-02)

Bugs Fixed

  • Fixed handling of claims challenges when the authentication challenge cache is empty or cleared while a request is in flight.
  • Fixed an issue in the challenge-based authentication policy where a cached authentication challenge accepted with challenge resource verification disabled could be reused by a separate default-strict client without revalidating the challenge resource.
  • Improved authentication challenge resource validation.

Commits viewable in compare view.

Updated HotChocolate.AspNetCore from 16.6.6 to 16.6.9.

Release notes

Sourced from HotChocolate.AspNetCore's releases.

16.6.9

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.8...16.6.9

16.6.8

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.7...16.6.8

16.6.7

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.6...16.6.7

Commits viewable in compare view.

Updated HotChocolate.Subscriptions.InMemory from 16.6.6 to 16.6.9.

Release notes

Sourced from HotChocolate.Subscriptions.InMemory's releases.

16.6.9

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.8...16.6.9

16.6.8

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.7...16.6.8

16.6.7

What's Changed

Full Changelog: ChilliCream/graphql-platform@16.6.6...16.6.7

Commits viewable in compare view.

Updated Markdig from 1.3.2 to 1.5.0.

Release notes

Sourced from Markdig's releases.

1.5.0

Changes

🐛 Bug Fixes

  • Keep Unicode whitespace other than spaces and tabs when trimming paragraphs, headings and info strings (PR #​966) by @​HuzaifaChaudary
  • Add relative file links extension (#​897) (PR #​968) by @​StefanGreve
  • Don't treat an escaped backslash as the start of another escape in HtmlHelper.Unescape (PR #​967) by @​HuzaifaChaudary
  • Fix unescaped source URL in media links (PR #​969) by @​StefanGreve

Full Changelog: 1.4.2...1.5.0

Published with dotnet-releaser

1.4.2

Changes

✨ New Features

  • Add IsAotCompatible for net8.0 and later targets (PR #​963) by @​StefanGreve

🐛 Bug Fixes

  • Fix setext heading line breaks and indented lazy quote lines (PR #​964) by @​wahidrizka
  • Fix setext underlines in block quotes and list items (PR #​965) by @​wahidrizka
  • Fix FindClosestBlock/FindBlockAtPosition with definition groups (#​677) (PR #​962) by @​ybai08

Full Changelog: 1.4.1...1.4.2

Published with dotnet-releaser

1.4.1

Changes

🐛 Bug Fixes

  • Fix definition list continuation consuming leading markers (PR #​957) by @​SparkUiX
  • Fix grid table open last cell taking a | from the next line (#​494) (PR #​958) by @​dualfroz
  • Fix HTML blocks not ending at a line with only spaces or tabs (PR #​960) by @​wahidrizka
  • Fix empty list items being parsed as text after a paragraph (PR #​961) by @​wahidrizka
  • Fix definition lists requiring 3 spaces after the marker (PR #​959) by @​dualfroz
  • Fix CommonMark HTML block start character classes (d5462ae5)
  • Fix CommonMark closing-tag block starts and whitespace (05e638f9)
  • Fix empty list items with trailing marker whitespace (2fec2085)
  • Fix CommonMark inline HTML declarations (d33c703d)
  • Fix definition paragraphs inside tight lists (a998839f)
  • Fix concurrent spec generation in parallel builds (ccb9d859)

📚 Documentation

  • Update doc for definition-list continuation rules (b58e83b4)

Full Changelog: 1.4.0...1.4.1

Published with dotnet-releaser

1.4.0

Changes

✨ New Features

  • Add strict GFM pipe table parsing mode (14cd25c7)

🐛 Bug Fixes

  • Fix heading auto-link hijacking nested link labels (#​668) (PR #​949) by @​dualfroz
  • Fix: keep trailing content out of an unmatched emphasis closer (#​743) (PR #​950) by @​dualfroz
  • Fix indent on first list item (#​482) (PR #​953) by @​boxofyellow
  • Add Normalization Support for PipeTables (GFM) (PR #​954) by @​boxofyellow
  • Fix partially empty pipe table separator regression (PR #​955) by @​vicancy
  • Reject emoji-parsing if the slice ends with ** (PR #​947) by @​bstordrup
  • Fix strict GFM tables against native cmark-gfm (86866b91)

🚀 Enhancements

  • Update 3rd party extensions (PR #​945) by @​Kryptos-FR

🏭 Tests

  • Fix tests warnings (96b024c2)

📦 Dependencies

  • Bump deps (c6b186b4)

🧰 Misc

  • Use NuGet Trusted Publishing via dotnet-releaser (56e9c238)

Full Changelog: 1.3.2...1.4.0

Published with dotnet-releaser

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Updated Microsoft.OpenApi from 3.10.2 to 3.11.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.11.0

3.11.0 (2026-10-19)

Features

  • document: add GetOperationById to search operations across path… (#​3025) (1dae1ff)

Bug Fixes

  • components-key validation timeouts under load (#​3108) (01d4729)
  • openapi: omit null response descriptions (afd4967)
  • serialization: potential infinite loop when inlining references (c6ef130)
  • serialization: references inlining (#​3124) (c6ef130)

Commits viewable in compare view.

Updated Microsoft.OpenApi.YamlReader from 3.10.2 to 3.11.0.

Release notes

Sourced from Microsoft.OpenApi.YamlReader's releases.

3.11.0

3.11.0 (2026-10-19)

Features

  • document: add GetOperationById to search operations across path… (#​3025) (1dae1ff)

Bug Fixes

  • components-key validation timeouts under load (#​3108) (01d4729)
  • openapi: omit null response descriptions (afd4967)
  • serialization: potential infinite loop when inlining references (c6ef130)
  • serialization: references inlining (#​3124) (c6ef130)

Commits viewable in compare view.

Updated ModelContextProtocol from 2.2.0 to 2.3.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.3.0

This release improves HTTP discovery, OAuth, protocol interoperability, and shutdown reliability, preserves registration order for server primitives, and exposes a TimeProvider for deterministic client timeout tests. It also corrects optional server-identity handling; applications reading McpClient.ServerInfo should adopt nullable handling.

Breaking Changes

Refer to the C# SDK Versioning documentation for details on versioning and breaking change policies.

  1. McpClient.ServerInfo is nullable — #​1903
    • Its return annotation changes from Implementation to Implementation?. Existing non-nullable assignments or dereferences can produce nullable warnings and fail warnings-as-errors builds.
    • On 2026-07-28 connections, ServerInfo is null when the server omits optional identity metadata from server/discover. Legacy initialize still requires serverInfo. Reading the property before connecting still throws InvalidOperationException.
    • Migrate with a null check or a fallback such as client.ServerInfo?.Name ?? "Unknown server". Self-reported identity must not be used for security decisions.
    • This corrective source-compatibility change is intentionally included in 2.3.0.

What's Changed

  • Correct protocol-version telemetry for stateless server spans #​1810 by @​luisangelrod
  • Preserve HTTP errors and correct discovery fallback handling #​1791 by @​PranavSenthilnathan (co-authored by @​Copilot)
  • Make modern Streamable HTTP status mapping deterministic #​1837 by @​jstar0
    • Modern responses wait for the first protocol message before sending headers; long-running silent handlers may need progress output or an appropriate HTTP timeout. Legacy eager-header behavior is preserved.
  • Accept opaque legacy metadata and correct request-scoped capabilities and discovery advertisement #​1852 by @​halter73 (co-authored by @​Copilot)
  • Avoid redundant SSE fallback after discovery is rejected with 400 or 404 #​1855 by @​scottt732
  • Close server stdin before waiting for graceful stdio process exit #​1838 by @​luisangelrod
  • Preserve insertion order when listing server tools, prompts, and resources #​1924 by @​PederHP (co-authored by Claude Opus 5.5)
  • Allow missing optional server identity in discovery and make ServerInfo nullable #​1903 by @​Coding-Professional
  • Include JSON parse details in Streamable HTTP 400 responses #​1844 by @​ump45nose
  • Exclude OAuth from DiscoverProbeTimeout, expose McpClientOptions.TimeProvider for deterministic timeout tests, and default SSE to legacy initialization #​1719 by @​halter73 (co-authored by @​Copilot)
    • OAuth remains subject to the overall InitializationTimeout and caller cancellation; it is excluded only from the short discovery-probe budget.
    • Modern discovery over SSE requires both explicit HttpTransportMode.Sse and ProtocolVersion = "2026-07-28"; pinning the version with AutoDetect is not equivalent.
  • Preserve numeric progress tokens in RequestOptions serialization #​1832 by @​dfedoryshchev
  • Dispose legacy SSE POST responses to release connections deterministically #​1841 by @​yalcinfu22 (co-authored by Claude Fable 5)

Documentation Updates

  • Document standing support for new MCP specification revisions #​1826 by @​halter73 (co-authored by @​Copilot)

Test Improvements

  • Stabilize discovery-capable test connections while retaining initialization deadlines #​1943 by @​tarekgh

Repository Infrastructure Updates

  • Add a source selector for manual documentation publishes #​1828 by @​jeffhandley (co-authored by @​Copilot)
  • Update SourceLink's private build dependency to resolve a vulnerable Git dependency #​1873 by @​halter73 (co-authored by @​Copilot)
  • Correct obsolete McpServerFactory references in Copilot instructions #​1892 by @​Zir0-93
  • Update Microsoft.Extensions.AI and AI.Abstractions to 10.11.0 and align shared System dependencies to 10.0.13 #​1940

Acknowledgements

  • @​scottt732 made their first contribution in #​1855
  • @​Zir0-93 made their first contribution in #​1892
  • @​Coding-Professional made their first contribution in #​1903
    ... (truncated)

Commits viewable in compare view.

Updated OpenIddict.AspNetCore from 7.7.1 to 7.7.2.

Release notes

Sourced from OpenIddict.AspNetCore's releases.

7.7.2

This release introduces the following changes:

  • The Quartz.NET integration now uses ConfigureAllQuartzSchedulers() instead of AddQuartz() on .NET 10+ to ensure options previously configured by the user are not overwritten by OpenIddict when registering the pruning job (thanks @​gabrielkim13! ❤️)

  • The Discord web provider was updated to use server configuration discovery, which allows the OpenIddict client to dynamically determine whether the iss parameter is allowed in the authorization responses returned by Discord (thanks @​StellaAlexis! ❤️)

Commits viewable in compare view.

Updated OpenIddict.EntityFrameworkCore from 7.7.1 to 7.7.2.

Release notes

Sourced from OpenIddict.EntityFrameworkCore's releases.

7.7.2

This release introduces the following changes:

  • The Quartz.NET integration now uses ConfigureAllQuartzSchedulers() instead of AddQuartz() on .NET 10+ to ensure options previously configured by the user are not overwritten by OpenIddict when registering the pruning job (thanks @​gabrielkim13! ❤️)

  • The Discord web provider was updated to use server configuration discovery, which allows the OpenIddict client to dynamically determine whether the iss parameter is allowed in the authorization responses returned by Discord (thanks @​StellaAlexis! ❤️)

Commits viewable in compare view.

Updated Spectre.Console.Cli from 0.55.0 to 0.57.2.

Release notes

Sourced from Spectre.Console.Cli's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated tap.studio.cli from 0.7.7 to 0.7.8.

Release notes

Sourced from tap.studio.cli's releases.

0.7.8

Downloads

Tap Studio — the desktop workbench.

Platform File
macOS (Apple silicon) Tap.Studio_0.7.8_aarch64.dmg
Windows (installer) Tap.Studio_0.7.8_x64-setup.exe
Windows (MSI) Tap.Studio_0.7.8_x64_en-US.msi
Linux (Debian/Ubuntu) Tap.Studio_0.7.8_amd64.deb

Tap Tunnels — the tap inspector CLI.

Platform File
macOS (Apple silicon) tap-0.7.8-osx-arm64.tar.gz
macOS (Intel) tap-0.7.8-osx-x64.tar.gz
Linux (x64) tap-0.7.8-linux-x64.tar.gz
Linux (arm64) tap-0.7.8-linux-arm64.tar.gz
Windows dotnet tool install -g Tap

Checksums for the CLI archives are in SHA256SUMS.

A small Studio release: a place to manage workspaces, two fixes, and a round of dependency
updates.

Manage workspaces

The workspace switcher gains a Manage workspaces… entry at the bottom. It opens a
Workspaces tab listing every workspace Studio knows about:

Column
Name The manifest name, with Active and Missing badges
Path The full folder path
Git Branch and origin remote, linked to the repository in the browser

Each row can be opened (switch to it), edited (switch, then open its manifest), or
removed. Removing only forgets the entry — the folder and its files stay on disk, and you
can add it back any time. The active workspace cannot be removed; switch away first.

The tab stays open across a workspace switch, so it works as a hub for hopping between
projects. When an Aspire AppHost pins the workspace, the entry is hidden and the tab's
actions are disabled, as the switcher itself already is.

Fixes

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the dotnet group with 14 updates
9bd21fe 
Bumps Aspire.Hosting from 13.5.4 to 13.6.4
Bumps Azure.Security.KeyVault.Secrets from 4.11.1 to 4.11.2
Bumps HotChocolate.AspNetCore from 16.6.6 to 16.6.9
Bumps HotChocolate.Subscriptions.InMemory from 16.6.6 to 16.6.9
Bumps Markdig from 1.3.2 to 1.5.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.12 to 10.0.13
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps Microsoft.OpenApi from 3.10.2 to 3.11.0
Bumps Microsoft.OpenApi.YamlReader from 3.10.2 to 3.11.0
Bumps ModelContextProtocol from 2.2.0 to 2.3.0
Bumps OpenIddict.AspNetCore from 7.7.1 to 7.7.2
Bumps OpenIddict.EntityFrameworkCore from 7.7.1 to 7.7.2
Bumps Spectre.Console.Cli from 0.55.0 to 0.57.2
Bumps tap.studio.cli from 0.7.7 to 0.7.8

---
updated-dependencies:
- dependency-name: Aspire.Hosting
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Azure.Security.KeyVault.Secrets
  dependency-version: 4.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: HotChocolate.AspNetCore
  dependency-version: 16.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: HotChocolate.Subscriptions.InMemory
  dependency-version: 16.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Markdig
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.OpenApi.YamlReader
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: ModelContextProtocol
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenIddict.AspNetCore
  dependency-version: 7.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenIddict.EntityFrameworkCore
  dependency-version: 7.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Spectre.Console.Cli
  dependency-version: 0.57.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: tap.studio.cli
  dependency-version: 0.7.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 24, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

0 participants