Skip to content

Bump the nuget group with 29 updates - #84

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-a2f4240f02
Closed

Bump the nuget group with 29 updates#84
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/nuget-a2f4240f02

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated dotnet-coverage from 18.7.0 to 18.9.0.

Release notes

Sourced from dotnet-coverage's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.122 to 3.0.123.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.123

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.123

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.122...3.0.123

Commits viewable in compare view.

Updated Microsoft.AgentGovernance from 3.7.0 to 4.0.0.

Release notes

Sourced from Microsoft.AgentGovernance's releases.

4.0.0

Agent Governance Toolkit v4.0.0

Ship agents to production without losing sleep -- now with consolidated packages, TEE key management, and Entra JWT verification across the mesh.

Highlights

Python Package Consolidation (Breaking)

45 Python packages consolidated into 5 clean distributions:

Distribution What is included
agent-governance-toolkit-core Policy engine, capability model, audit, MCP gateway, identity, trust scoring
agent-governance-toolkit-runtime Privilege rings, saga orchestration, termination control
agent-governance-toolkit-sre SLOs, error budgets, chaos engineering, circuit breakers
agent-governance-toolkit-cli agt CLI, OWASP verification, integrity checks, policy linting
agent-governance-toolkit[full] Meta-package installing all of the above

Old package names (agent-os-kernel, agentmesh-platform, etc.) remain as stub redirects for migration.

New Capabilities

  • TEE keystore abstraction (ADR 0010): async key management with TEEKeyHandle, SoftwareKeyHandle, and attested key store adapters
  • Entra-signed JWT verification for mesh-relay WebSocket connections and mesh-registry agent verification
  • Wire-protocol-aware policy evaluation for SQL and Kubernetes across TypeScript, Rust, Go, and .NET
  • Credential injection and offload across all four SDK languages
  • Expanded credential redaction across C#, Python, TypeScript, and Rust
  • Sandbox subprocess code scanner and OpenShell shell interception
  • LangGraph v1.0 governance adapter with stale-auth fingerprinting
  • New CLI governance packages: OpenCode, Antigravity CLI, Claude Code
  • AGT test replay engine for policy regression testing

Security (15+ fixes)

  • Closed authorization bypasses in stateless kernel and execute API
  • Proof-of-possession enforcement on registry endpoints
  • Trust boundary hardening: POP, capability grant auth, signing-oracle, unknown-DID auto-trust
  • JWKS/revocation trust-fetch hardening and URL allowlist matching
  • In-process sandbox hardening against stdlib escape paths
  • Mute-agent: 11 red-team regression tests
  • setuptools minimum raised to 78.1.1 for CVE fix

Documentation

  • README rewrite, docs site refresh, architecture diagrams
  • ADR-0026 (Foundry AI Gateway PDP), ADR-0028 (AGT Studio), ADR-0029 (policy distribution)
  • NSA MCP compliance mapping, zh-TW translations
  • 60+ tutorial improvements

Install

... (truncated)

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.Web from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.Components.Web's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.AspNetCore.TestHost's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.AI from 10.7.0 to 10.8.0.

Release notes

Sourced from Microsoft.Extensions.AI's releases.

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
  • Update Agent Framework to 1.13.0 #​7613 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.AI.OpenAI from 10.7.0 to 10.8.0.

Release notes

Sourced from Microsoft.Extensions.AI.OpenAI's releases.

10.8.0

This release adds new experimental APIs to Microsoft.Extensions.AI.Abstractions and updates the OpenAI dependency to 2.12.0, alongside documentation, test, and repository maintenance.

Experimental API Changes

New Experimental APIs

  • New experimental API: AIFunctionNameAttribute and AIParameterNameAttribute #​7610 by @​jozkee (co-authored by @​jeffhandley @​Copilot)
  • New experimental API: ToolApprovalRequestContent.RequiresConfirmation (MEAI001) #​7549 by @​javiercn (co-authored by @​Copilot)

What's Changed

AI

  • Upgrade OpenAI dependency to 2.12.0 #​7608 by @​jozkee (co-authored by @​Copilot)
  • Auto-detect audio format in OpenAISpeechToTextClient #​7575 by @​jozkee (co-authored by @​Copilot)
  • Fix ImageGeneratingChatClient duplicating preceding content and dropping following content #​7624 by @​jozkee (co-authored by @​Copilot)

Vector Data

  • Make all test methods virtual in VectorData.ConformanceTests #​7606 by @​adamsitnik (co-authored by @​Copilot)

Documentation Updates

  • Remove links to ai-samples repo #​7574 by @​gewarren
  • Fix up docs with Copilot (MEVD) #​7597 by @​gewarren
  • Fix up docs with Copilot (M.E.ServiceDiscovery) #​7598 by @​gewarren (co-authored by @​Copilot)
  • Fix up docs with Copilot (MEAI) #​7600 by @​gewarren
  • Fix up docs with Copilot #​7601 by @​gewarren

Test Improvements

  • Fix flaky StampedeTests and harden related test waits #​7572 by @​jeffhandley (co-authored by @​Copilot)
  • Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit #​7579 by @​adamsitnik (co-authored by @​Copilot)
  • Removing SemanticKernel Connectors dependency and replacing it #​7584 by @​adamsitnik (co-authored by @​Copilot)
  • Migrate to xUnit v3 #​7607 by @​adamsitnik (co-authored by @​shyamnamboodiripad @​Copilot)

Repository Infrastructure Updates

  • Update OTel GenAI conventions skill for standalone semconv-genai repo #​7519 by @​jeffhandley (co-authored by @​Copilot)
  • Bump dotnet-coverage from 18.7.0 to 18.8.0 #​7552
  • [main] Update dependencies from dotnet/arcade #​7559
  • Fix transitive MessagePack vulnerability in AI template AppHost projects #​7561 by @​adamsitnik (co-authored by @​Copilot)
  • Bump esbuild, @​vitejs/plugin-react and vite in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7564
  • Bump tmp from 0.2.6 to 0.2.7 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7569
  • Bump js-yaml from 4.1.1 to 4.2.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7570
  • Bump PowerShell from 7.6.2 to 7.6.3 #​7576
  • Remove duplicate 'WebAPI' classification from template #​7577 by @​danroth27
  • [main] Update dependencies from dotnet/arcade #​7590
  • Eliminate redundant Correctness CI stage by merging into Build #​7594 by @​adamsitnik (co-authored by @​Copilot)
  • Update Agent Framework to 1.13.0 #​7613 by @​jeffhandley (co-authored by @​Copilot)
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.Binder from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.Binder's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Configuration.EnvironmentVariables's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.9 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.JsonWebTokens's releases.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 8.19.1 to 8.19.2.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

Commits viewable in compare view.

Updated NSubstitute from 5.3.0 to 6.0.0.

Release notes

Sourced from NSubstitute's releases.

6.0.0

ℹ️ No changes from Release Candidate 1.

NSubstitute v6.0.0

From RC1 notes:

  • [NEW] ArgMatchers.Matching predicate matcher as an alternative to Is(Expression<Predicate<T>>. (.NET6 and above.)
  • [UPDATE] Improved support for custom argument matchers. Arg.Is now accepts arg matchers.
  • [UPDATE][BREAKING] Update target frameworks: .NET8, .NET Standard 2.0
  • [UPDATE][BREAKING] Remove legacy obsolete API
  • [UPDATE][BREAKING] Mark as obsolete api CompatArg with pre c# 7.0 support
  • [UPDATE][BREAKING] Nullability is enabled for public api for .NET 8+ TFMs
  • [UPDATE] Migrate documentation to docfx platform and update samples to NUnit 4
  • [NEW] Added NuGet Package README file.

Full change list

6.0.0-rc.1

NSubstitute v6.0.0 Release Candidate 1

Due to the large number of changes in this release, we wanted to start with a release candidate to ensure we've correctly captured breaking changes.

  • [NEW] ArgMatchers.Matching predicate matcher as an alternative to Is(Expression<Predicate<T>>. (.NET6 and above.)
  • [UPDATE] Improved support for custom argument matchers. Arg.Is now accepts arg matchers.
  • [UPDATE][BREAKING] Update target frameworks: .NET8, .NET Standard 2.0
  • [UPDATE][BREAKING] Remove legacy obsolete API
  • [UPDATE][BREAKING] Mark as obsolete api CompatArg with pre c# 7.0 support
  • [UPDATE][BREAKING] Nullability is enabled for public api for .NET 8+ TFMs
  • [UPDATE] Migrate documentation to docfx platform and update samples to NUnit 4
  • [NEW] Added NuGet Package README file.

Full change list

Commits viewable in compare view.

Updated OpenTelemetry from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry's releases.

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

  • NuGet: OpenTelemetry v1.17.0-rc.1

    • Fixed a metric point reclaim data race on CPU ARM architectures.
      (#​7401)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Replaced the vendored copy of
      EnvironmentVariablesConfigurationProvider with a direct
      Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
      Consumers gain automatic pickup of upstream bug fixes and security patches;
      no public API or behavioural change.
      (#​7146)

    • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
      when an activity is dropped because its local (in-process) parent is not
      recorded.
      (#​7427)

    • Added support for a Schema URL on Resource instances.
      (#​7472)

    • Fixed a metric storage leak that occurred when meters and instruments were
      repeatedly created and disposed.
      (#​7466)

    • Added ExcludedTagKeys property to MetricStreamConfiguration to support
      excluding specific tag keys from metric streams.
      (#​7373)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.17.0-rc.1

    • Fixed TraceContextPropagator to normalize empty tracestate header values
      to null when extracting trace context.
      (#​7407,
      #​7433)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
      to read only the normalized environment variable name, following the updated
      environment variable carrier specification.
      Non-normalized carrier keys are no longer matched, even when they would
      normalize to the requested key.
      ... (truncated)

1.17.0-beta.1

The following changes are from the previous release 1.16.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.17.0-beta.1

    • Added a verbose-level diagnostic event for ignored metrics.
      (#​7429)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Fix double unit suffixes in metric names when using OpenMetrics.
      (#​7454)

    • Fix incorrect handling of leading digits in metric names for OpenMetrics.
      (#​7454)

    • Add PrometheusAspNetCoreOptions.ScopeInfoEnabled property to enable or
      disable scope labels in Prometheus metrics. Defaults to true.
      (#​7436)

    • Added support for the dots and values Prometheus UTF-8 name escaping
      schemes when negotiated via the Accept header.
      (#​7439)

    • Add PrometheusAspNetCoreOptions.TargetInfoEnabled property to enable or
      disable the target_info metric in Prometheus metrics. Defaults to true.
      (#​7438)

    • Added support for the allow-utf-8 Prometheus UTF-8 name escaping scheme
      when negotiated via the Accept header.
      (#​7440)

    • Add PrometheusAspNetCoreOptions.ResourceConstantLabels property to select
      resource attributes to add to each metric as constant labels. Defaults to
      null (no resource attributes are added as metric labels).
      (#​7471)

    • Add PrometheusAspNetCoreOptions.MaxScrapeResponseSizeBytes to configure
      the maximum size of a scrape response. The default is now ~166 MiB.
      (#​7487)

    • A scrape whose serialized output exceeds the maximum scrape response size
      limit now responds with HTTP 500.
      (#​7487)

    • Fixed the Prometheus text exposition format emitting redundant comments.
      (#​7491)

    • Made Accept header content negotiation consistent with the
      PrometheusHttpListener endpoint.
      ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

  • NuGet: OpenTelemetry v1.17.0-rc.1

    • Fixed a metric point reclaim data race on CPU ARM architectures.
      (#​7401)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Replaced the vendored copy of
      EnvironmentVariablesConfigurationProvider with a direct
      Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
      Consumers gain automatic pickup of upstream bug fixes and security patches;
      no public API or behavioural change.
      (#​7146)

    • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
      when an activity is dropped because its local (in-process) parent is not
      recorded.
      (#​7427)

    • Added support for a Schema URL on Resource instances.
      (#​7472)

    • Fixed a metric storage leak that occurred when meters and instruments were
      repeatedly created and disposed.
      (#​7466)

    • Added ExcludedTagKeys property to MetricStreamConfiguration to support
      excluding specific tag keys from metric streams.
      (#​7373)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.17.0-rc.1

    • Fixed TraceContextPropagator to normalize empty tracestate header values
      to null when extracting trace context.
      (#​7407,
      #​7433)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
      to read only the normalized environment variable name, following the updated
      environment variable carrier specification.
      Non-normalized carrier keys are no longer matched, even when they would
      normalize to the requested key.
      ... (truncated)

1.17.0-beta.1

The following changes are from the previous release 1.16.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.17.0-beta.1

    • Added a verbose-level diagnostic event for ignored metrics.
      (#​7429)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Fix double unit suffixes in metric names when using OpenMetrics.
      (#​7454)

    • Fix incorrect handling of leading digits in metric names for OpenMetrics.
      (#​7454)

    • Add PrometheusAspNetCoreOptions.ScopeInfoEnabled property to enable or
      disable scope labels in Prometheus metrics. Defaults to true.
      (#​7436)

    • Added support for the dots and values Prometheus UTF-8 name escaping
      schemes when negotiated via the Accept header.
      (#​7439)

    • Add PrometheusAspNetCoreOptions.TargetInfoEnabled property to enable or
      disable the target_info metric in Prometheus metrics. Defaults to true.
      (#​7438)

    • Added support for the allow-utf-8 Prometheus UTF-8 name escaping scheme
      when negotiated via the Accept header.
      (#​7440)

    • Add PrometheusAspNetCoreOptions.ResourceConstantLabels property to select
      resource attributes to add to each metric as constant labels. Defaults to
      null (no resource attributes are added as metric labels).
      (#​7471)

    • Add PrometheusAspNetCoreOptions.MaxScrapeResponseSizeBytes to configure
      the maximum size of a scrape response. The default is now ~166 MiB.
      (#​7487)

    • A scrape whose serialized output exceeds the maximum scrape response size
      limit now responds with HTTP 500.
      (#​7487)

    • Fixed the Prometheus text exposition format emitting redundant comments.
      (#​7491)

    • Made Accept header content negotiation consistent with the
      PrometheusHttpListener endpoint.
      ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

  • NuGet: OpenTelemetry v1.17.0-rc.1

    • Fixed a metric point reclaim data race on CPU ARM architectures.
      (#​7401)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Replaced the vendored copy of
      EnvironmentVariablesConfigurationProvider with a direct
      Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
      Consumers gain automatic pickup of upstream bug fixes and security patches;
      no public API or behavioural change.
      (#​7146)

    • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
      when an activity is dropped because its local (in-process) parent is not
      recorded.
      (#​7427)

    • Added support for a Schema URL on Resource instances.
      (#​7472)

    • Fixed a metric storage leak that occurred when meters and instruments were
      repeatedly created and disposed.
      (#​7466)

    • Added ExcludedTagKeys property to MetricStreamConfiguration to support
      excluding specific tag keys from metric streams.
      (#​7373)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.17.0-rc.1

    • Fixed TraceContextPropagator to normalize empty tracestate header values
      to null when extracting trace context.
      (#​7407,
      #​7433)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
      to read only the normalized environment variable name, following the updated
      environment variable carrier specification.
      Non-normalized carrier keys are no longer matched, even when they would
      normalize to the requested key.
      ... (truncated)

1.17.0-beta.1

The following changes are from the previous release 1.16.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.17.0-beta.1

    • Added a verbose-level diagnostic event for ignored metrics.
      (#​7429)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Fix double unit suffixes in metric names when using OpenMetrics.
      (#​7454)

    • Fix incorrect handling of leading digits in metric names for OpenMetrics.
      (#​7454)

    • Add PrometheusAspNetCoreOptions.ScopeInfoEnabled property to enable or
      disable scope labels in Prometheus metrics. Defaults to true.
      (#​7436)

    • Added support for the dots and values Prometheus UTF-8 name escaping
      schemes when negotiated via the Accept header.
      (#​7439)

    • Add PrometheusAspNetCoreOptions.TargetInfoEnabled property to enable or
      disable the target_info metric in Prometheus metrics. Defaults to true.
      (#​7438)

    • Added support for the allow-utf-8 Prometheus UTF-8 name escaping scheme
      when negotiated via the Accept header.
      (#​7440)

    • Add PrometheusAspNetCoreOptions.ResourceConstantLabels property to select
      resource attributes to add to each metric as constant labels. Defaults to
      null (no resource attributes are added as metric labels).
      (#​7471)

    • Add PrometheusAspNetCoreOptions.MaxScrapeResponseSizeBytes to configure
      the maximum size of a scrape response. The default is now ~166 MiB.
      (#​7487)

    • A scrape whose serialized output exceeds the maximum scrape response size
      limit now responds with HTTP 500.
      (#​7487)

    • Fixed the Prometheus text exposition format emitting redundant comments.
      (#​7491)

    • Made Accept header content negotiation consistent with the
      PrometheusHttpListener endpoint.
      ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.17.0

1.17.0-rc.1

1.17.0-beta.1

1.17.0-alpha.1

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Runtime from 1.16.0 to 1.17.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.17.0

1.17.0-rc.1

1.17.0-beta.1

1.17.0-alpha.1

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 8.19.1 to 8.19.2.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget group with 29 updates
a5f920b 
Bumps dotnet-coverage from 18.7.0 to 18.9.0
Bumps Meziantou.Analyzer from 3.0.122 to 3.0.123
Bumps Microsoft.AgentGovernance from 3.7.0 to 4.0.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10
Bumps Microsoft.AspNetCore.Components.Web from 10.0.9 to 10.0.10
Bumps Microsoft.AspNetCore.TestHost from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.AI from 10.7.0 to 10.8.0
Bumps Microsoft.Extensions.AI.OpenAI from 10.7.0 to 10.8.0
Bumps Microsoft.Extensions.Configuration from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.Binder from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Hosting from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Http from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Logging from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.19.1 to 8.19.2
Bumps Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.1 to 8.19.2
Bumps Microsoft.IdentityModel.Tokens from 8.19.1 to 8.19.2
Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1
Bumps NSubstitute from 5.3.0 to 6.0.0
Bumps OpenTelemetry from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.16.0 to 1.17.0
Bumps System.IdentityModel.Tokens.Jwt from 8.19.1 to 8.19.2

---
updated-dependencies:
- dependency-name: dotnet-coverage
  dependency-version: 18.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AgentGovernance
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.Components.Web
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.AI
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.AI.OpenAI
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Hosting
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Http
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.Protocols.OpenIdConnect
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: OpenTelemetry
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Stale dependencies, need updates label Jul 27, 2026
@dependabot dependabot Bot mentioned this pull request Jul 27, 2026
Closed
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #86.

@dependabot dependabot Bot closed this Aug 3, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/dot-config/nuget-a2f4240f02 branch August 3, 2026 20:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Stale dependencies, need updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants