chore(deps): Bump Aspire.Hosting.PostgreSQL and 15 others

[dependabot]

Updated Aspire.Hosting.PostgreSQL from 13.5.0 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

13.5.3

What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

• 📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #​19489. (#​19585, backport of #​19579, @​sebastienros)

• 🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #​19496. (#​19625, backport of #​19590, @​karolz-ms, @​danegsta)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.5.3

---

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2

What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

• 🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#​19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #​19554, @​mitchdenny)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1

What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

• 🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

• 🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #​19365. Fixes #​19503. ([#​19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #​19506, @​adamint)

🏷️ Housekeeping

• 📦 Updated DCP (Developer Control Plane) to 0.25.13 ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

• 🔧 Restored WinGet publication using .NET 9 wingetcreate ([#​19509]([release/13.5] fix(release): Restore WinGet publication with .NET 9 wingetcreate microsoft/aspire#19509))

• 🧹 Removed the pipeline-scoped Publish-Build-Assets group from the release pipeline ([#​19523]([release/13.5] Remove pipeline-scoped Publish-Build-Assets group microsoft/aspire#19523), [#​19163](Remove Publish-Build-Assets variable group from release/13.5 microsoft/aspire#19163))

• 🚀 Bumped branding to 13.5.1 ([#​19531](Increment patch version from 0 to 1 microsoft/aspire#19531))

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

Commits viewable in compare view.

Updated bunit from 2.9.0 to 2.11.3.

Release notes

Sourced from bunit's releases.

2.11.3

Fixed

• InvokeOnSpacerBeforeVisible now uses 4 parameters on .NET 11.0. Reported by @​vnbaaij in #​1915. Fixed by @​vnbaaij in #​1919.
• A JSInterop timeout elapsing while a result was set could crash the test host with InvalidOperationException: Nullable object must have a value. Reported by @​calebcwells in #​1920. Fixed by @​linkdotnet.

2.10.3

Fixed

• BunitHtmlParser.Dispose() no longer throws InvalidOperationException: Collection was modified when a parse is in flight on another thread during test teardown. Reported by @​thimobuchheister in #​1892. Fixed by @​linkdotnet.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.Web from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Components.Web's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.AI.Evaluation at 10.10.0.

Release notes

Sourced from Microsoft.Extensions.AI.Evaluation's releases.

10.10.0

This month's release focuses on AI package reliability: closing gaps in evaluation scoring, hardening OpenAI image-option handling, and removing the deprecated OpenAI Assistants API support.

Experimental API Changes

Removed Experimental APIs

• OpenAI Assistants experimental APIs removed (was experimental under OPENAI001) #​7724

What's Changed

AI

• Remove OpenAI Assistants API support #​7724 by @​jozkee (co-authored by @​Copilot)
• Update OpenAI package version to 2.13.0 #​7726 by @​jozkee
• OpenAI: Avoid null implicit conversions for image options #​7727 by @​jozkee (co-authored by @​Copilot)

AI Evaluation

• Fail closed when a quality metric has no valid score #​7735 by @​thaildhe172591
• Validate path segments in Azure storage result store and response cache #​7718 by @​Lroca88

Repository Infrastructure Updates

• Add TfxInstaller for publishing #​7695 by @​peterwaltonwork
• Bump PowerShell from 7.6.4 to 7.6.5 #​7702
• [Infrastructure] Update vulnerable npm dependencies #​7705 by @​wtgodbe
• Add Node installation for TfxInstaller #​7703 by @​peterwaltonwork
• Publish VSIX using publish task instead of output #​7711 by @​peterwaltonwork
• Bump dotnet-coverage from 18.9.0 to 18.10.0 #​7708
• Do not validate extension during publish step #​7725 by @​peterwaltonwork
• Add skill for upgrading OpenAI #​7728 by @​jozkee
• Fix source indexer stage #​7694 by @​jjonescz

Acknowledgements

• @​Lroca88 made their first contribution in #​7718
• @​thaildhe172591 made their first contribution in #​7735
• @​ANcpLua submitted issue #​7665 (resolved by #​7735)
• @​jeffhandley @​peterwald @​shyamnamboodiripad reviewed pull requests

Full Changelog: dotnet/extensions@v10.9.0...v10.10.0

Commits viewable in compare view.

Pinned Microsoft.Extensions.Configuration.EnvironmentVariables at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Configuration.EnvironmentVariables's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Configuration.Json at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Configuration.Json's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.DependencyInjection at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.DependencyInjection.Abstractions at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.FileSystemGlobbing from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.FileSystemGlobbing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Hosting.Abstractions at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Hosting.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Http at 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Testcontainers.PostgreSql from 4.14.0 to 4.15.0.

Release notes

Sourced from Testcontainers.PostgreSql's releases.

4.15.0

What's Changed

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​45594466.

🚀 Features

• feat: Add options to the Docker Compose up and down command (#​1759) @​HofmeisterAn
• feat: Add QuestDB module (#​1618) @​FortuneN, @​HofmeisterAn
• feat: Add Compose support (#​1750) @​HofmeisterAn
• fix(Couchbase): Treat an already provisioned cluster as configured (#​1736) @​arnelirobles, @​HofmeisterAn
• feat: Retry transient Docker image pull failures (#​1734) @​thomhurst, @​HofmeisterAn
• chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn
• feat(MongoDb): Resolve the MongoDb shell file path once (#​1745) @​HofmeisterAn

🐛 Bug Fixes

• fix: Detach from the container output before stopping or removing it (#​1755) @​HofmeisterAn
• fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn

📖 Documentation

• docs: Update CONTRIBUTING.md (#​1744) @​HofmeisterAn

🧹 Housekeeping

• chore: Improve null check, test typing, and IDE settings (#​1757) @​HofmeisterAn
• fix(GCloud): Bump test image version (#​1752) @​HofmeisterAn
• chore: Resolve Sonar findings (#​1751) @​HofmeisterAn
• chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
• feat: Prepare next release cycle (4.15.0) (#​1742) @​HofmeisterAn

📦 Dependency Updates

• chore(deps): Bump mkdocs-material from 9.7.2 to 9.7.7 (#​1758) @​dependabot[bot]
• chore(deps): Bump the actions group with 5 updates (#​1754) @​dependabot[bot]
• chore(deps): Bump the actions group across 1 directory with 7 updates (#​1747) @​dependabot[bot]
• chore(deps): Revert Dependabot NuGet jobs (#​1748) @​HofmeisterAn
• chore(deps): Split Dependabot NuGet jobs and bump test dependencies (#​1746) @​HofmeisterAn

Commits viewable in compare view.

Updated xunit.v3 from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

[dependabot]

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.