Update external NuGet dependencies to latest versions#14549
Merged
joperezr merged 11 commits intodotnet:release/13.2from Feb 20, 2026
Merged
Update external NuGet dependencies to latest versions#14549joperezr merged 11 commits intodotnet:release/13.2from
joperezr merged 11 commits intodotnet:release/13.2from
Conversation
Update 38 external dependencies to their latest versions: - Confluent.Kafka 2.12.0 -> 2.13.0 - Google.Protobuf 3.33.0 -> 3.33.5 - Grpc.AspNetCore/ClientFactory 2.71.0 -> 2.76.0 - Grpc.Tools 2.72.0 -> 2.78.0 - Hex1b/McpServer/Tool 0.78.0 -> 0.90.0 - Humanizer.Core 2.14.1 -> 3.0.1 - JsonPatch.Net 3.3.0 -> 5.0.0 - KubernetesClient 18.0.5 -> 18.0.13 - Markdig 0.43.0 -> 0.45.0 - Microsoft.Data.SqlClient 6.1.2 -> 6.1.4 - Microsoft.DevTunnels.Connections 1.3.6 -> 1.3.12 - Microsoft.FluentUI.AspNetCore.Components 4.13.2 -> 4.14.0 - ModelContextProtocol 0.4.0-preview.3 -> 0.8.0-preview.1 - MongoDB.Driver 3.5.0 -> 3.6.0 - MongoDB.Driver.Core.Extensions.DiagnosticSources 2.1.0 -> 3.0.0 - MySqlConnector.DependencyInjection 2.4.0 -> 2.5.0 - NATS.Net 2.6.11 -> 2.7.2 - Npgsql.DependencyInjection/OpenTelemetry 10.0.0 -> 10.0.1 - OpenAI 2.7.0 -> 2.8.0 - OpenTelemetry.Exporter.Console/InMemory 1.14.0 -> 1.15.0 - OpenTelemetry.Instrumentation.GrpcNetClient 1.14.0-beta.1 -> 1.15.0-beta.1 - Oracle.ManagedDataAccess.OpenTelemetry 23.26.0 -> 23.26.100 - Polly.Core/Extensions 8.6.4 -> 8.6.5 - Pomelo.EntityFrameworkCore.MySql 8.0.3 -> 9.0.0 - Qdrant.Client 1.15.1 -> 1.16.1 - RabbitMQ.Client 7.1.2 -> 7.2.0 - Spectre.Console 0.52.1-preview.0.5 -> 0.54.1-alpha.0.37 - StackExchange.Redis 2.9.32 -> 2.11.0 - StreamJsonRpc 2.22.23 -> 2.24.84 - System.IO.Hashing 9.0.10 -> 10.0.3 Move Microsoft.Extensions.Caching.Memory to the common section (no longer TFM-conditional) to support Pomelo 9.0.0's transitive dependency on it. Also enhance the dependency-update skill with: - Bulk update workflow (update-then-verify-then-mirror) - Transitive pinning conflict guidance (NU1109) - Broken transitive dep metadata guidance (NU1603) - Known special-handling packages - Azure CLI fallback for Windows (az.cmd) - Hex1b.Tool added to package family list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14549Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14549" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates 38 external NuGet dependencies to their latest versions and enhances the dependency-update skill documentation with lessons learned from the bulk update process. The update addresses the previous constraint on Pomelo.EntityFrameworkCore.MySql by moving Microsoft.Extensions.Caching.Memory to the common section to resolve transitive pinning conflicts.
Changes:
- Updated 38 external NuGet package versions to their latest stable or pre-release versions (depending on package conventions)
- Moved Microsoft.Extensions.Caching.Memory from TFM-conditional sections to common section to resolve NU1109 transitive pinning conflict introduced by Pomelo 9.0.0 upgrade
- Enhanced .github/skills/dependency-update/SKILL.md with bulk update workflow, transitive pinning guidance (NU1109/NU1603), package-specific handling notes, and Azure CLI fallback instructions
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Directory.Packages.props | Updated 38 external package versions including major bumps (Humanizer.Core 2→3, JsonPatch.Net 3→5, Pomelo 8→9, System.IO.Hashing 9→10); moved Microsoft.Extensions.Caching.Memory to common section; removed obsolete Pomelo constraint comment |
| .github/skills/dependency-update/SKILL.md | Added Hex1b.Tool to package family list; documented bulk update workflow with nuget.org verification steps; added transitive pinning (NU1109) and broken metadata (NU1603) guidance; added package-specific handling notes for Pomelo, Microsoft.AI.Foundry.Local, Spectre.Console, and Milvus.Client; added Azure CLI fallback instructions for Windows |
9fbf055 to
ea1f511
Compare
- MCP SDK 0.8.0: Convert IDictionary to Dictionary for IReadOnlyDictionary compatibility in AgentMcpCommand.cs, suppress MCPEXP001 experimental warning - Humanizer 3.0: Fully qualify Resources references in ResourceDetails.razor to avoid ambiguity with Humanizer.Resources namespace - MySqlConnector 2.5.0: Migrate from obsolete MySqlConnectorLogManager.Provider to DbContextOptionsBuilder.UseLoggerFactory(), remove unused MySqlConnector.Logging.Microsoft.Extensions.Logging package reference - RabbitMQ.Client 7.2.0: Suppress SYSLIB0026/0027/0028 warnings from source-generated configuration binder code touching obsolete X509Certificate2 APIs, regenerate ConfigurationSchema.json - FluentUI 4.14.0: Implement new IMessageService.ShowMessageBar/Async MarkupString overloads in test mock - Revert OpenAI to 2.7.0 (needs coordinated update with Microsoft.Extensions.AI.OpenAI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ea1f511 to
52ef9f8
Compare
- Revert JsonPatch.Net to 3.3.0: Updating to 5.0.0 caused TypeLoadException due to incompatible JsonPointer.Net value type change vs pinned JsonSchema.Net 7.4.0. Both packages need to be updated together in a separate PR. - Update Microsoft.Azure.StackExchangeRedis 3.2.1 -> 3.3.1 and Microsoft.Extensions.Azure 1.13.0 -> 1.13.1: Required for StackExchange.Redis 2.11.0 compatibility. The AMR refactor split Azure auth into AzureManagedRedisOptionsProvider; updated tests to check for the new type instead of IAzureCacheTokenEvents. - Revert Pomelo MySqlConnector logging to MySqlConnectorLogManager.Provider with #pragma CS0618 suppression: UseLoggerFactory only configures EF Core logging, not MySqlConnector's internal categories (ConnectionPool, etc.). There is no non-obsolete alternative when using Pomelo without MySqlDataSource. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Feb 18, 2026
…ects Humanizer.Core 3.x and StreamJsonRpc 2.24.x ship Roslyn analyzers that are incompatible with older SDK versions (net8): - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) These analyzers flow transitively to template projects, causing build failures when template tests verify backward compatibility with older SDKs. Add PrivateAssets="analyzers" to prevent these analyzers from flowing to consuming projects while keeping them available for our own builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Humanizer.Core 3.0.1 and StreamJsonRpc 2.24.84 ship Roslyn analyzers that are incompatible with older SDKs (net8) used by template tests: - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) PrivateAssets="analyzers" does not prevent these from flowing to template projects since the analyzers are resolved from the NuGet package cache at build time. Reverting to compatible versions: - Humanizer.Core: 3.0.1 -> 2.14.1 - StreamJsonRpc: 2.24.84 -> 2.22.23 Also reverts the Humanizer namespace ambiguity fix in ResourceDetails.razor since 2.14.1 does not introduce the Humanizer.Resources collision. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Spectre.Console 0.54.1-alpha.0.37 changed hyperlink rendering behavior: the [link=url] markup no longer emits ANSI OSC 8 hyperlink escape sequences in the same way, breaking the ConsoleActivityLoggerTests that verify clickable link rendering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
eerhardt
reviewed
Feb 19, 2026
| <AssemblyName>aspire</AssemblyName> | ||
| <RootNamespace>Aspire.Cli</RootNamespace> | ||
| <NoWarn>$(NoWarn);CS1591</NoWarn> | ||
| <!-- MCPEXP001: The MCP SDK 0.8.0 added experimental types (ToolExecution, ToolTaskSupport) to its default |
Member
Author
There was a problem hiding this comment.
For context: we don't use ToolExecution or ToolTaskSupport directly. The suppression is needed because our BackchannelJsonSerializerContext combines its JsonTypeInfoResolver with McpJsonUtilities.DefaultOptions.TypeInfoResolver. In MCP 0.8.0, that default resolver now includes type info for ToolExecution and ToolTaskSupport which are marked [Experimental("MCPEXP001")]. The System.Text.Json source generator emits code referencing those types,
triggering the diagnostic.
Member
There was a problem hiding this comment.
Should we be doing something else? Are we doing something wrong in Aspire.Cli? or is this expected behavior when using the STJ source generator and MCP types?
Directory.Packages.props
Outdated
| <PackageVersion Include="Microsoft.Extensions.Http" Version="$(MicrosoftExtensionsHttpPreviewVersion)" /> | ||
| <PackageVersion Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1PreviewVersion)" /> | ||
| <PackageVersion Include="System.Text.Json" Version="$(SystemTextJsonPreviewVersion)" /> | ||
| <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="$(MicrosoftExtensionsCachingMemoryPreviewVersion)" /> |
Member
There was a problem hiding this comment.
To make this readable - can we keep it alphabetized?
| <PackageVersion Include="Npgsql.OpenTelemetry" Version="10.0.1" /> | ||
| <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.0" /> | ||
| <PackageVersion Include="OpenTelemetry.Exporter.InMemory" Version="1.15.0" /> | ||
| <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="$(OpenTelemetryExporterOpenTelemetryProtocolVersion)" /> |
Member
There was a problem hiding this comment.
What about the other OpenTelemetry packages?
Member
Author
There was a problem hiding this comment.
Ah, good catch. The other OpenTelemetry packages are controlled by a version in Versions.props, which the update dependencies skill is specifically told not to use, so it instead only updates things that are in this itemgroup directly. Do you want me to make those changes here or do it in a follow up PR?
Member
There was a problem hiding this comment.
Here would be best IMO - to keep the OpenTelemetry in sync. But I won't block you doing it in a follow up, if that makes it easier for you.
src/Components/Aspire.Pomelo.EntityFrameworkCore.MySql/AspireEFMySqlExtensions.cs
Show resolved
Hide resolved
eerhardt
reviewed
Feb 19, 2026
...soft.Azure.StackExchangeRedis.Tests/AspireMicrosoftAzureStackExchangeRedisExtensionsTests.cs
Show resolved
Hide resolved
The Azure Managed Redis endpoints were split out into another class, so we need to check both classes.
Member
|
/deployment-test |
- Move Microsoft.Extensions.Caching.Memory to alphabetical position in the common section of Directory.Packages.props - Update OpenTelemetry version properties in eng/Versions.props: - Instrumentation.AspNetCore: 1.14.0 -> 1.15.0 - Instrumentation.Http: 1.14.0 -> 1.15.0 - Extensions.Hosting: 1.14.0 -> 1.15.0 - Instrumentation.Runtime: 1.14.0 -> 1.15.0 - Exporter.OpenTelemetryProtocol: 1.14.0 -> 1.15.0 - Azure.Monitor.OpenTelemetry.Exporter: 1.5.0 -> 1.6.0 - Regenerate Aspire.Seq ConfigurationSchema.json for OTel changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
eerhardt
approved these changes
Feb 20, 2026
Member
eerhardt
left a comment
There was a problem hiding this comment.
LGTM - we should ensure we update the rest of the OpenTelemetry packages as well. (And probably update the Skill to handle them.
- Document that OTel packages are split across Directory.Packages.props (hardcoded versions) and eng/Versions.props (MSBuild properties), and both must be updated together to keep OTel in sync - Add guidance to check eng/Versions.props when identifying packages - Add Humanizer.Core, StreamJsonRpc, and Azure.Monitor.OpenTelemetry.Exporter to the special handling section with upstream issue links Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
joperezr
added a commit
that referenced
this pull request
Feb 21, 2026
* Fix CopilotCliRunner version parsing for 'GitHub Copilot CLI X.X.X' format (#14568) * Fix CopilotCliRunner version parsing for 'GitHub Copilot CLI X.X.X' format Extract version parsing into a testable TryParseVersionOutput method that handles prefixed version strings like 'GitHub Copilot CLI 0.0.397' by taking the last space-separated token before parsing. Fixes #14174 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR feedback: handle trailing punctuation in version string Trim trailing period and other punctuation before parsing, to handle output like 'GitHub Copilot CLI 0.0.397.' from the issue report. Add test case for the trailing period format. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <mitch@mitchdeny.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Suppress update notification when running with --detach (#14571) * Suppress update notification when running with --detach When running 'aspire run --detach', the parent process no longer displays the update notification message before exiting. The update check is not useful in detach mode since the parent exits immediately after spawning the child process. Fixes part of #14238 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add unit tests for update notification suppression in detach mode Validates that the update notification is not shown when --detach is used, and that it is shown for normal (non-detach) runs. Uses a tracking ICliUpdateNotifier to verify the behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Move TestCliUpdateNotifier to shared TestServices folder Consolidate duplicate ICliUpdateNotifier test implementations from RunCommandTests and UpdateCommandTests into a single shared TestCliUpdateNotifier in TestServices, combining tracking and callback capabilities. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <mitch@mitchdeny.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add ACA deployment E2E tests for custom and existing ACR (#14510) * Add ACA deployment E2E tests for custom and existing ACR Add two new deployment E2E tests: - AcaCustomRegistryDeploymentTests: Deploys a starter app to ACA using AddAzureContainerRegistry + WithAzureContainerRegistry to create and attach a custom registry instead of relying on the default ACR. - AcaExistingRegistryDeploymentTests: Pre-creates an ACR via az CLI, then deploys a starter app to ACA referencing the existing ACR via AsExisting() with parameters. Both tests follow the established AcaStarterDeploymentTests pattern with Hex1b terminal automation, endpoint verification, and cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix deployment test failures - Custom Registry: Increase deploy wait to 35 min, detect PIPELINE FAILED to fail fast instead of timing out, bump test timeout to 45 min - Existing Registry: Use null for resourceGroup param in AsExisting() since ACR is in the same resource group as the deployment, avoiding cross-RG Bicep scope that caused compilation errors. Add same pipeline failure detection. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Verify container images exist in ACR after deployment Replace simple ACR existence checks with comprehensive image verification: - Discover the ACR name in the resource group - List all repositories in the ACR - Verify each repository has at least one tagged image - Fail the test if no images are found This ensures the deployment actually pushed container images to the custom/existing registry, not just that the ACR resource exists. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix misleading comment: recordings are uploaded for all tests The comment said 'only for failed tests' but the code uploads recordings for all tests regardless of pass/fail status. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <mitch@mitchdeny.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix NU1009 error for CPM projects during aspire update (#14585) * Fix NU1009 error for CPM projects during aspire update When a project uses Central Package Management (CPM) and has a PackageVersion entry for Aspire.Hosting.AppHost in Directory.Packages.props, running 'aspire update' would leave the PackageVersion orphaned after removing the PackageReference from the csproj. The new SDK format adds an implicit PackageReference with IsImplicitlyDefined=true, and NuGet rejects PackageVersion entries for implicitly-defined packages (NU1009). The fix removes the orphaned PackageVersion entry from Directory.Packages.props during the SDK migration in aspire update. Fixes #14550 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Handle NuGet.config prompts in CPM e2e test The aspire update flow prompts for NuGet.config directory and confirmation when the project doesn't have an existing NuGet.config. The test now handles both prompts by accepting the defaults. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update external NuGet dependencies to latest versions (#14549) * Update external NuGet dependencies and enhance dependency update skill Update 38 external dependencies to their latest versions: - Confluent.Kafka 2.12.0 -> 2.13.0 - Google.Protobuf 3.33.0 -> 3.33.5 - Grpc.AspNetCore/ClientFactory 2.71.0 -> 2.76.0 - Grpc.Tools 2.72.0 -> 2.78.0 - Hex1b/McpServer/Tool 0.78.0 -> 0.90.0 - Humanizer.Core 2.14.1 -> 3.0.1 - JsonPatch.Net 3.3.0 -> 5.0.0 - KubernetesClient 18.0.5 -> 18.0.13 - Markdig 0.43.0 -> 0.45.0 - Microsoft.Data.SqlClient 6.1.2 -> 6.1.4 - Microsoft.DevTunnels.Connections 1.3.6 -> 1.3.12 - Microsoft.FluentUI.AspNetCore.Components 4.13.2 -> 4.14.0 - ModelContextProtocol 0.4.0-preview.3 -> 0.8.0-preview.1 - MongoDB.Driver 3.5.0 -> 3.6.0 - MongoDB.Driver.Core.Extensions.DiagnosticSources 2.1.0 -> 3.0.0 - MySqlConnector.DependencyInjection 2.4.0 -> 2.5.0 - NATS.Net 2.6.11 -> 2.7.2 - Npgsql.DependencyInjection/OpenTelemetry 10.0.0 -> 10.0.1 - OpenAI 2.7.0 -> 2.8.0 - OpenTelemetry.Exporter.Console/InMemory 1.14.0 -> 1.15.0 - OpenTelemetry.Instrumentation.GrpcNetClient 1.14.0-beta.1 -> 1.15.0-beta.1 - Oracle.ManagedDataAccess.OpenTelemetry 23.26.0 -> 23.26.100 - Polly.Core/Extensions 8.6.4 -> 8.6.5 - Pomelo.EntityFrameworkCore.MySql 8.0.3 -> 9.0.0 - Qdrant.Client 1.15.1 -> 1.16.1 - RabbitMQ.Client 7.1.2 -> 7.2.0 - Spectre.Console 0.52.1-preview.0.5 -> 0.54.1-alpha.0.37 - StackExchange.Redis 2.9.32 -> 2.11.0 - StreamJsonRpc 2.22.23 -> 2.24.84 - System.IO.Hashing 9.0.10 -> 10.0.3 Move Microsoft.Extensions.Caching.Memory to the common section (no longer TFM-conditional) to support Pomelo 9.0.0's transitive dependency on it. Also enhance the dependency-update skill with: - Bulk update workflow (update-then-verify-then-mirror) - Transitive pinning conflict guidance (NU1109) - Broken transitive dep metadata guidance (NU1603) - Known special-handling packages - Azure CLI fallback for Windows (az.cmd) - Hex1b.Tool added to package family list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix build errors from dependency updates - MCP SDK 0.8.0: Convert IDictionary to Dictionary for IReadOnlyDictionary compatibility in AgentMcpCommand.cs, suppress MCPEXP001 experimental warning - Humanizer 3.0: Fully qualify Resources references in ResourceDetails.razor to avoid ambiguity with Humanizer.Resources namespace - MySqlConnector 2.5.0: Migrate from obsolete MySqlConnectorLogManager.Provider to DbContextOptionsBuilder.UseLoggerFactory(), remove unused MySqlConnector.Logging.Microsoft.Extensions.Logging package reference - RabbitMQ.Client 7.2.0: Suppress SYSLIB0026/0027/0028 warnings from source-generated configuration binder code touching obsolete X509Certificate2 APIs, regenerate ConfigurationSchema.json - FluentUI 4.14.0: Implement new IMessageService.ShowMessageBar/Async MarkupString overloads in test mock - Revert OpenAI to 2.7.0 (needs coordinated update with Microsoft.Extensions.AI.OpenAI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix test failures from dependency updates - Revert JsonPatch.Net to 3.3.0: Updating to 5.0.0 caused TypeLoadException due to incompatible JsonPointer.Net value type change vs pinned JsonSchema.Net 7.4.0. Both packages need to be updated together in a separate PR. - Update Microsoft.Azure.StackExchangeRedis 3.2.1 -> 3.3.1 and Microsoft.Extensions.Azure 1.13.0 -> 1.13.1: Required for StackExchange.Redis 2.11.0 compatibility. The AMR refactor split Azure auth into AzureManagedRedisOptionsProvider; updated tests to check for the new type instead of IAzureCacheTokenEvents. - Revert Pomelo MySqlConnector logging to MySqlConnectorLogManager.Provider with #pragma CS0618 suppression: UseLoggerFactory only configures EF Core logging, not MySqlConnector's internal categories (ConnectionPool, etc.). There is no non-obsolete alternative when using Pomelo without MySqlDataSource. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Exclude incompatible analyzers from transitive flow to consuming projects Humanizer.Core 3.x and StreamJsonRpc 2.24.x ship Roslyn analyzers that are incompatible with older SDK versions (net8): - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) These analyzers flow transitively to template projects, causing build failures when template tests verify backward compatibility with older SDKs. Add PrivateAssets="analyzers" to prevent these analyzers from flowing to consuming projects while keeping them available for our own builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Humanizer.Core and StreamJsonRpc to previous versions Humanizer.Core 3.0.1 and StreamJsonRpc 2.24.84 ship Roslyn analyzers that are incompatible with older SDKs (net8) used by template tests: - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) PrivateAssets="analyzers" does not prevent these from flowing to template projects since the analyzers are resolved from the NuGet package cache at build time. Reverting to compatible versions: - Humanizer.Core: 3.0.1 -> 2.14.1 - StreamJsonRpc: 2.24.84 -> 2.22.23 Also reverts the Humanizer namespace ambiguity fix in ResourceDetails.razor since 2.14.1 does not introduce the Humanizer.Resources collision. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Spectre.Console to 0.52.1-preview.0.5 Spectre.Console 0.54.1-alpha.0.37 changed hyperlink rendering behavior: the [link=url] markup no longer emits ANSI OSC 8 hyperlink escape sequences in the same way, breaking the ConsoleActivityLoggerTests that verify clickable link rendering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix up RabbitMQ * Fix Azure Redis break from StackExchange/StackExchange.Redis#2986 The Azure Managed Redis endpoints were split out into another class, so we need to check both classes. * Alphabetize Caching.Memory and update remaining OTel packages to 1.15.0 - Move Microsoft.Extensions.Caching.Memory to alphabetical position in the common section of Directory.Packages.props - Update OpenTelemetry version properties in eng/Versions.props: - Instrumentation.AspNetCore: 1.14.0 -> 1.15.0 - Instrumentation.Http: 1.14.0 -> 1.15.0 - Extensions.Hosting: 1.14.0 -> 1.15.0 - Instrumentation.Runtime: 1.14.0 -> 1.15.0 - Exporter.OpenTelemetryProtocol: 1.14.0 -> 1.15.0 - Azure.Monitor.OpenTelemetry.Exporter: 1.5.0 -> 1.6.0 - Regenerate Aspire.Seq ConfigurationSchema.json for OTel changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Azure.Monitor.OpenTelemetry.Exporter update due to AOT warning * Update dependency skill to document OTel packages in eng/Versions.props - Document that OTel packages are split across Directory.Packages.props (hardcoded versions) and eng/Versions.props (MSBuild properties), and both must be updated together to keep OTel in sync - Add guidance to check eng/Versions.props when identifying packages - Add Humanizer.Core, StreamJsonRpc, and Azure.Monitor.OpenTelemetry.Exporter to the special handling section with upstream issue links Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com> * Update container image tags to latest versions (#14555) * Update container image tags to latest versions Update 17 Docker container image tags across 12 hosting integrations: - EventHubs Emulator: 2.1.0 → 2.2.0 - ServiceBus SQL Server: 2022-latest → 2025-latest - Kafka (Confluent): 8.1.0 → 8.1.1 - Kafka UI: v1.3.0 → v1.4.2 - Keycloak: 26.4 → 26.5 - Milvus: v2.5.17 → v2.5.27 - MySQL: 9.5 → 9.6 - Oracle: 23.26.0.0 → 23.26.1.0 - Postgres: 17.6 → 18.2 - pgAdmin: 9.9.0 → 9.12.0 - pgWeb: 0.16.2 → 0.17.0 - Qdrant: v1.15.5 → v1.16.3 - Redis: 8.2 → 8.6 - RedisInsight: 2.70 → 3.0 - SQL Server: 2022-latest → 2025-latest - YARP: 2.3.0-preview.4 → 2.3.0-preview.5 Also adds an agent skill (.github/skills/update-container-images/) with a companion C# script to automate future container image tag updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix test snapshots and Postgres test assumptions for updated image tags - Update 5 YARP snapshot files: 2.3.0-preview.4 → 2.3.0-preview.5 - Update aspire-manifest.json: 2022-latest → 2025-latest - Fix Postgres v17 data path tests to explicitly set v17 image tag since the default image is now v18 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix hardcoded YARP tag in Dockerfile assertion test Update Assert.Contains for YARP image tag: 2.3.0-preview.4 → 2.3.0-preview.5 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR feedback: revert SQL Server, Postgres, and use rolling YARP tag - Revert SQL Server back to 2022-latest (Mac ARM incompatibility) - Revert Postgres back to 17.6 (data checksums concern, will do separately) - Change YARP to rolling tag 2.3-preview instead of pinned 2.3.0-preview.5 - Update all affected test snapshots and assertions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Document stdout/stderr conventions in UpdateImageTags.cs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <midenn@microsoft.com> Co-authored-by: Mitch Denny <mitch@mitchdeny.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Jose Perez Rodriguez <joperezr@microsoft.com> Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Member
|
This caused a regression in the dashboard by updating Microsoft.FluentUI.AspNetCore.Components. Please exclude Microsoft.FluentUI.AspNetCore.Components from automatic updates. The dashboard must be carefully tested when upgrading this package. It should never happen automatically. Skill fix: #14614 |
16 tasks
16 tasks
Member
Author
Thanks for noting. Copilot is fixing the agent skill that was used for these updates with #14634 |
Copilot AI
pushed a commit
that referenced
this pull request
Mar 10, 2026
* Update external NuGet dependencies and enhance dependency update skill Update 38 external dependencies to their latest versions: - Confluent.Kafka 2.12.0 -> 2.13.0 - Google.Protobuf 3.33.0 -> 3.33.5 - Grpc.AspNetCore/ClientFactory 2.71.0 -> 2.76.0 - Grpc.Tools 2.72.0 -> 2.78.0 - Hex1b/McpServer/Tool 0.78.0 -> 0.90.0 - Humanizer.Core 2.14.1 -> 3.0.1 - JsonPatch.Net 3.3.0 -> 5.0.0 - KubernetesClient 18.0.5 -> 18.0.13 - Markdig 0.43.0 -> 0.45.0 - Microsoft.Data.SqlClient 6.1.2 -> 6.1.4 - Microsoft.DevTunnels.Connections 1.3.6 -> 1.3.12 - Microsoft.FluentUI.AspNetCore.Components 4.13.2 -> 4.14.0 - ModelContextProtocol 0.4.0-preview.3 -> 0.8.0-preview.1 - MongoDB.Driver 3.5.0 -> 3.6.0 - MongoDB.Driver.Core.Extensions.DiagnosticSources 2.1.0 -> 3.0.0 - MySqlConnector.DependencyInjection 2.4.0 -> 2.5.0 - NATS.Net 2.6.11 -> 2.7.2 - Npgsql.DependencyInjection/OpenTelemetry 10.0.0 -> 10.0.1 - OpenAI 2.7.0 -> 2.8.0 - OpenTelemetry.Exporter.Console/InMemory 1.14.0 -> 1.15.0 - OpenTelemetry.Instrumentation.GrpcNetClient 1.14.0-beta.1 -> 1.15.0-beta.1 - Oracle.ManagedDataAccess.OpenTelemetry 23.26.0 -> 23.26.100 - Polly.Core/Extensions 8.6.4 -> 8.6.5 - Pomelo.EntityFrameworkCore.MySql 8.0.3 -> 9.0.0 - Qdrant.Client 1.15.1 -> 1.16.1 - RabbitMQ.Client 7.1.2 -> 7.2.0 - Spectre.Console 0.52.1-preview.0.5 -> 0.54.1-alpha.0.37 - StackExchange.Redis 2.9.32 -> 2.11.0 - StreamJsonRpc 2.22.23 -> 2.24.84 - System.IO.Hashing 9.0.10 -> 10.0.3 Move Microsoft.Extensions.Caching.Memory to the common section (no longer TFM-conditional) to support Pomelo 9.0.0's transitive dependency on it. Also enhance the dependency-update skill with: - Bulk update workflow (update-then-verify-then-mirror) - Transitive pinning conflict guidance (NU1109) - Broken transitive dep metadata guidance (NU1603) - Known special-handling packages - Azure CLI fallback for Windows (az.cmd) - Hex1b.Tool added to package family list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix build errors from dependency updates - MCP SDK 0.8.0: Convert IDictionary to Dictionary for IReadOnlyDictionary compatibility in AgentMcpCommand.cs, suppress MCPEXP001 experimental warning - Humanizer 3.0: Fully qualify Resources references in ResourceDetails.razor to avoid ambiguity with Humanizer.Resources namespace - MySqlConnector 2.5.0: Migrate from obsolete MySqlConnectorLogManager.Provider to DbContextOptionsBuilder.UseLoggerFactory(), remove unused MySqlConnector.Logging.Microsoft.Extensions.Logging package reference - RabbitMQ.Client 7.2.0: Suppress SYSLIB0026/0027/0028 warnings from source-generated configuration binder code touching obsolete X509Certificate2 APIs, regenerate ConfigurationSchema.json - FluentUI 4.14.0: Implement new IMessageService.ShowMessageBar/Async MarkupString overloads in test mock - Revert OpenAI to 2.7.0 (needs coordinated update with Microsoft.Extensions.AI.OpenAI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix test failures from dependency updates - Revert JsonPatch.Net to 3.3.0: Updating to 5.0.0 caused TypeLoadException due to incompatible JsonPointer.Net value type change vs pinned JsonSchema.Net 7.4.0. Both packages need to be updated together in a separate PR. - Update Microsoft.Azure.StackExchangeRedis 3.2.1 -> 3.3.1 and Microsoft.Extensions.Azure 1.13.0 -> 1.13.1: Required for StackExchange.Redis 2.11.0 compatibility. The AMR refactor split Azure auth into AzureManagedRedisOptionsProvider; updated tests to check for the new type instead of IAzureCacheTokenEvents. - Revert Pomelo MySqlConnector logging to MySqlConnectorLogManager.Provider with #pragma CS0618 suppression: UseLoggerFactory only configures EF Core logging, not MySqlConnector's internal categories (ConnectionPool, etc.). There is no non-obsolete alternative when using Pomelo without MySqlDataSource. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Exclude incompatible analyzers from transitive flow to consuming projects Humanizer.Core 3.x and StreamJsonRpc 2.24.x ship Roslyn analyzers that are incompatible with older SDK versions (net8): - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) These analyzers flow transitively to template projects, causing build failures when template tests verify backward compatibility with older SDKs. Add PrivateAssets="analyzers" to prevent these analyzers from flowing to consuming projects while keeping them available for our own builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Humanizer.Core and StreamJsonRpc to previous versions Humanizer.Core 3.0.1 and StreamJsonRpc 2.24.84 ship Roslyn analyzers that are incompatible with older SDKs (net8) used by template tests: - Humanizer.Analyzers requires System.Collections.Immutable 9.0.0 (CS8032) - StreamJsonRpc.Analyzers targets Roslyn 4.14.0 (CS9057) PrivateAssets="analyzers" does not prevent these from flowing to template projects since the analyzers are resolved from the NuGet package cache at build time. Reverting to compatible versions: - Humanizer.Core: 3.0.1 -> 2.14.1 - StreamJsonRpc: 2.24.84 -> 2.22.23 Also reverts the Humanizer namespace ambiguity fix in ResourceDetails.razor since 2.14.1 does not introduce the Humanizer.Resources collision. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Spectre.Console to 0.52.1-preview.0.5 Spectre.Console 0.54.1-alpha.0.37 changed hyperlink rendering behavior: the [link=url] markup no longer emits ANSI OSC 8 hyperlink escape sequences in the same way, breaking the ConsoleActivityLoggerTests that verify clickable link rendering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix up RabbitMQ * Fix Azure Redis break from StackExchange/StackExchange.Redis#2986 The Azure Managed Redis endpoints were split out into another class, so we need to check both classes. * Alphabetize Caching.Memory and update remaining OTel packages to 1.15.0 - Move Microsoft.Extensions.Caching.Memory to alphabetical position in the common section of Directory.Packages.props - Update OpenTelemetry version properties in eng/Versions.props: - Instrumentation.AspNetCore: 1.14.0 -> 1.15.0 - Instrumentation.Http: 1.14.0 -> 1.15.0 - Extensions.Hosting: 1.14.0 -> 1.15.0 - Instrumentation.Runtime: 1.14.0 -> 1.15.0 - Exporter.OpenTelemetryProtocol: 1.14.0 -> 1.15.0 - Azure.Monitor.OpenTelemetry.Exporter: 1.5.0 -> 1.6.0 - Regenerate Aspire.Seq ConfigurationSchema.json for OTel changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert Azure.Monitor.OpenTelemetry.Exporter update due to AOT warning * Update dependency skill to document OTel packages in eng/Versions.props - Document that OTel packages are split across Directory.Packages.props (hardcoded versions) and eng/Versions.props (MSBuild properties), and both must be updated together to keep OTel in sync - Add guidance to check eng/Versions.props when identifying packages - Add Humanizer.Core, StreamJsonRpc, and Azure.Monitor.OpenTelemetry.Exporter to the special handling section with upstream issue links Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates 38 external NuGet dependencies to their latest versions and enhances the dependency-update skill with lessons learned from the bulk update process.
Package Updates
Not Updated
Other Changes
Mirrored Packages
The following packages were mirrored to internal feeds via the dotnet-migrate-package pipeline:
Follow-up Issues
The following issues were logged to track problems discovered during this upgrade that need to be addressed separately:
MySqlConnectorLogManager.Provideris obsolete but there is no non-obsolete alternative for wiring MySqlConnector's internal log categories when using Pomelo withoutMySqlDataSource. Currently suppressed with#pragma.