Bump the aspire group with 23 updates by dependabot[bot] · Pull Request #1737 · microsoft/aspire-samples

dependabot · 2026-06-17T06:58:04Z

Updated Aspire.Azure.Storage.Blobs from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Azure.Storage.Blobs's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Azure.Storage.Queues from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Azure.Storage.Queues's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.AppHost from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Azure from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Azure's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.AppContainers from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Azure.AppContainers's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.Functions from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Azure.Functions's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Azure.Storage from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Azure.Storage's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Docker from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Docker's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.JavaScript from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.JavaScript's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.MySql from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.MySql's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Orleans from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Orleans's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.PostgreSQL from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Python from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Python's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Redis from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Redis's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.SqlServer from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.SqlServer's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Microsoft.Data.SqlClient from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Microsoft.Data.SqlClient's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Microsoft.EntityFrameworkCore.SqlServer from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Microsoft.EntityFrameworkCore.SqlServer's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.MySqlConnector from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.MySqlConnector's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Npgsql from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Npgsql's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#18205, @mitchdenny)
🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#18240, @damianedwards)

🏷️ Housekeeping

📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Commits viewable in compare view.

Updated Aspire.Npgsql.EntityFrameworkCore.PostgreSQL from 13.4.4 to 13.4.5.

Release notes

Sourced from Aspire.Npgsql.EntityFrameworkCore.PostgreSQL's releases.

13.4.5 What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes

🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#18204, @mitchdenny)
🎭 **playwrightCliVersion values that are not valid SemVer ...

Description has been truncated

Dependabot will resolve any conflicts with this PR as long as you don't alter it you...

Description has been truncated

Bumps Aspire.Azure.Storage.Blobs from 13.4.4 to 13.4.5 Bumps Aspire.Azure.Storage.Queues from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.AppHost from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Azure from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Azure.AppContainers from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Azure.Functions from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Azure.Storage from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Docker from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.JavaScript from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.MySql from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Orleans from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.PostgreSQL from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Python from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Redis from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.SqlServer from 13.4.4 to 13.4.5 Bumps Aspire.Hosting.Testing from 13.4.4 to 13.4.5 Bumps Aspire.Microsoft.Data.SqlClient from 13.4.4 to 13.4.5 Bumps Aspire.Microsoft.EntityFrameworkCore.SqlServer from 13.4.4 to 13.4.5 Bumps Aspire.MySqlConnector from 13.4.4 to 13.4.5 Bumps Aspire.Npgsql from 13.4.4 to 13.4.5 Bumps Aspire.Npgsql.EntityFrameworkCore.PostgreSQL from 13.4.4 to 13.4.5 Bumps Aspire.StackExchange.Redis from 13.4.4 to 13.4.5 Bumps Aspire.StackExchange.Redis.OutputCaching from 13.4.4 to 13.4.5 --- updated-dependencies: - dependency-name: Aspire.Azure.Storage.Blobs dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Azure.Storage.Blobs dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Azure.Storage.Queues dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.AppHost dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure.AppContainers dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure.Functions dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure.Storage dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Azure.Storage dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Docker dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.JavaScript dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.JavaScript dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.JavaScript dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.MySql dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Orleans dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.PostgreSQL dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.PostgreSQL dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Python dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Hosting.Testing dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Microsoft.Data.SqlClient dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.MySqlConnector dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Npgsql dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Npgsql.EntityFrameworkCore.PostgreSQL dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.Npgsql.EntityFrameworkCore.PostgreSQL dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.StackExchange.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.StackExchange.Redis dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire - dependency-name: Aspire.StackExchange.Redis.OutputCaching dependency-version: 13.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspire ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

microsoft-github-policy-service

Approved; this PR will merge when all required status checks pass.

dependabot Bot added the area-engineering-systems label Jun 17, 2026

Copilot AI review requested due to automatic review settings June 17, 2026 06:58

dependabot Bot added the area-engineering-systems label Jun 17, 2026

Copilot AI reviewed Jun 17, 2026

microsoft-github-policy-service Bot added dependencies Pull requests that update a dependency file auto-merge labels Jun 17, 2026

microsoft-github-policy-service Bot enabled auto-merge (squash) June 17, 2026 06:59

microsoft-github-policy-service Bot approved these changes Jun 17, 2026

View reviewed changes

microsoft-github-policy-service Bot merged commit 6733fd3 into main Jun 17, 2026
2 of 4 checks passed

microsoft-github-policy-service Bot deleted the dependabot/nuget/samples/aspire-shop/AspireShop.AppHost/aspire-31d0b20836 branch June 17, 2026 06:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the aspire group with 23 updates#1737

Bump the aspire group with 23 updates#1737
microsoft-github-policy-service[bot] merged 1 commit into
mainfrom
dependabot/nuget/samples/aspire-shop/AspireShop.AppHost/aspire-31d0b20836

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

microsoft-github-policy-service Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5

🐛 Fixes

🏷️ Housekeeping

13.4.5

What's New in Aspire 13.4.5