Skip to content

chore: Bump the dotnet-deps group with 5 updates - #2725

Open
dependabot[bot] wants to merge 1 commit into
edgefrom
dependabot/nuget/samples/aws/edge/dotnet-deps-0a7fe6702d
Open

dependabot[bot] wants to merge 1 commit into
edgefrom
dependabot/nuget/samples/aws/edge/dotnet-deps-0a7fe6702d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Updated AWSSDK.S3 from 4.0.104.4 to 4.0.104.6.

Release notes

Sourced from AWSSDK.S3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Dapr.Client from 1.18.10 to 1.19.0.

Release notes

Sourced from Dapr.Client's releases.

1.19.0

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0

1.19.0-rc.6

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.6

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.4...v1.19.0-rc.6

1.19.0-rc.4

What's Changed

New Contributors

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.3...v1.19.0-rc.4

1.19.0-rc.3

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.2...v1.19.0-rc.3

1.19.0-rc.2

What's Changed

Full Changelog: dapr/dotnet-sdk@v1.19.0-rc.1...v1.19.0-rc.2

1.19.0-rc.1

What's Changed

Support for Dapr Runtime changes ahead of v1.19:

General Improvements

Bug Fixes

Full Changelog: dapr/dotnet-sdk@v1.18.10...v1.19.0-rc.1

1.19.0-preview.2

Dapr.Actors.Next is a ground-up re-implementation of the Dapr Actors building block for .NET, shipping as a preview throughout the 1.18 release cycle, with a stable release planned alongside Dapr runtime v1.19. The actor model itself is unchanged: actors remain virtual, addressed by type and ID, and support reentrancy, timers, reminders, proxying, etc. However, the way the SDK connects to the runtime and the way you write actor code have been modernized.

Highlights

  • Streaming runtime connectivity
    Actor callbacks (invoke, reminder, timer, deactivate) now arrive over a long-lived bidirectional gRPC stream instead of inbound, per-call HTTP requests into mapped actor-handler endpoints. This is the same pattern already used for Dapr workflows and streaming pub/sub subscriptions. There are no actor handlers to map, though your app will still need to expose a port for inbound gRPC connections from the Dapr runtime.
  • No reflection, trim-clean and AOT-ready
    Source generators produce the proxy, dispatcher, activation factory, registration and actor registry from your interface and implementation. Actors are discovered rather than registered by hand, and the runtime packages can be used in applications building for Native AOT.
  • Compile-time safety
    The public surface is annotated for nullable reference types, and new analyzers and code fixes catch actor-specific mistakes as you type: non-serializable or non-task-returning methods, blocking calls inside a turn, state changes that would break deserialization, using a callback method in a reminder that doesn't exist in the specified type, reading time from the clock instead of an injected TimeProvider, and more!
  • Consistent with the rest of the modern Dapr .NET SDK packages
    This release features per-activation DI scopes, use of the options pattern (IOptions<DaprActorsOptions>), and the same pluggable IDaprSerializer (System.Text.Json by default) used by Dapr.StateManagement and Dapr.Workflow.
  • New capabilities
    State-envelope schema versioning with upcaster chains, a first-class StateMachineActor<TState, TData> model, pub/sub-driven actors via [Subscribe] applied to the method to call instead of requiring external startup subscription and invocation, dynamic invocation by type/id/method with no compile-time contract, and an in-memory deterministic test runtime with optional Coyote integration.

Performance
Replacing the reflection-based proxy and dispatch machinery with source generators shows up directly in the numbers. In our benchmarks, creating an actor proxy drops from roughly 725 ns and 3.4 KB allocated under Dapr.Actors to about 14 ns and 48 B under Dapr.Actors.Next: a ~50x improvement in time and ~70x in allocation. A warm actor call is about 20% faster (≈484 ns -> ≈375 ns) and allocates roughly 30% less (1,264 B -> 912 B). The largest end-to-end win is in startup: building the provider, resolving the actor runtime, and dispatching the first call takes ~284 µs under Dapr.Actors versus ~37 µs under Dapr.Actors.Next, an ~8x reduction that holds steady as the number of registered actor types grows because registration and dispatch are generated at compile time rather than discovered and emitted on first use. Container construction itself is marginally more expensive on the new SDK (~6.0 µs vs ~4.7 µs) as more is wired up front, but that cost is repaid many times over on the first invocation.

We expect further optimizations before the 1.19 GA.

Benchmarks run with BenchmarkDotNet; figures are means from a single machine and are indicative rather than a guarantee. Feel free to run them yourself from here.

Compatibility notes

  • This package requires the Dapr runtime v1.18 or later.
  • This package is not API compatible with the original Dapr.Actors. Because actors are addressed by the same type names, you can migrate one actor type at a time, but it's easier to do that across separate projects than to mix both SDKs in one.
  • Serialization is a clean break: there's a single serialization path and no built-in DataContract support (supply and register your own implementation of IDaprSerializer if you need it). Verify that existing persisted state still deserializes before migrating a type.
  • Dapr.Actors and its associated packages are now in maintenance mode and will receive security and bug fixes only. No deprecation date has been set.

Getting started
Add the package to your project:

dotnet add package Dapr.Actors.Next --prerelease

Then register it in DI with builder.Services.AddDaprActors().

Documentation is available along with a six-part tutorial spanning different implementation examples.

Please reach out in the .NET channel on Discord or file an issue if you encounter problems, have feature suggestions, or just want to share feedback about this new functionality!

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore.Swagger from 10.3.0 to 10.3.1.

Release notes

Sourced from Swashbuckle.AspNetCore.Swagger's releases.

10.3.1

What's Changed

Deprecations

[!IMPORTANT]
Swashbuckle.AspNetCore.ApiTesting.Xunit depended on Xunit v2, which is no longer supported.

The package has been removed and no further versions will be released.

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.3.0...v10.3.1

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore.SwaggerGen from 10.3.0 to 10.3.1.

Release notes

Sourced from Swashbuckle.AspNetCore.SwaggerGen's releases.

10.3.1

What's Changed

Deprecations

[!IMPORTANT]
Swashbuckle.AspNetCore.ApiTesting.Xunit depended on Xunit v2, which is no longer supported.

The package has been removed and no further versions will be released.

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.3.0...v10.3.1

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore.SwaggerUI from 10.3.0 to 10.3.1.

Release notes

Sourced from Swashbuckle.AspNetCore.SwaggerUI's releases.

10.3.1

What's Changed

Deprecations

[!IMPORTANT]
Swashbuckle.AspNetCore.ApiTesting.Xunit depended on Xunit v2, which is no longer supported.

The package has been removed and no further versions will be released.

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.3.0...v10.3.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps AWSSDK.S3 from 4.0.104.4 to 4.0.104.6
Bumps Dapr.Client from 1.18.10 to 1.19.0
Bumps Swashbuckle.AspNetCore.Swagger from 10.3.0 to 10.3.1
Bumps Swashbuckle.AspNetCore.SwaggerGen from 10.3.0 to 10.3.1
Bumps Swashbuckle.AspNetCore.SwaggerUI from 10.3.0 to 10.3.1

---
updated-dependencies:
- dependency-name: AWSSDK.S3
  dependency-version: 4.0.104.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-deps
- dependency-name: Swashbuckle.AspNetCore.Swagger
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-deps
- dependency-name: Swashbuckle.AspNetCore.SwaggerGen
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-deps
- dependency-name: Swashbuckle.AspNetCore.SwaggerUI
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-deps
- dependency-name: Dapr.Client
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 30, 2026 00:44
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: deps/nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested review from a team as code owners October 30, 2026 00:44
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
nuget/AWSSDK.S3 4.0.104.6 UnknownUnknown
nuget/Swashbuckle.AspNetCore.Swagger 10.3.1 UnknownUnknown
nuget/Swashbuckle.AspNetCore.SwaggerGen 10.3.1 UnknownUnknown
nuget/Swashbuckle.AspNetCore.SwaggerUI 10.3.1 UnknownUnknown
nuget/Dapr.Client 1.19.0 🟢 4.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 5/30 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • samples/aws/aws.csproj
  • samples/dapr/ui/ui.csproj

@radius-dependabot-manager
radius-dependabot-manager Bot enabled auto-merge (squash) October 30, 2026 00:45

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants