Bump the aspire group with 2 updates

[dependabot]

Updated Aspire.Npgsql from 13.3.2 to 13.4.2.

Release notes

Sourced from Aspire.Npgsql's releases.

13.4.2

What's New in Aspire 13.4.2

Patch release for Aspire 13.4 with a fix for Redis persistent container deadlock on startup when using TLS.

🐛 Fixes

• 🔴 Redis with WithLifetime(ContainerLifetime.Persistent) could deadlock on startup — Redis TLS startup arguments used the public/allocated host ports instead of the internal target ports. When the public port differed from the target port (or was not yet allocated) the container would listen on an unexpected port and become unreachable. The TLS and non-TLS startup arguments now bind to target ports, matching what Redis expects internally. Fixes #​17822. (#​17827, backported via #​17850, @​danegsta)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.4.2 (#​17876)

---

Full Changelog: microsoft/aspire@v13.4.1...v13.4.2

Full commit: d7d0b6759ce4b936c76bc4775814d27db560dd6d

Generated by Generate release notes for a new stable Aspire release · ● 5M

13.4.1

What's New in Aspire 13.4.1

Patch release for Aspire 13.4 with fixes for explicit-start resource lifecycle callbacks, Redis persistent container startup, proxyless endpoint allocation, and a duplicated profiles block in the empty C# AppHost template.

🐛 Fixes

• ⏱️ Explicit-start resources triggered lifecycle callbacks too early — Session-scoped resources marked with WithExplicitStart() were having their execution configuration callbacks (environment variables, arguments, certificates) evaluated at AppHost startup instead of at manual start. This meant user-interaction callbacks such as WithEnvironment(ctx => PromptForValueAsync(...)) were called before the user triggered the resource. DCP registration is now deferred until the user manually starts the resource; persistent explicit-start resources still register immediately but patch the existing DCP record to Start = true rather than deleting and recreating it. Fixes #​17813. (#​17825, backported via #​17826, @​danegsta)
• 🔴 Redis with WithLifetime(ContainerLifetime.Persistent) could deadlock on startup — Redis TLS startup arguments used the public/allocated host ports instead of the internal target ports. When the public port differed from the target port (or was not yet allocated) the container would listen on an unexpected port and become unreachable. The TLS and non-TLS startup arguments now bind to target ports, matching what Redis expects internally. Fixes #​17822. (#​17827, backported via #​17850, @​danegsta)
• 🔌 Proxyless container endpoint could hang when resolved before container creation — Referencing a proxyless container endpoint in an environment variable callback (before the container port spec was finalized) could deadlock. An on-demand allocation path now commits the target port as the fallback host port in that case; once BuildContainerPorts runs, normal DCP dynamic port assignment takes over for any later resolution. (#​17851, backported via #​17859, @​danegsta)
• 📄 Empty C# AppHost template emitted duplicate profiles block — aspire new aspire-empty on 13.4 produced an aspire.config.json with a profiles block that duplicated the content already present in apphost.run.json, causing redundant launch configuration. The embedded template now contains only the required appHost.path binding; profile configuration lives exclusively in apphost.run.json. Fixes #​17660. (#​17781, backported via #​17820, @​mitchdenny)

🏷️ Housekeeping

• 📦 Added Aspire CLI npm package to the release pipeline so the npm distribution is published as part of stable releases. (#​17297, backported via #​17766, @​adamint)
• 🚀 Bumped branding to 13.4.1 (#​17819)

---

Full Changelog: microsoft/aspire@v13.4.0...v13.4.1

Full commit: cf985fa817dd5863e7f62eb74fa1725ab5069ed2

Generated by Generate release notes for a new stable Aspire release · ● 1.0.40

Generated by Generate release notes for a new stable Aspire release · ● 3.9M

13.4.0

Aspire 13.4.0

Aspire 13.4 brings major improvements to Foundry hosted agents, the Aspire skills system, CLI reliability, and TypeScript AppHost stability — with cross-compute-environment deployment now working end-to-end and TypeScript AppHost support — Aspire's polyglot story — reaching general availability (GA).

Highlights

• 🎉 TypeScript AppHost is now GA — First introduced as a preview in an earlier version of Aspire, the TypeScript AppHost — Aspire's polyglot story — has reached the quality bar for general availability and is now officially supported for production use alongside C#. As part of GA, the experimental markers on the Azure TypeScript AppHost (ATS) APIs have been removed and the ATS surface area is stable for 13.4.
• 🤖 Foundry hosted agents — Protocol selection (responses / invocations) is now configurable from both C# and TypeScript AppHosts. Cross-compute-environment deployments (e.g., a Foundry hosted agent + an AKS consumer) now wire up correctly: endpoint resolution and the required Azure AI User RBAC role assignment on the Foundry account are generated automatically — no manual az role assignment create steps needed.
• 🛠️ Aspire skills catalog from bundle — aspire agent init now drives its installable skill catalog from the bundle manifest, surfacing all six bundled skills (previously only three were visible). An embedded snapshot means the full catalog is available even in airgapped / disconnected environments.
• 🔧 CLI reliability — Multiple CLI fixes: implicit-channel discovery restored, aspire stop no longer falsely reports failure on Unix, aspire ps no longer includes raw resource data (use aspire describe for detailed state), aspire new prefers the current CLI template version, friendly error for aspire do --list-steps without a step argument, and improved --search option description with documentation link.
• ⌨️ TypeScript AppHost — Fixed a deadlock that occurred when lazy options callbacks invoked async methods; dev-localhost resource service URLs are now accepted for local development without extra configuration.
• 📊 Dashboard — Summary log formatting improved for readability, dotnet watch dashboard auto-launch signal restored, and dynamic-port handling fixed for DistributedApplicationTestingBuilder.
• ☸️ Kubernetes — The Helm CLI minimum version (≥ 4.2.0) is now validated before a Kubernetes deploy, giving a clear error instead of a cryptic failure.
• ⚠️ Aspire.Hosting.Blazor ships as preview in 13.4 — A packaging issue with the Blazor gateway scripts means the package is intentionally marked preview for this release. Full stable support is targeted for 13.5.

⚠️ Notable changes

• aspire ps no longer includes raw resource data in its output. Use aspire describe <resource> to inspect detailed resource state.
• Foundry hosted agent builder API shape updated — see #​17545 and #​17669 for the updated C# and TypeScript signatures.
• Aspire.Hosting.Blazor is preview-versioned in 13.4 (SuppressFinalPackageVersion=true). A fix for the addBlazorGateway gateway script resolution error in TypeScript AppHosts is tracked in #​17685.

📖 Learn more

For the full details on everything in this release, check out the What's new in Aspire 13.4 documentation.

Thank you to all the community contributors who helped make Aspire 13.4 possible! 💜

---

Full Changelog: microsoft/aspire@v13.3.5...v13.4.0

Full commit: becb48e2d61099e35ae336d527d3875e928d6594

Generated by Generate release notes for a new stable Aspire release · ● 6.5M

13.3.5

What's New in Aspire 13.3.5

Patch release for Aspire 13.3 with fixes for the Azure provisioning location prompt and an Aspire CLI named-pipe timeout on Linux with .NET SDK 10.0.300.

🐛 Fixes

• 📍 Azure provisioning location prompt not populated — Selecting an existing resource group during aspire publish now correctly populates dependent server-controlled fields (such as Location). Previously, server-provided values for disabled inputs were discarded, leaving those fields blank. (#​17278, backported via #​17291)
• 🔧 Aspire CLI named-pipe timeout on Linux with .NET SDK 10.0.300 — The Aspire CLI was forcing DOTNET_CLI_USE_MSBUILD_SERVER=1 for all dotnet run/dotnet build invocations. On Linux with SDK 10.0.300 this caused a named-pipe timeout that prevented aspire run from building the AppHost. The forced override has been removed so the SDK chooses MSBuild server behavior. Fixes #​16849. (#​17313, backported via #​17314)

🏷️ Housekeeping

• ⬆️ Skipped log publish for WinGet/Homebrew installer pipeline jobs to fix Prepare Installers stage failures (#​17134)
• 🚀 Bumped branding to 13.3.5 (#​17315)

---

Full Changelog: microsoft/aspire@v13.3.4...v13.3.5

Full commit: 70b33bcb5f64c75e3ab6f57616545f35bd43dc81

Generated by Generate release notes for a new stable Aspire release · ● 4.3M

13.3.4

What's New in Aspire 13.3.4

Patch release for Aspire 13.3 with a fix for the Aspire skill description exceeding agent host limits.

🐛 Fixes

• 📝 Aspire skill description too long for agent hosts — The SKILL.md generated by aspire agent init included a frontmatter description that exceeded the 1024-character limit enforced by agent hosts such as Codex and Copilot CLI, causing the Aspire skill to fail to load. The bundled skill description has been shortened to stay within the limit. (#​17183, backported via #​17188)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.3.4 (#​17215)

---

Full commit: 75080796af797483231a9da2d1642b5130617565

Generated by Generate release notes for a new stable Aspire release · ● 3.6M

13.3.3

What's New in Aspire 13.3.3

Patch release for Aspire 13.3 with fixes for debug log level leaking into user resources, Keycloak HTTPS endpoint token invalidation, and endpoint materialization in HostResourceWithEndpoints.

🐛 Fixes

• 🔇 Debug log level leaking into user resources — Logging__LogLevel__Default=Debug set by the app host was being inherited by all user resources, silently changing their logging verbosity. The app host now uses ASPIRE_APPHOST_LOGLEVEL instead, which is scoped to Aspire processes only. (#​17071, backported via #​17078)
• 🔑 Keycloak HTTPS primary endpoint — Fixed a regression where Keycloak tokens became invalid after an app host restart because the HTTPS endpoint port was dynamic. When developer certificates are enabled, Keycloak's primary endpoint is now upgraded to HTTPS directly, and the endpoint name is set to http to enable standard http+https:// service discovery URLs. (#​17058, backported via #​17063)
• 🔌 Endpoint materialization in HostResourceWithEndpoints — Endpoints configured via HostResourceWithEndpoints are now correctly materialized, ensuring endpoint resolution and service discovery work as expected. (#​17091, backported via #​17092)

🏷️ Housekeeping

• ⬆️ Bumped DCP (Microsoft.DeveloperControlPlane) from 0.23.5 → 0.23.6 — includes fixes for Kubernetes OpenAPI generator types that caused [SHOULD NOT HAPPEN] failed to update managedFields errors. (#​17070)
• 🚀 Bumped branding to 13.3.3 (#​17088)

---

Full commit: a4615e7c6def6cba4703cdbd84009cd3da9a261b

Commits viewable in compare view.

Updated Microsoft.Extensions.ServiceDiscovery.Yarp from 10.4.0 to 10.6.0.

Release notes

Sourced from Microsoft.Extensions.ServiceDiscovery.Yarp's releases.

10.6.0

Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.

Experimental API Changes

Now Stable

• ResponseContinuationToken and background-response APIs are now stable (previously MEAI001) #​7512

What's Changed

AI

• Stabilize ResponseContinuationToken / background-response APIs #​7512 by @​jozkee (co-authored by @​Copilot)

Repository Infrastructure Updates

• Update version to 10.6.0 #​7458 by @​jeffhandley
• [main] Update dependencies from dotnet/arcade #​7451
• Bump follow-redirects from 1.15.11 to 1.16.0 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/azure-devops-report/tasks/PublishAIEvaluationReport #​7469
• Merge release/10.5 into main #​7470 by @​jeffhandley
• Bump microsoft.visualstudio.slngen.tool from 12.0.13 to 12.0.32 #​7484
• Bump postcss from 8.5.9 to 8.5.12 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7494
• Bump dotnet-reportgenerator-globaltool from 5.5.7 to 5.5.9 #​7504
• Rename release-notes skill to write-release-notes #​7511 by @​jeffhandley (co-authored by @​Copilot)

Acknowledgements

• @​wtgodbe @​tarekgh @​peterwald @​JeremyLikness @​eiriktsarpalis @​ericstj @​evgenyfedorov2 reviewed pull requests

Full Changelog: dotnet/extensions@v10.5.2...v10.6.0

10.5.2

This patch release ships a single fix to Microsoft.Extensions.VectorData.Abstractions, correcting StorageName resolution when external serialization is enabled. Microsoft.Extensions.VectorData.ConformanceTests, Microsoft.Extensions.AI.Abstractions, Microsoft.Extensions.AI, and Microsoft.Extensions.AI.OpenAI are published alongside it for version coherency — they contain no code changes from 10.5.1.

Packages in this release

Package	Version
Microsoft.Extensions.VectorData.Abstractions	10.5.2
Microsoft.Extensions.VectorData.ConformanceTests	10.5.2
Microsoft.Extensions.AI.Abstractions	10.5.2
Microsoft.Extensions.AI	10.5.2
Microsoft.Extensions.AI.OpenAI	10.5.2

What's Changed

Microsoft.Extensions.VectorData.Abstractions

• Minor fixes to MEVD.Abstractions: correct StorageName behavior when external serialization is enabled, and disable a warning for net462. (by @​roji in #​7475)

Full Changelog: dotnet/extensions@v10.5.1...v10.5.2

10.5.1

Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.

The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.

Packages in this release

Package	Version
Microsoft.Extensions.AI	10.5.1
Microsoft.Extensions.AI.Abstractions	10.5.1
Microsoft.Extensions.AI.OpenAI	10.5.1
Microsoft.Extensions.AI.Templates	10.5.1-preview.3.26251.3
Microsoft.Agents.AI.ProjectTemplates	1.3.0-preview.1.26251.3

Experimental API Changes

Now Stable

The following types previously emitted the MEAI001 experimental diagnostic and are now stable.

• CodeInterpreter and WebSearch tool content types are now stable #​7493
  • CodeInterpreterToolCallContent
  • CodeInterpreterToolResultContent
  • WebSearchToolCallContent
  • WebSearchToolResultContent
• ImageGeneration tool content types and tool are now stable #​7476
  • ImageGenerationToolCallContent
  • ImageGenerationToolResultContent
  • HostedImageGenerationTool
  • ImageGenerationOptions
  • ImageGenerationResponseFormat (the Hosted enum value remains experimental)
  • IImageGenerator and the rest of the image generation infrastructure also remain experimental

New Experimental APIs

The following new APIs emit the MEAI001 experimental diagnostic.

• New experimental API: HostedToolSearchTool with DeferredTools for tool-search-driven deferred tool loading #​7471
• New experimental API: OpenAIRequestPolicies extension hook for appending System.ClientModel.PipelinePolicy instances to outgoing OpenAI requests #​7495

Breaking Changes to Experimental APIs

• WebSearchToolResultContent.Results was renamed to Outputs as part of the stabilization in #​7493, aligning with CodeInterpreterToolResultContent.Outputs. The original Results property was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.

  WebSearchToolResultContent content = ...;
  - IList<AIContent>? items = content.Results;
  + IList<AIContent>? items = content.Outputs;

... (truncated)

10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

1. Rename VectorStoreVectorAttribute constructor parameter #​7460
   • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
   • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

• HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

• Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
• Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
• Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
• Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
• Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
• Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
• Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

• Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
• Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

• Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
• Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

• Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

• Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

• Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

... (truncated)

10.4.1

This release of the Microsoft.Extensions.AI packages adds new experimental APIs for Realtime client sessions and Text-to-Speech, along with OpenTelemetry and middleware improvements.

Packages in this release

Package	Version
Microsoft.Extensions.AI.Abstractions	10.4.1
Microsoft.Extensions.AI	10.4.1
Microsoft.Extensions.AI.OpenAI	10.4.1

Experimental API Changes

New Experimental APIs

• New experimental API: Realtime Client Sessions #​7285 and #​7399
• New experimental API: Text-to-Speech Client #​7381

Changes to Experimental APIs

• Hosted File Download Stream: write-path methods now explicitly throw NotSupportedException #​7394

What's Changed

AI

• Add ITextToSpeechClient abstraction, middleware, and OpenAI implementation #​7381 by @​stephentoub
• Realtime Client Proposal #​7285 by @​tarekgh
• Add VoiceActivityDetection options to realtime session abstractions #​7399 by @​tarekgh
• Make UriContent mediaType parameter optional with inference from URI file extension #​7398 by @​stephentoub (co-authored by @​Copilot)
• Emit gen_ai.client.operation.exception via ILogger LoggerMessage on OpenTelemetry instrumentation classes #​7379 by @​stephentoub (co-authored by @​Copilot)
• Support invoke_workflow as an equivalent parent span to invoke_agent in FunctionInvokingChatClient #​7382 by @​stephentoub (co-authored by @​Copilot)
• Make HostedFileDownloadStream explicitly read-only #​7394 by @​stephentoub (co-authored by @​Copilot)

Documentation Updates

• Document JSON schema derivation for return types in AIFunctionFactory #​7400 by @​stephentoub (co-authored by @​Copilot)

Test Improvements

• Fix test warnings #​7369 by @​jozkee
• Add tests for JSON deserialization of serializable types #​7373 by @​stephentoub (co-authored by @​Copilot)

Repository Infrastructure Updates

• Update Package Validation Baseline to 10.4.0 #​7389 by @​jeffhandley (co-authored by @​Copilot)
• Update ModelContextProtocol libraries to version 1.0.0 #​7340 by @​stephentoub (co-authored by @​Copilot)

Acknowledgements

• @​eiriktsarpalis @​ericstj @​CodeBlanch @​lmolkova @​adamsitnik @​joperezr reviewed pull requests
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions