chore(deps): update .net dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
Aspire.AppHost.Sdk	13.2.2 → 13.2.4			msbuild-sdk	patch
Aspire.Hosting.AppHost	13.2.2 → 13.2.4			nuget	patch
Aspire.Hosting.Azure.AppContainers	13.2.2 → 13.2.4			nuget	patch
Aspire.Hosting.Azure.PostgreSQL	13.2.2 → 13.2.4			nuget	patch
Aspire.Hosting.Azure.Sql	13.2.2 → 13.2.4			nuget	patch
Aspire.Hosting.JavaScript	13.2.2 → 13.2.4			nuget	patch
Aspire.Hosting.Testing	13.2.2 → 13.2.4			nuget	patch
Aspire.Microsoft.EntityFrameworkCore.SqlServer	13.2.2 → 13.2.4			nuget	patch
Aspire.Npgsql.EntityFrameworkCore.PostgreSQL	13.2.2 → 13.2.4			nuget	patch
Azure.Extensions.AspNetCore.Configuration.Secrets (source)	1.5.0 → 1.5.1			nuget	patch
Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.AspNetCore.Identity.EntityFrameworkCore (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.AspNetCore.Mvc.Testing (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.AspNetCore.OpenApi (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.EntityFrameworkCore (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.EntityFrameworkCore.Design (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.EntityFrameworkCore.Sqlite (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.Extensions.ApiDescription.Server (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.Extensions.Hosting (source)	10.0.5 → 10.0.7			nuget	patch
Microsoft.Extensions.Http.Resilience (source)	10.4.0 → 10.5.0			nuget	minor
Microsoft.Extensions.ServiceDiscovery (source)	10.4.0 → 10.5.0			nuget	minor
Microsoft.NET.Test.Sdk	18.4.0 → 18.5.1			nuget	minor
NUnit.Analyzers	4.12.0 → 4.13.0			nuget	minor
OpenTelemetry.Exporter.OpenTelemetryProtocol (source)	1.15.2 → 1.15.3			nuget	patch
OpenTelemetry.Extensions.Hosting (source)	1.15.2 → 1.15.3			nuget	patch
OpenTelemetry.Instrumentation.AspNetCore (source)	1.15.1 → 1.15.2			nuget	patch
OpenTelemetry.Instrumentation.Http (source)	1.15.0 → 1.15.1			nuget	patch
OpenTelemetry.Instrumentation.Runtime (source)	1.15.0 → 1.15.1			nuget	patch
Scalar.AspNetCore (source)	2.13.22 → 2.14.11			nuget	minor
System.IdentityModel.Tokens.Jwt	8.17.0 → 8.18.0			nuget	minor
dotnet-sdk	10.0.201 → 10.0.203			dotnet-sdk	patch

---

Release Notes

microsoft/aspire (Aspire.AppHost.Sdk)

v13.2.4: Aspire 13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

• 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

• 🚀 Bumped branding to
  13.2.4 (#​16436)

v13.2.3: Aspire 13.2.3

What's New in Aspire 13.2.3

Patch release focused on CLI packaging, signing, and reliability fixes.

🐛 Fixes

• 🛑 aspire stop now properly cleans up application containers on Windows (#​16123)
• 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#​16053)
• ✍️ Fixed signing for the aspire-managed bundle payload (#​16211)
• 🎭 Fixed Playwright CLI provenance verification for the new tag format (#​16134)
• 🧭 Updated service discovery environment variables (#​16223)

🔧 Improvements

• 📊 Removed telemetry API data limits and refactored URL builders (#​16023)
• ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#​16212)

🏷️ Housekeeping

• 🔖 Bumped branding to 13.2.3 (#​16181)
• 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#​16276, #​16285)

Azure/azure-sdk-for-net (Azure.Extensions.AspNetCore.Configuration.Secrets)

v1.5.1

Compare Source

1.5.1 (2026-04-29)

Other Changes

• Adopted the new Azure.Core version that includes the identity types moved from Azure.Identity.

dotnet/dotnet (Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore)

v10.0.7

v10.0.6

dotnet/extensions (Microsoft.Extensions.Http.Resilience)

v10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

1. Rename VectorStoreVectorAttribute constructor parameter #​7460
   • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
   • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

• HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

• Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
• Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
• Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
• Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
• Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
• Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
• Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

• Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
• Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

• Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
• Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

• Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

• Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

• Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

• Fix SqliteVectorStoreWriterTests hang: reduce test record count and use conditional MaxTopCount #​7360 by @​stephentoub (co-authored by @​copilot)

Repository Infrastructure Updates

• Bump minimatch and azure-pipelines-task-lib in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7361
• Remove stale user-level .npmrc instead of npmAuthenticate #​7366 by @​ilonatommy
• [main] Update dependencies from dotnet/arcade #​7374
• Use env vars in build.ps1 to bypass stale agent npm config #​7376 by @​ilonatommy
• Add a Release-Notes skill #​7390 by @​jeffhandley
• Enable CFSClean* policies for extensions-ci-official pipeline #​7403 by @​mmitche
• Fix CG alerts for Microsoft.Bcl.Memory #​7418 by @​wtgodbe
• Bump flatted from 3.3.3 to 3.4.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7421
• [main] Update dependencies from dotnet/arcade #​7422
• Bump picomatch from 2.3.1 to 2.3.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7427
• Bump picomatch in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7429
• Stop using Mariner 2 images #​7431 by @​wtgodbe
• [main] Update dependencies from dotnet/arcade #​7435
• Bump brace-expansion from 1.1.12 to 1.1.13 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7440
• Bump lodash from 4.17.23 to 4.18.1 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7455
• Bump vite from 6.4.1 to 6.4.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7456
• Correctly publish MEVD.ConformanceTests as nuget packages #​7459 by @​roji
• Update ApiChief baselines for MEAI and MEVD #​7461 by @​jeffhandley
• Upgrade to OpenAI 2.10.0 #​7450 by @​stephentoub
• Use shared DiagnosticIds constants for MEVD experimental APIs #​7462 by @​jeffhandley

Acknowledgements

• @​shyamnamboodiripad @​rogerbarreto @​ReubenBond @​evgenyfedorov2 @​tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.4.1...v10.5.0

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.5.1

What's Changed

• Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) by @​nohwnd in #​15720
• Port verify-binding-redirects.ps1 to rel/18.5 by @​nohwnd in #​15719
• Bump to 18.5.1 by @​nohwnd in #​15721

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

v18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

• Add runtime configs by @​nohwnd in #​15377
• Add net8.0 target for TranslationLayer by @​nohwnd in #​15375
• Determine architecture of remote process on windows by @​nohwnd in #​15396
• Updating System.Collections.Immutable package reference to version 9.0.0 by @​MSLukeWest in #​15392
• Dump via netcore tool on windows by @​nohwnd in #​15397
• Fix answer file splitting by @​nohwnd in #​15381
• Run tests against vsix runner by @​nohwnd in #​15419

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

nunit/nunit.analyzers (NUnit.Analyzers)

v4.13.0: NUnit Analyzers 4.13 - May 2, 2026

Compare Source

NUnit Analyzers 4.13 - May 2, 2026

This release of the NUnit Analyzers updates analyzer handling for the NUnit 4.6 API change that replaces
ActualValueDelegate<> with Func<> - see nunit/nunit#4824 for more information.
Analyzers now also consider the return type of Func<> in assertions. The release also includes one bug fix and
some dependency updates.

The release contains contributions from the following users (in alphabetical order):

• @​manfred-brands
• @​mikkelbu
• @​RenderMichael

Issues Resolved

Features and Enhancements

• #​982 Recognized Func<T> return values

Bugs

• #​968 Whitespace issue in Does.Contain fixer when assert spans multiple lines

Tooling, Process, and Documentation

• #​985 chore: Bump year to 2026 in copyrights
• #​978 Bump cake.tool from 6.0.0 to 6.1.0
• #​976 chore: Correct documentation
• #​975 chore: bump version
• #​956 Bump cake.tool from 4.0.0 to 6.0.0

open-telemetry/opentelemetry-dotnet (OpenTelemetry.Exporter.OpenTelemetryProtocol)

v1.15.3

Release details: 1.15.3

• Breaking change: Fixed tracestate parsing to reject keys that do not
  begin with a lowercase letter, including keys beginning with digits, to
  align with the W3C Trace Context specification.
• Breaking change: Fixed an insecure disk retry default for OTLP export.
  Disk retry now requires OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH
  when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk is configured.
• Improve efficiency of parsing of baggage and B3 propagation headers.
• OtlpLogExporter now uses IHttpClientFactory on .NET 8+.
• Fixed an issue in OTLP/gRPC retry handling when parsing gRPC statuses.
• Fixed OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT not being applied.
• Fixed baggage and trace headers not respecting the maximum length in some cases.
• Fixed BaggagePropagator to trim optional whitespace (OWS) around =
  separators when parsing the baggage header.
• Fixed BaggagePropagator to strip baggage properties from values when
  parsing the baggage header.
• Fixed OTLP persistent storage clean-up handling for malformed filenames.
• Fixed resource leak in batch and periodic exporting task workers for Blazor/WASM.
• Fixed LogRecord.LogLevel to preserve LogLevel.None.
• Fixed OTEL_TRACES_SAMPLER_ARG handling for out-of-range values.
• Fixed an issue with OTLP disk retry storage where metrics and logs used the
  traces storage directory.
• Fixed full OTLP endpoint being logged by internal diagnostics.
• Improve efficiency of parsing of baggage, B3 and Jaeger propagation headers.
• Hardened Zipkin exporter memory usage for endpoint caching and array tag
  serialization.

open-telemetry/opentelemetry-dotnet-contrib (OpenTelemetry.Instrumentation.Http)

v1.15.1

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet (System.IdentityModel.Tokens.Jwt)

v8.18.0

Compare Source

New Features

• Introduced a new interface IConfigurationEventHandlerContextAware<T> that provides context to the configuration event handler implementation, allowing it to optionally bypass a cache lookup. See PR #​3444.
• Added Microsoft.IdentityModel.Dpop — a new package implementing DPoP (Demonstrating Proof-of-Possession) per RFC 9449. Provides both client-side and server-side proof validation with no System.Net.Http dependency. See PR #​3443.

---

Configuration

📅 Schedule: (in timezone Australia/Brisbane)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.