Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
AWSSDK.S3	4.0.18.7 → 4.0.23					nuget	patch
FastEndpoints (source)	8.0.1 → 8.1.0					nuget	minor
FastEndpoints.Generator (source)	8.0.1 → 8.1.0					nuget	minor
FastEndpoints.Security (source)	8.0.1 → 8.1.0					nuget	minor
FastEndpoints.Swagger (source)	8.0.1 → 8.1.0					nuget	minor
FastEndpoints.Testing (source)	8.0.1 → 8.1.0					nuget	minor
Microsoft.AspNetCore.Authentication.JwtBearer (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.AspNetCore.Identity.EntityFrameworkCore (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.AspNetCore.OpenApi (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.AspNetCore.OutputCaching.StackExchangeRedis (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.EntityFrameworkCore.InMemory (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.EntityFrameworkCore.Tools (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.Extensions.Caching.Hybrid (source)	10.3.0 → 10.5.0					nuget	minor
Microsoft.Extensions.Caching.StackExchangeRedis (source)	10.0.3 → 10.0.7					nuget	patch
Microsoft.Extensions.Http.Resilience (source)	10.3.0 → 10.5.0					nuget	minor
Microsoft.Extensions.TimeProvider.Testing (source)	10.3.0 → 10.5.0					nuget	minor
Microsoft.NET.Test.Sdk	18.3.0 → 18.5.1					nuget	minor
MinecraftRenderer	0.4.2 → 0.6.0					nuget	minor
Npgsql	10.0.1 → 10.0.2					nuget	patch
Npgsql.EntityFrameworkCore.PostgreSQL	10.0.0 → 10.0.1					nuget	patch
OpenTelemetry.Extensions.Hosting (source)	1.15.0 → 1.15.3					nuget	patch
Pyroscope (source)	0.14.1 → 0.15.0					nuget	minor
Quartz.Extensions.Hosting (source)	3.16.1 → 3.18.1					nuget	minor
Refit	10.0.1 → 10.1.6					nuget	minor
Refit.HttpClientFactory	10.0.1 → 10.1.6					nuget	minor
Scalar.AspNetCore (source)	2.13.1 → 2.14.11					nuget	minor
SkyblockRepo	0.4.3 → 0.5.0					nuget	minor
StackExchange.Redis (source)	2.11.8 → 2.12.14					nuget	minor
Swashbuckle.AspNetCore	10.1.4 → 10.1.7					nuget	patch
Swashbuckle.AspNetCore.Annotations	10.1.4 → 10.1.7					nuget	patch
System.Linq.Async	7.0.0 → 7.0.1					nuget	patch
System.Threading.RateLimiting (source)	10.0.3 → 10.0.7					nuget	patch
Testcontainers.PostgreSql (source)	4.10.0 → 4.11.0					nuget	minor
ZLinq	1.5.5 → 1.5.6					nuget	patch
coverlet.collector	8.0.0 → 8.0.1					nuget	patch
dotnet-ef (source)	10.0.1 → 10.0.7					nuget	patch
dotnet-sdk	10.0.0 → 10.0.203					dotnet-sdk	patch
prom/prometheus	v3.5.0 → v3.11.3						minor
pyroscope/pyroscope-dotnet	0.13.0-glibc → 0.14.5-glibc					stage	minor

---

Release Notes

aws/aws-sdk-net (AWSSDK.S3)

v4.0.23

v4.0.22

v4.0.21

v4.0.20

v4.0.19

dotnet/dotnet (Microsoft.AspNetCore.Authentication.JwtBearer)

v10.0.7

v10.0.6

v10.0.5

v10.0.4

dotnet/extensions (Microsoft.Extensions.Caching.Hybrid)

v10.5.0

HTTP Logging Middleware APIs in Microsoft.AspNetCore.Diagnostics.Middleware are now stable. This release also transfers Microsoft.Extensions.VectorData.Abstractions and Microsoft.Extensions.VectorData.ConformanceTests from the Semantic Kernel repository into dotnet/extensions, jumping from 10.1.0 to 10.5.0 for consistent versioning. The release also delivers fixes across the AI libraries, AI Evaluation, and Service Discovery.

Breaking Changes

1. Rename VectorStoreVectorAttribute constructor parameter #​7460
   • The Dimensions parameter was renamed to dimensions (lowercase). This is a source-breaking change only — binary compatibility is preserved.
   • If you use the named argument syntax new VectorStoreVectorAttribute(Dimensions: 1536), update it to new VectorStoreVectorAttribute(dimensions: 1536).

Experimental API Changes

Now Stable

• HTTP Logging Middleware APIs are now stable (previously EXTEXP0013): AddHttpLogEnricher<T>, IHttpLogEnricher, and RequestHeadersLogEnricherOptions.HeadersDataClasses #​7380

What's Changed

AI

• Fix OpenAIResponsesChatClient to respect "store":false in responses #​7417 by @​stephentoub
• Fix InvalidOperationException in CoalesceWebSearchToolCallContent #​7419 by @​stephentoub
• Handle F# optional parameters in AIFunctionFactory schema generation #​7439 by @​eiriktsarpalis
• Fix ComputerCallResponseItem using Item.Id instead of CallId #​7446 by @​jozkee
• Fix HostedFileContent with image MIME type sent as input_file instead of input_image #​7438 by @​stephentoub (co-authored by @​copilot)
• Guard Activity.Current restore with null check in OpenTelemetry streaming clients #​7443 by @​stephentoub (co-authored by @​copilot)
• Enable stateless mode in remote MCP server template (released as v1.2.0 on 2026-04-01) #​7441 by @​jeffhandley

Vector Data

• Move Microsoft.Extensions.VectorData.Abstractions over from Semantic Kernel #​7434 by @​roji
• Rename VectorStoreVectorAttribute dimensions constructor parameter #​7460 by @​roji

AI Evaluation

• Add Path Validation for DiskBasedResponseCache and DiskBasedResultStore #​7397 by @​peterwald
• Update brace-expansion for CVE-2026-33750 #​7457 by @​SamMonoRT

ASP.NET Core Extensions

• Removing experimental attribute from Http logging middleware #​7380 by @​mariamgerges

Service Discovery

• Implement RFC6761 reserved DNS names handling #​6924 by @​rzikm

Documentation Updates

• Remove per-library CHANGELOG.md files #​7413 by @​jeffhandley

Test Improvements

• Fix SqliteVectorStoreWriterTests hang: reduce test record count and use conditional MaxTopCount #​7360 by @​stephentoub (co-authored by @​copilot)

Repository Infrastructure Updates

• Bump minimatch and azure-pipelines-task-lib in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7361
• Remove stale user-level .npmrc instead of npmAuthenticate #​7366 by @​ilonatommy
• [main] Update dependencies from dotnet/arcade #​7374
• Use env vars in build.ps1 to bypass stale agent npm config #​7376 by @​ilonatommy
• Add a Release-Notes skill #​7390 by @​jeffhandley
• Enable CFSClean* policies for extensions-ci-official pipeline #​7403 by @​mmitche
• Fix CG alerts for Microsoft.Bcl.Memory #​7418 by @​wtgodbe
• Bump flatted from 3.3.3 to 3.4.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7421
• [main] Update dependencies from dotnet/arcade #​7422
• Bump picomatch from 2.3.1 to 2.3.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7427
• Bump picomatch in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7429
• Stop using Mariner 2 images #​7431 by @​wtgodbe
• [main] Update dependencies from dotnet/arcade #​7435
• Bump brace-expansion from 1.1.12 to 1.1.13 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7440
• Bump lodash from 4.17.23 to 4.18.1 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7455
• Bump vite from 6.4.1 to 6.4.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7456
• Correctly publish MEVD.ConformanceTests as nuget packages #​7459 by @​roji
• Update ApiChief baselines for MEAI and MEVD #​7461 by @​jeffhandley
• Upgrade to OpenAI 2.10.0 #​7450 by @​stephentoub
• Use shared DiagnosticIds constants for MEVD experimental APIs #​7462 by @​jeffhandley

Acknowledgements

• @​shyamnamboodiripad @​rogerbarreto @​ReubenBond @​evgenyfedorov2 @​tarekgh reviewed pull requests

Full Changelog: dotnet/extensions@v10.4.1...v10.5.0

v10.4.0

This release advances the AI abstractions with new hosted file, web search, and reasoning content types, stabilizes MCP and tool approval APIs, adds streaming latency metrics to OpenTelemetry instrumentation, and delivers bug fixes across caching, data ingestion, and resource monitoring.

Experimental API Changes

Now Stable

• MCP Server Tool Content and Function Call Approval APIs are now stable (previously MEAI001) #​7299
• FakeLogCollector.GetLogsAsync(CancellationToken) is now stable (previously EXTEXP0003) #​7332

New Experimental APIs

• New experimental AddExtendedHttpClientLogging overloads with wrapHandlersPipeline parameter (EXTEXP0013) #​7231

Removed Experimental APIs

• AI Tool Reduction experimental APIs removed (was experimental under MEAI001) #​7353

What's Changed

AI

• Add IHostedFileClient and friends #​7269 by @​stephentoub
• Add web search tool call content #​7276 by @​stephentoub (co-authored by @​Copilot)
• Surface OpenAI-compatible reasoning_content as TextReasoningContent #​7295 by @​stephentoub
• MCP/Approvals/Tool Contents stabilization #​7299 by @​jozkee
• Implement time_to_first_chunk and time_per_output_chunk streaming metrics in OpenTelemetryChatClient #​7325 by @​stephentoub (co-authored by @​Copilot)
• Add openai.api.type telemetry attribute to OpenAI IChatClient implementations #​7316 by @​stephentoub (co-authored by @​Copilot)
• Update OpenTelemetry Gen AI semantic conventions to v1.40 #​7322 by @​stephentoub (co-authored by @​Copilot)
• Fix tool definitions emission regardless of sensitivity setting #​7346 by @​stephentoub (co-authored by @​Copilot)
• Honor [Required] attribute in AI function parameter JSON schema generation #​7272 by @​stephentoub (co-authored by @​Copilot)
• AddAIContentType automatically registers content type against every base in the inheritance chain up to AIContent #​7358 by @​jozkee (co-authored by @​Copilot)
• Auto-mark server-handled FunctionCallContent as InformationalOnly #​7314 by @​stephentoub (co-authored by @​Copilot)
• Map ReasoningEffort.None and ExtraHigh to none and xhigh in OpenAI IChatClient implementations #​7319 by @​stephentoub (co-authored by @​Copilot)
• Handle DynamicMethod reflection limitations in AIFunctionFactory #​7287 by @​stephentoub (co-authored by @​Copilot)
• Fix Activity.Current nulled during streaming tool invocation #​7321 by @​flaviocdc (co-authored by @​Copilot)
• Handle FunctionCallOutputResponseItem in streaming response conversion #​7307 by @​stephentoub (co-authored by @​Copilot)
• Fix serialization of response continuation tokens #​7356 by @​stephentoub
• Remove AI Tool Reduction experimental APIs #​7353 by @​stephentoub (co-authored by @​Copilot)
• Update OpenAI to 2.9.1 #​7349 by @​stephentoub

Telemetry and Observability

• Introduce support for the Gauge metric type #​7203 by @​rainsxng
• Update logging source generator to support generic methods #​7331 by @​svick (co-authored by @​Copilot)
• Update logging source generator to match runtime PR #​124589 (ref readonly/params/scoped) #​7333 by @​svick (co-authored by @​Copilot)
• Promote FakeLogCollector.GetLogsAsync(CancellationToken) from experimental to stable #​7332 by @​Demo30
• Remove obsolete CS1591 warning suppression from generated file preamble #​7308 by @​luissena

HTTP Resilience and Diagnostics

• Expose wrapHandlersPipeline parameter in AddExtendedHttpClientLogging API #​7231 by @​rainsxng (co-authored by @​Copilot)

Diagnostics, Health Checks, and Resource Monitoring

• Add scaling to [0, 100] for LinuxUtilizationProvider #​7289 by @​amadeuszl

Data Ingestion

• Fix infinite loop in GetPreExistingChunksIdsAsync when records exceed MaxTopCount #​7311 by @​adamsitnik (co-authored by @​Copilot)

Caching

• Fix buffer copying for HybridCachePayload. #​7343 by @​cincuranet

Test Improvements

• Fix flaky LinuxResourceHealthCheckTests by isolating MeterListener with ReferenceEquals #​7302 by @​stephentoub (co-authored by @​Copilot)
• Fix flaky resource monitoring test #​7303 by @​stephentoub
• Fix flaky HttpRequestBuffering_DoesNotBufferDisabledOrOversizedLogs test #​7304 by @​stephentoub (co-authored by @​Copilot)
• Fix race condition in FakeLogCollector async enumeration test #​7300 by @​stephentoub (co-authored by @​Copilot)
• Fix cgroupv1 acceptance test to explicitly register the v1 parser #​7296 by @​stephentoub (co-authored by @​Copilot)

Repository Infrastructure Updates

• Update McpServer project template to ModelContextProtocol 1.1.0 #​7338 by @​jeffhandley (co-authored by @​Copilot)
• Update aiagent-webapi template to latest Agent Framework versions (rc1/260219) #​7339 by @​jeffhandley (co-authored by @​Copilot)
• Update SDK and dotnet version to 10.0.103 #​7326 by @​wtgodbe
• Introduce an ApiChief skill to streamline updating API baselines #​7281 by @​jeffhandley (co-authored by @​Copilot)
• Update ApiChief script to use the net10.0 artifacts #​7280 by @​jeffhandley
• Replace Windows queue image references from vs2022preview to vs2022 in pipeline YAML #​7347 by @​wtgodbe (co-authored by @​Copilot)
• Update public pipeline pool images to fix broken builds #​7292 by @​joperezr
• Use smaller windows.vs2022.amd64.open pool image #​7298 by @​joperezr
• Remove main-to-dev inter-branch merge automation #​7315 by @​joperezr (co-authored by @​Copilot)
• Updating FakeLogCollector API baselines #​7334 by @​Demo30
• Run the issue-labeler over pull requests using polling #​7273 by @​jeffhandley (co-authored by @​Copilot)
• Add npmAuthenticate task to fix npm E401 errors on CI agents #​7364 by @​ilonatommy (co-authored by @​Copilot)
• Pass sourceIndexBuildCommand through to SourceIndex #​7348 by @​wtgodbe
• Bump qs from 6.14.1 to 6.14.2 in /src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript #​7301
• Bump rollup from 4.40.0 to 4.59.0 #​7345

Acknowledgements

• @​luissena made their first contribution in #​7308
• @​flaviocdc made their first contribution in #​7321
• @​bryjen submitted issue #​7271 (resolved by #​7272)
• @​vsantele submitted issue #​7306 (resolved by #​7307)
• @​evgenyfedorov2 @​eiriktsarpalis @​tarekgh @​ericstj @​iliar-turdushev @​rogerbarreto @​shyamnamboodiripad @​DeagleGross @​MihaZupan @​akoeplinger @​mattleibow @​rafal-mz @​roji @​rosebyte reviewed pull requests

Full Changelog: dotnet/extensions@v10.3.0...v10.4.0

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.5.1

What's Changed

• Fix System.Collections.Immutable binding mismatch in Common.dll (rel/18.5) by @​nohwnd in #​15720
• Port verify-binding-redirects.ps1 to rel/18.5 by @​nohwnd in #​15719
• Bump to 18.5.1 by @​nohwnd in #​15721

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

v18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

• Add runtime configs by @​nohwnd in #​15377
• Add net8.0 target for TranslationLayer by @​nohwnd in #​15375
• Determine architecture of remote process on windows by @​nohwnd in #​15396
• Updating System.Collections.Immutable package reference to version 9.0.0 by @​MSLukeWest in #​15392
• Dump via netcore tool on windows by @​nohwnd in #​15397
• Fix answer file splitting by @​nohwnd in #​15381
• Run tests against vsix runner by @​nohwnd in #​15419

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

v18.4.0

What's Changed

• Add LoongArch64 support by @​stdmnpkg in #​15359

• Refactor Condition evaluation by @​Youssef1313 in #​15357

• Adding info on extensions points part 1 by @​nohwnd in #​15360

• Add option to ask for uploading code QL before the standard window ends by @​nohwnd in #​15373

• Update runtime versions by @​nohwnd in #​15372

• Fix .NET 10 regression for traits by @​Youssef1313 in #​15370

• Update target frameworks to net10.0 and net11.0 by @​dotnet-maestro[bot] in #​15349

• Fix names in pipeline matrix so we don't have to align them by @​nohwnd in #​15365

• Update SECURITY.md by @​Youssef1313 in #​15342

New Contributors

• @​stdmnpkg made their first contribution in #​15359

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

npgsql/npgsql (Npgsql)

v10.0.2

v10.0.2 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v10.0.1...v10.0.2

open-telemetry/opentelemetry-dotnet (OpenTelemetry.Extensions.Hosting)

v1.15.3

Release details: 1.15.3

• Breaking change: Fixed tracestate parsing to reject keys that do not
  begin with a lowercase letter, including keys beginning with digits, to
  align with the W3C Trace Context specification.
• Breaking change: Fixed an insecure disk retry default for OTLP export.
  Disk retry now requires OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH
  when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk is configured.
• Improve efficiency of parsing of baggage and B3 propagation headers.
• OtlpLogExporter now uses IHttpClientFactory on .NET 8+.
• Fixed an issue in OTLP/gRPC retry handling when parsing gRPC statuses.
• Fixed OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT not being applied.
• Fixed baggage and trace headers not respecting the maximum length in some cases.
• Fixed BaggagePropagator to trim optional whitespace (OWS) around =
  separators when parsing the baggage header.
• Fixed BaggagePropagator to strip baggage properties from values when
  parsing the baggage header.
• Fixed OTLP persistent storage clean-up handling for malformed filenames.
• Fixed resource leak in batch and periodic exporting task workers for Blazor/WASM.
• Fixed LogRecord.LogLevel to preserve LogLevel.None.
• Fixed OTEL_TRACES_SAMPLER_ARG handling for out-of-range values.
• Fixed an issue with OTLP disk retry storage where metrics and logs used the
  traces storage directory.
• Fixed full OTLP endpoint being logged by internal diagnostics.
• Improve efficiency of parsing of baggage, B3 and Jaeger propagation headers.
• Hardened Zipkin exporter memory usage for endpoint caching and array tag
  serialization.

v1.15.2

Release details: 1.15.2

• Limit how much of the response body is read by the OTLP exporter when
  export fails and error logging is enabled.
• Added Task-based worker support for BatchExportProcessor and
  PeriodicExportingMetricReader to enable the OpenTelemetry SDK to work
  in single-threaded WebAssembly environments such as Blazor and
  Uno Platform.

v1.15.1

Release details: 1.15.1

• Breaking change: The Baggage API now disallows empty baggage names and
  treats baggage names and values as case sensitive, aligning with the latest
  Baggage API specification.
• Various bug fixes across OpenTelemetry.Api and OpenTelemetry SDK,
  including fixes for thread-safety, sampler edge cases, metrics precision,
  and observable instrument lifecycle handling.

quartznet/quartznet (Quartz.Extensions.Hosting)

v3.18.1

Quartz.NET 3.18.1 is a maintenance release that addresses a timezone-related bug, security advisories on transitive dependencies, and an issue that prevented the new Redis distributed-lock package from publishing to nuget.org.

Highlights

• Fix GetTimeBefore for positive-offset timezones — CronExpression.GetTimeBefore could throw ArgumentOutOfRangeException for cron expressions evaluated against timezones with positive UT

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.