Skip to content

Update dependency Aspire.Hosting.AppHost to 13.4.5#52

Open
dependencyupdates[bot] wants to merge 1 commit into
mainfrom
renovate/aspire.hosting.apphost-13.x
Open

Update dependency Aspire.Hosting.AppHost to 13.4.5#52
dependencyupdates[bot] wants to merge 1 commit into
mainfrom
renovate/aspire.hosting.apphost-13.x

Conversation

@dependencyupdates

@dependencyupdates dependencyupdates Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
Aspire.Hosting.AppHost 13.4.413.4.5 age adoption passing confidence

Release Notes

microsoft/aspire (Aspire.Hosting.AppHost)

v13.4.5: Aspire 13.4.5

What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security advisory, tightening CLI validation for Playwright configuration, and adding coding-agent detection to CLI telemetry.

🐛 Fixes
  • 🛡️ Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory — The transitive MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell within the advisory's vulnerable LZ4 decompression range. Aspire does not use MessagePackFormatter or LZ4 — all StreamJsonRpc calls use SystemTextJsonFormatter over local Unix sockets — so the vulnerability was not reachable in practice. The bump clears the NU1903 warning for consumers of the Aspire.Hosting package. (#​18204, @mitchdenny)
  • 🎭 playwrightCliVersion values that are not valid SemVer 2.0 now fail fast with a clear diagnostic — Previously an invalid override (range expression, dist-tag like latest, or a v-prefixed string) would surface as a generic npm resolution failure. The value is now validated with strict SemVer parsing at startup; an error naming the configuration key and the offending value is emitted immediately. (#​18205, @mitchdenny)
  • 🤖 CLI telemetry now detects and reports the calling coding agent — When the Aspire CLI is invoked from inside a known coding agent environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent name is included in the main CLI telemetry event. GitHub Copilot CLI is specifically identified as copilot-cli. (#​18240, @damianedwards)
🏷️ Housekeeping
  • 📄 Refreshed the @microsoft/aspire-cli npm package README to be TypeScript-only — updated examples to the current ts-starter template (apphost.mts / aspire.mjs), added a backing-services snippet showing aspire add for PostgreSQL and Redis, and documented aspire dashboard run as a standalone dashboard option. (#​18221, @adamint)

Full Changelog: v13.4.4...v13.4.5

Full commit: 73114e86c64aeb9f3f3c7da8e37df1ae4281b27e

Generated by Generate release notes for a new stable Aspire release · ● 4.4M


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Commands to ignore dependencies

You can trigger dependency actions by commenting on this PR:

  • @particularbot ignore this major version
  • @particularbot ignore this minor version
  • @particularbot ignore this dependency

@dependencyupdates dependencyupdates Bot changed the title Update dependency Aspire.Hosting.AppHost to 13.4.3 Update dependency Aspire.Hosting.AppHost to 13.4.3 - autoclosed Jun 9, 2026
@dependencyupdates dependencyupdates Bot closed this Jun 9, 2026
@dependencyupdates dependencyupdates Bot deleted the renovate/aspire.hosting.apphost-13.x branch June 9, 2026 03:21
@dependencyupdates dependencyupdates Bot changed the title Update dependency Aspire.Hosting.AppHost to 13.4.3 - autoclosed Update dependency Aspire.Hosting.AppHost to 13.4.4 Jun 15, 2026
@dependencyupdates dependencyupdates Bot reopened this Jun 15, 2026
@dependencyupdates dependencyupdates Bot force-pushed the renovate/aspire.hosting.apphost-13.x branch 2 times, most recently from 783a59f to 3649f56 Compare June 15, 2026 11:20
@dependencyupdates dependencyupdates Bot changed the title Update dependency Aspire.Hosting.AppHost to 13.4.4 Update dependency Aspire.Hosting.AppHost to 13.4.4 - autoclosed Jun 16, 2026
@dependencyupdates dependencyupdates Bot changed the title Update dependency Aspire.Hosting.AppHost to 13.4.4 - autoclosed Update dependency Aspire.Hosting.AppHost to 13.4.5 Jun 17, 2026
@dependencyupdates dependencyupdates Bot reopened this Jun 17, 2026
@dependencyupdates dependencyupdates Bot force-pushed the renovate/aspire.hosting.apphost-13.x branch 2 times, most recently from 3649f56 to c49602a Compare June 17, 2026 04:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants