Skip to content

[release/13.5] Constrain aspire-starter port replacers to localhost: URLs - #20110

Merged
Jose Perez Rodriguez (joperezr) merged 1 commit into
release/13.5from
backport/pr-20031-to-release/13.5
Sep 14, 2026
Merged

[release/13.5] Constrain aspire-starter port replacers to localhost: URLs#20110
Jose Perez Rodriguez (joperezr) merged 1 commit into
release/13.5from
backport/pr-20031-to-release/13.5

Conversation

@JamesNK

@JamesNK James Newton-King (JamesNK) commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Backport of #20031 to release/13.5

/cc James Newton-King (@JamesNK) Bart Koelman (@bart-vmware)

Customer Impact

Aspire Starter App generation can replace matching port-number literals in unrelated vendored JavaScript files, producing randomly different Bootstrap artifacts and noisy diffs between otherwise equivalent projects.

Testing

The source PR manually installed pre-fix and post-fix templates and generated projects with different ports. Before the fix, bootstrap.bundle.js changed; after the fix, launchSettings.json used the requested ports while bootstrap.bundle.js remained byte-for-byte identical.

Risk

Low. The change is limited to replacement conditions for ten dynamic port symbols and preserves substitutions in localhost: URL contexts.

Regression?

No

@bart-vmware @JamesNK
Constrain aspire-starter port replacers to localhost: URLs
0018a59 
The dynamic port symbols (webHttpPortReplacer, apiServiceHttpPortReplacer,
appHostHttpPortReplacer, etc.) used a bare numeric "replaces" value, so the
template engine substituted that number everywhere in generated content, not
just in launchSettings.json. Since the default ports (5000, 7000, 5301, 7301,
15000, 17000, 19000, 20000, 21000, 22000) also occur as plain numeric literals
in vendored files such as wwwroot/lib/bootstrap/dist/js/bootstrap.bundle.js
(e.g. carousel interval: 5000), those files ended up with churned values that
differ between generated projects, making diffs across template runs noisy.

Add "onlyIf": [{"after": "localhost:"}] to each port replacer so substitution
only fires in "localhost:<port>" contexts, matching the fix already applied
upstream for the same class of bug (dotnet/aspnetcore#65165, dotnet/sdk#48811).

Fixes #20030
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20110

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20110"

@aspire-repo-bot
aspire-repo-bot Bot requested a balanced review from Copilot September 14, 2026 09:26
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

1 / 100 test projects · 1 job, from 1 changed file.

Selected test projects (1 / 100)

Aspire.Templates.Tests

Selected jobs (1)

deployment-e2e

How these were chosen — grouped by what changed

🔧 src/Aspire.ProjectTemplates/templates/aspire-starter/.template.config/template.json (changed source)
→ 1 directly: Aspire.Templates.Tests

Job reasons

Job Triggered by
deployment-e2e src/Aspire.ProjectTemplates/templates/aspire-starter/.template.config/template.json

Selection computed for commit 0018a59.

Copilot AI reviewed Sep 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The regression is not protected by an automated template-generation test.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Constrains dynamic port replacement to localhost: URLs, preventing unintended changes to vendored JavaScript.

Changes:

  • Adds onlyIf conditions to all ten port replacers.
  • Preserves expected substitutions in launch settings.
File summaries
File Description
src/Aspire.ProjectTemplates/templates/aspire-starter/.template.config/template.json Restricts port substitutions to localhost URLs.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread src/Aspire.ProjectTemplates/templates/aspire-starter/.template.config/template.json Resolved
@JamesNK James Newton-King (JamesNK) added the Servicing-consider Issue for next servicing release review label Sep 14, 2026
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions github-actions Bot mentioned this pull request Sep 14, 2026
Open
@joperezr

Jose Perez Rodriguez (joperezr) commented Sep 14, 2026

Copy link
Copy Markdown
Member

Failure here is unrelated, it is because of missing #19965 which is now being backported. I'll go ahead and merge this in.

@joperezr
Jose Perez Rodriguez (joperezr) merged commit bd4a8e2 into release/13.5 Sep 14, 2026
1687 of 1703 checks passed
@joperezr
Jose Perez Rodriguez (joperezr) deleted the backport/pr-20031-to-release/13.5 branch September 14, 2026 16:59
@github-actions github-actions Bot added this to the 13.5.x milestone Sep 14, 2026
@microsoft-github-policy-service microsoft-github-policy-service Bot removed this from the 13.5.x milestone Sep 14, 2026
@aspire-repo-bot

aspire-repo-bot Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

✅ No documentation update needed.

Step 5 branch: excluded → base_branch_is_release, head_branch_is_backport, title_release_prefix, body_backport_marker

This PR is a backport (title [release/13.5] ..., body contains Backport of #20031 to release/13.5, head branch is a backport branch, and base branch is release/13.5). Per workflow policy, backport PRs are excluded from doc generation because user-facing documentation is authored against the original forward PR (#20031) on the default branch; drafting a second docs PR here would be duplicate noise.

Triggered signals (1): project_template_changed (evidence: src/Aspire.ProjectTemplates/templates/aspire-starter/.template.config/template.json matched path pattern ^src/Aspire\.ProjectTemplates/.+$).

No docs PR was drafted.

Merged
4 of 14 tasks
@bart-vmware

Bart Koelman (bart-vmware) commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Thanks!

@github-actions github-actions Bot mentioned this pull request Sep 15, 2026
Open
This was referenced Sep 15, 2026
Closed
Closed
Closed
Closed
Closed
Merged
Closed
This was referenced Oct 14, 2026
Closed
Closed
Closed
Rene Bentes Pinto (renebentes) pushed a commit to renebentes/3054 that referenced this pull request Oct 14, 2026
@dependabot
build: Bump Aspire.Npgsql.EntityFrameworkCore.PostgreSQL from 13.5.3 …
e4999f6 
…to 13.6.1 (#275)

Updated
[Aspire.Npgsql.EntityFrameworkCore.PostgreSQL](https://github.com/microsoft/aspire)
from 13.5.3 to 13.6.1.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Npgsql.EntityFrameworkCore.PostgreSQL's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.1

## What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during
sustained metric ingestion, restores scrolling in the Metrics tree,
improves dashboard navigation, fixes container exec watch failures, and
ensures session-scoped containers are cleaned up when stopping .NET
AppHosts on Windows.

### 🐛 Fixes

- 📊 **Dashboard CPU usage could increase during long-running metric
ingestion** — Metric retention repeatedly scanned retained history on
every insertion, causing steadily increasing CPU usage even with a fixed
workload. Cleanup now skips dimensions below capacity and removes only
the oldest surplus points when needed. Existing retention limits and
exemplar behavior are unchanged, and no configuration changes are
required. Regression introduced in 13.6. Fixes
[#​20725](microsoft/aspire#20725).
([#​20747](microsoft/aspire#20747), backport of
[#​20736](microsoft/aspire#20736), @​JamesNK)

- 📈 **The Metrics tree could not be scrolled** — The meter and
instrument tree now scrolls when it exceeds the viewport, allowing you
to reach and select instruments below the fold. Regression introduced in
13.6. Fixes [#​20728](microsoft/aspire#20728).
([#​20762](microsoft/aspire#20762), backport of
[#​20758](microsoft/aspire#20758), @​heyysiri)

- 🧭 **Dashboard navigation could fail after a browser disconnect** —
Pending page-state updates now persist session state before navigating
and skip navigation when the browser has disconnected, avoiding an
unhandled navigation failure. The navigation rail's overflow button also
has consistent sizing, icon alignment, and hover styling in expanded and
collapsed layouts and both light and dark themes.
([#​20545](microsoft/aspire#20545), backport of
[#​20527](microsoft/aspire#20527), @​JamesNK)

- 🖥️ **Container exec watches could terminate shortly after AppHost
startup** — A stalled DCP watch connection could produce a critical
`Watch task over Kubernetes ContainerExec resources terminated
unexpectedly` error and stop subsequent terminal state and log updates
from being observed. Watch connection attempts now retry after timeouts,
and periodic restarts correctly recreate connections without swallowing
unrelated cancellation. Regression introduced in 13.6.0.
([#​20664](microsoft/aspire#20664), backport of
[#​20466](microsoft/aspire#20466), @​radical)

- 🪟 **Session-scoped containers could remain running after stopping a
.NET AppHost on Windows** — AppHosts launched through `dotnet run` or
`dotnet watch` now allow DCP to finish resource cleanup during shutdown,
including existing Ctrl+C and `aspire stop` flows. Persistent resources
remain unaffected, while direct .NET launches and TypeScript/polyglot
AppHosts retain their existing process protection. Fixes
[#​20495](microsoft/aspire#20495).
([#​20514](microsoft/aspire#20514), backport of
[#​20494](microsoft/aspire#20494), @​danegsta)

---

*Full Changelog:
[v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)*

*Full commit:
[3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)*


## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


## 13.5.4

## What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource
leaks, DevTunnel errors with automatically selected regions, misleading
Azure emulator dashboard entries, and unintended changes to generated
starter apps, plus Homebrew compatibility and Radius API diagnostic
updates.

### 🐛 Fixes

- 📨 **Kafka health checks leaked producers and polling threads** — Each
AppHost health-check execution created a new Kafka producer without
disposing it, accumulating background threads over time. Health checks
now reuse a producer per Kafka resource and dispose it with the AppHost,
while keeping multiple Kafka resources independently configured. Fixes
[#​20091](microsoft/aspire#20091).
([#​20094](microsoft/aspire#20094), backport of
[#​20092](microsoft/aspire#20092), @​davidfowl)

- 🌐 **DevTunnels could fail when the region was selected automatically**
— Tunnel setup and health checks now use the cluster-qualified tunnel ID
returned by the DevTunnel CLI for port operations and access queries.
This fixes failures when a bare tunnel ID cannot be resolved for those
operations. Regression introduced in 13.3. Fixes
[#​18790](microsoft/aspire#18790).
([#​19853](microsoft/aspire#19853), backport of
[#​19230](microsoft/aspire#19230), @​Vladipz)

- ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The
dashboard now hides the `azure-environment` resource when no Azure
resources require cloud provisioning, instead of leaving it visible in
**Not started**. It remains visible for apps that combine local
emulators with resources requiring Azure provisioning. No AppHost
changes are needed. Fixes
[#​19617](microsoft/aspire#19617).
([#​19998](microsoft/aspire#19998), backport of
[#​19843](microsoft/aspire#19843), @​eerhardt)

- 🧩 **Starter app generation could alter unrelated JavaScript values** —
Dynamic port replacement could also replace matching numeric literals in
bundled JavaScript, including Bootstrap timing values. Port
substitutions are now restricted to `localhost:` URLs, preserving the
original library files while still configuring the requested ports.
Fixes [#​20030](microsoft/aspire#20030).
([#​20110](microsoft/aspire#20110), backport of
[#​20031](microsoft/aspire#20031),
@​bart-vmware, @​JamesNK)

- 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced
deprecated cask URL and post-install syntax with the supported
equivalents, resolving compatibility issues with current Homebrew while
preserving install-channel metadata.
([#​20119](microsoft/aspire#20119), backport of
[#​19965](microsoft/aspire#19965), @​askpt,
@​joperezr)

- 🧪 **Radius cloud-provider callback interfaces now carry the
experimental diagnostic** — `IAwsRadiusProviderBuilder` and
`IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`,
matching the existing `WithAwsProvider` and `WithAzureProvider` methods.
Code referencing these interfaces directly must now acknowledge the same
experimental API diagnostic.
([#​19874](microsoft/aspire#19874),
@​sebastienros)

---

*Full Changelog:
[v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)*

*Full commit:
[9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)*

Commits viewable in [compare
view](microsoft/aspire@v13.5.3...v13.6.1).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Rene Bentes Pinto (renebentes) pushed a commit to renebentes/3054 that referenced this pull request Oct 14, 2026
@dependabot
build: Bump Aspire.Hosting.Testing from 13.5.3 to 13.6.1 (#274)
a69365c 
Updated [Aspire.Hosting.Testing](https://github.com/microsoft/aspire)
from 13.5.3 to 13.6.1.

<details>
<summary>Release notes</summary>

_Sourced from [Aspire.Hosting.Testing's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.1

## What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during
sustained metric ingestion, restores scrolling in the Metrics tree,
improves dashboard navigation, fixes container exec watch failures, and
ensures session-scoped containers are cleaned up when stopping .NET
AppHosts on Windows.

### 🐛 Fixes

- 📊 **Dashboard CPU usage could increase during long-running metric
ingestion** — Metric retention repeatedly scanned retained history on
every insertion, causing steadily increasing CPU usage even with a fixed
workload. Cleanup now skips dimensions below capacity and removes only
the oldest surplus points when needed. Existing retention limits and
exemplar behavior are unchanged, and no configuration changes are
required. Regression introduced in 13.6. Fixes
[#​20725](microsoft/aspire#20725).
([#​20747](microsoft/aspire#20747), backport of
[#​20736](microsoft/aspire#20736), @​JamesNK)

- 📈 **The Metrics tree could not be scrolled** — The meter and
instrument tree now scrolls when it exceeds the viewport, allowing you
to reach and select instruments below the fold. Regression introduced in
13.6. Fixes [#​20728](microsoft/aspire#20728).
([#​20762](microsoft/aspire#20762), backport of
[#​20758](microsoft/aspire#20758), @​heyysiri)

- 🧭 **Dashboard navigation could fail after a browser disconnect** —
Pending page-state updates now persist session state before navigating
and skip navigation when the browser has disconnected, avoiding an
unhandled navigation failure. The navigation rail's overflow button also
has consistent sizing, icon alignment, and hover styling in expanded and
collapsed layouts and both light and dark themes.
([#​20545](microsoft/aspire#20545), backport of
[#​20527](microsoft/aspire#20527), @​JamesNK)

- 🖥️ **Container exec watches could terminate shortly after AppHost
startup** — A stalled DCP watch connection could produce a critical
`Watch task over Kubernetes ContainerExec resources terminated
unexpectedly` error and stop subsequent terminal state and log updates
from being observed. Watch connection attempts now retry after timeouts,
and periodic restarts correctly recreate connections without swallowing
unrelated cancellation. Regression introduced in 13.6.0.
([#​20664](microsoft/aspire#20664), backport of
[#​20466](microsoft/aspire#20466), @​radical)

- 🪟 **Session-scoped containers could remain running after stopping a
.NET AppHost on Windows** — AppHosts launched through `dotnet run` or
`dotnet watch` now allow DCP to finish resource cleanup during shutdown,
including existing Ctrl+C and `aspire stop` flows. Persistent resources
remain unaffected, while direct .NET launches and TypeScript/polyglot
AppHosts retain their existing process protection. Fixes
[#​20495](microsoft/aspire#20495).
([#​20514](microsoft/aspire#20514), backport of
[#​20494](microsoft/aspire#20494), @​danegsta)

---

*Full Changelog:
[v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)*

*Full commit:
[3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)*


## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


## 13.5.4

## What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource
leaks, DevTunnel errors with automatically selected regions, misleading
Azure emulator dashboard entries, and unintended changes to generated
starter apps, plus Homebrew compatibility and Radius API diagnostic
updates.

### 🐛 Fixes

- 📨 **Kafka health checks leaked producers and polling threads** — Each
AppHost health-check execution created a new Kafka producer without
disposing it, accumulating background threads over time. Health checks
now reuse a producer per Kafka resource and dispose it with the AppHost,
while keeping multiple Kafka resources independently configured. Fixes
[#​20091](microsoft/aspire#20091).
([#​20094](microsoft/aspire#20094), backport of
[#​20092](microsoft/aspire#20092), @​davidfowl)

- 🌐 **DevTunnels could fail when the region was selected automatically**
— Tunnel setup and health checks now use the cluster-qualified tunnel ID
returned by the DevTunnel CLI for port operations and access queries.
This fixes failures when a bare tunnel ID cannot be resolved for those
operations. Regression introduced in 13.3. Fixes
[#​18790](microsoft/aspire#18790).
([#​19853](microsoft/aspire#19853), backport of
[#​19230](microsoft/aspire#19230), @​Vladipz)

- ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The
dashboard now hides the `azure-environment` resource when no Azure
resources require cloud provisioning, instead of leaving it visible in
**Not started**. It remains visible for apps that combine local
emulators with resources requiring Azure provisioning. No AppHost
changes are needed. Fixes
[#​19617](microsoft/aspire#19617).
([#​19998](microsoft/aspire#19998), backport of
[#​19843](microsoft/aspire#19843), @​eerhardt)

- 🧩 **Starter app generation could alter unrelated JavaScript values** —
Dynamic port replacement could also replace matching numeric literals in
bundled JavaScript, including Bootstrap timing values. Port
substitutions are now restricted to `localhost:` URLs, preserving the
original library files while still configuring the requested ports.
Fixes [#​20030](microsoft/aspire#20030).
([#​20110](microsoft/aspire#20110), backport of
[#​20031](microsoft/aspire#20031),
@​bart-vmware, @​JamesNK)

- 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced
deprecated cask URL and post-install syntax with the supported
equivalents, resolving compatibility issues with current Homebrew while
preserving install-channel metadata.
([#​20119](microsoft/aspire#20119), backport of
[#​19965](microsoft/aspire#19965), @​askpt,
@​joperezr)

- 🧪 **Radius cloud-provider callback interfaces now carry the
experimental diagnostic** — `IAwsRadiusProviderBuilder` and
`IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`,
matching the existing `WithAwsProvider` and `WithAzureProvider` methods.
Code referencing these interfaces directly must now acknowledge the same
experimental API diagnostic.
([#​19874](microsoft/aspire#19874),
@​sebastienros)

---

*Full Changelog:
[v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)*

*Full commit:
[9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)*

Commits viewable in [compare
view](microsoft/aspire@v13.5.3...v13.6.1).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 14, 2026
Closed
Open
Open
Closed
Closed
Closed
Closed
Open
Closed
Closed
Closed
Merged
Closed
Closed
Open
Open
Closed
github-actions Bot pushed a commit to BenjaminMichaelis/DotnetTemplates that referenced this pull request Oct 14, 2026
@dependabot
Bump the aspire group with 1 update (#591)
0f281ed 
Updated [aspire.cli](https://github.com/microsoft/aspire) from 13.4.2 to
13.6.1.

<details>
<summary>Release notes</summary>

_Sourced from [aspire.cli's
releases](https://github.com/microsoft/aspire/releases)._

## 13.6.1

## What's New in Aspire 13.6.1

Patch release for Aspire 13.6 that reduces dashboard CPU usage during
sustained metric ingestion, restores scrolling in the Metrics tree,
improves dashboard navigation, fixes container exec watch failures, and
ensures session-scoped containers are cleaned up when stopping .NET
AppHosts on Windows.

### 🐛 Fixes

- 📊 **Dashboard CPU usage could increase during long-running metric
ingestion** — Metric retention repeatedly scanned retained history on
every insertion, causing steadily increasing CPU usage even with a fixed
workload. Cleanup now skips dimensions below capacity and removes only
the oldest surplus points when needed. Existing retention limits and
exemplar behavior are unchanged, and no configuration changes are
required. Regression introduced in 13.6. Fixes
[#​20725](microsoft/aspire#20725).
([#​20747](microsoft/aspire#20747), backport of
[#​20736](microsoft/aspire#20736), @​JamesNK)

- 📈 **The Metrics tree could not be scrolled** — The meter and
instrument tree now scrolls when it exceeds the viewport, allowing you
to reach and select instruments below the fold. Regression introduced in
13.6. Fixes [#​20728](microsoft/aspire#20728).
([#​20762](microsoft/aspire#20762), backport of
[#​20758](microsoft/aspire#20758), @​heyysiri)

- 🧭 **Dashboard navigation could fail after a browser disconnect** —
Pending page-state updates now persist session state before navigating
and skip navigation when the browser has disconnected, avoiding an
unhandled navigation failure. The navigation rail's overflow button also
has consistent sizing, icon alignment, and hover styling in expanded and
collapsed layouts and both light and dark themes.
([#​20545](microsoft/aspire#20545), backport of
[#​20527](microsoft/aspire#20527), @​JamesNK)

- 🖥️ **Container exec watches could terminate shortly after AppHost
startup** — A stalled DCP watch connection could produce a critical
`Watch task over Kubernetes ContainerExec resources terminated
unexpectedly` error and stop subsequent terminal state and log updates
from being observed. Watch connection attempts now retry after timeouts,
and periodic restarts correctly recreate connections without swallowing
unrelated cancellation. Regression introduced in 13.6.0.
([#​20664](microsoft/aspire#20664), backport of
[#​20466](microsoft/aspire#20466), @​radical)

- 🪟 **Session-scoped containers could remain running after stopping a
.NET AppHost on Windows** — AppHosts launched through `dotnet run` or
`dotnet watch` now allow DCP to finish resource cleanup during shutdown,
including existing Ctrl+C and `aspire stop` flows. Persistent resources
remain unaffected, while direct .NET launches and TypeScript/polyglot
AppHosts retain their existing process protection. Fixes
[#​20495](microsoft/aspire#20495).
([#​20514](microsoft/aspire#20514), backport of
[#​20494](microsoft/aspire#20494), @​danegsta)

---

*Full Changelog:
[v13.6.0...v13.6.1](microsoft/aspire@v13.6.0...v13.6.1)*

*Full commit:
[3751e615ad660621f2a7aa4c390ef48e08a0eed8](microsoft/aspire@3751e615ad660621f2a7aa4c390ef48e08a0eed8)*


## 13.6.0

# Aspire 13.6.0

Aspire 13.6 brings persistent application history, a refreshed and more
interactive dashboard, first-party Java and Rust hosting, and new Azure
deployment options. Coordinated .NET builds, portable volume paths,
sharper CLI workflows, and more capable editor tooling make it easier to
build, debug, and deploy applications across languages.

## Highlights

- 🗃️ **Persistent, refreshed dashboard** — SQLite-backed telemetry and
resource snapshots let you revisit up to ten application runs, with
read-only access to completed runs and default retention limits of
100,000 console log messages, structured logs, and traces each. The
dashboard now ships as Native AOT and adopts Fluent UI v5 with a
collapsible navigation rail.
- 🖥️ **AppHost-owned terminals and database REPLs** — Experimental
terminal APIs let AppHosts create interactive sessions in a dashboard
dock, dialog, or separate window. Opt-in `WithRepl()` commands open
bundled clients for PostgreSQL, MySQL, MongoDB, SQL Server, Redis, and
Valkey, while `aspire terminal ps` and `aspire terminal tape play`
support discovery and repeatable terminal interactions.
- 🌐 **First-party Java and Rust hosting** — New `Aspire.Hosting.Java`
and `Aspire.Hosting.Rust` packages bring Maven, Gradle, Spring Boot,
Quarkus, and Cargo applications into the app model, with generated
container builds and VS Code debugging. These integrations build on work
that originated in the Aspire Community Toolkit.
- 🛠️ **More flexible AppHosts** — The prerelease `Aspire.Hosting.Dotnet`
integration coordinates compatible projects into shared restore and
build groups and supports .NET SDK container publishing. Portable
volume-path environment variables work across local execution and
deployment, while TypeScript AppHosts gain standard `appsettings.json`
configuration and Deno runtime support.
- ⌨️ **Sharper CLI workflows** — Select launch profiles with `aspire
run` and `aspire start`, update repository-local CLI manifests with
`aspire update`, create file-based C# AppHosts with `aspire init
--language csharp --file-based`, and export TypeScript API data with
`aspire sdk export`. Terminal commands no longer need a feature flag,
Linux certificate trust includes Firefox NSS databases, and `aspire stop
--force --volumes` adds explicit cleanup of Aspire-owned volumes.
- 💻 **More capable VS Code tooling** — Coding agents can start and stop
AppHosts through the extension, and the Aspire pane exposes deploy,
publish, and pipeline actions. Multi-root discovery, worktree-scoped
lifecycle operations, preserved launch arguments, clearer debug logs,
and missing-debugger guidance make complex workspaces more predictable.
- ☁️ **New Azure options in preview** — Azure Connector Namespace models
external-service connections and managed MCP server configurations.
Azure Container Apps Sandboxes adds isolated sandbox deployments with
configurable resource tiers and lifecycle policies, while Azure
Container Apps Express offers a simplified environment option for rapid
provisioning.
- ☸️ **More expressive, reliable deployments** — Experimental Azure
Provisioning SDK proxies let polyglot AppHosts customize infrastructure.
Deployment state is isolated under `ASPIRE_HOME`, Kubernetes preserves
inherited hostnames and embedded parameter values, and AKS gains
persistent-volume provisioning and more reliable cleanup.
- 🔌 **Expanded integrations** — Experimental Deno hosting and MongoDB
replica sets join Foundry Toolboxes, remote Foundry Local endpoints,
Blazor WebAssembly debugging, and configurable Dev Tunnel expiration.
Azure Cosmos DB and AI Inference client integrations gain health checks,
and the vNext Cosmos DB emulator sends its own telemetry to the
dashboard.

## ⚠️ Breaking changes

Notable changes include automatic TLS for local MongoDB servers when a
certificate is available, the Linux-based vNext Cosmos DB emulator
becoming the default, new Azure Front Door origin names that can require
cleanup of existing origins, portable connection-string
environment-variable aliases on stricter deployment targets, and
experimental terminal types moving from `Aspire.Hosting.Terminals` to
`Aspire.Hosting.ApplicationModel`.

See the full list and migration guidance in the [Aspire 13.6 breaking
changes](https://aspire.dev/whats-new/aspire-13-6/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.6](https://aspire.dev/whats-new/aspire-13-6/).

Thank you to all the community contributors who helped make Aspire 13.6
possible! 💜

---

_Full Changelog:
[v13.5.4...v13.6.0](microsoft/aspire@v13.5.4...v13.6.0)_

_Full commit:
[56f3e9c0d216c0c7069dabb49dd0464e4827744f](microsoft/aspire@56f3e9c0d216c0c7069dabb49dd0464e4827744f)_


## 13.5.4

## What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource
leaks, DevTunnel errors with automatically selected regions, misleading
Azure emulator dashboard entries, and unintended changes to generated
starter apps, plus Homebrew compatibility and Radius API diagnostic
updates.

### 🐛 Fixes

- 📨 **Kafka health checks leaked producers and polling threads** — Each
AppHost health-check execution created a new Kafka producer without
disposing it, accumulating background threads over time. Health checks
now reuse a producer per Kafka resource and dispose it with the AppHost,
while keeping multiple Kafka resources independently configured. Fixes
[#​20091](microsoft/aspire#20091).
([#​20094](microsoft/aspire#20094), backport of
[#​20092](microsoft/aspire#20092), @​davidfowl)

- 🌐 **DevTunnels could fail when the region was selected automatically**
— Tunnel setup and health checks now use the cluster-qualified tunnel ID
returned by the DevTunnel CLI for port operations and access queries.
This fixes failures when a bare tunnel ID cannot be resolved for those
operations. Regression introduced in 13.3. Fixes
[#​18790](microsoft/aspire#18790).
([#​19853](microsoft/aspire#19853), backport of
[#​19230](microsoft/aspire#19230), @​Vladipz)

- ☁️ **Emulator-only AppHosts showed an unused Azure environment** — The
dashboard now hides the `azure-environment` resource when no Azure
resources require cloud provisioning, instead of leaving it visible in
**Not started**. It remains visible for apps that combine local
emulators with resources requiring Azure provisioning. No AppHost
changes are needed. Fixes
[#​19617](microsoft/aspire#19617).
([#​19998](microsoft/aspire#19998), backport of
[#​19843](microsoft/aspire#19843), @​eerhardt)

- 🧩 **Starter app generation could alter unrelated JavaScript values** —
Dynamic port replacement could also replace matching numeric literals in
bundled JavaScript, including Bootstrap timing values. Port
substitutions are now restricted to `localhost:` URLs, preserving the
original library files while still configuring the requested ports.
Fixes [#​20030](microsoft/aspire#20030).
([#​20110](microsoft/aspire#20110), backport of
[#​20031](microsoft/aspire#20031),
@​bart-vmware, @​JamesNK)

- 🍎 **Updated the Aspire Homebrew cask for Homebrew 6.x** — Replaced
deprecated cask URL and post-install syntax with the supported
equivalents, resolving compatibility issues with current Homebrew while
preserving install-channel metadata.
([#​20119](microsoft/aspire#20119), backport of
[#​19965](microsoft/aspire#19965), @​askpt,
@​joperezr)

- 🧪 **Radius cloud-provider callback interfaces now carry the
experimental diagnostic** — `IAwsRadiusProviderBuilder` and
`IAzureRadiusProviderBuilder` are now marked with `ASPIRERADIUS003`,
matching the existing `WithAwsProvider` and `WithAzureProvider` methods.
Code referencing these interfaces directly must now acknowledge the same
experimental API diagnostic.
([#​19874](microsoft/aspire#19874),
@​sebastienros)

---

*Full Changelog:
[v13.5.3...v13.5.4](microsoft/aspire@v13.5.3...v13.5.4)*

*Full commit:
[9c1b401dd67746739044f68959cbf4d3d7af93a6](microsoft/aspire@9c1b401dd67746739044f68959cbf4d3d7af93a6)*

## 13.5.3

## What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes
for resources with multi-path icons and restores missing public URLs for
DevTunnel resources.

### 🐛 Fixes

- 📊 **Dashboard Graph view could crash for Azure Blob resources** —
Resources such as those created with `AddBlobs` use icons containing
multiple SVG paths, which caused an XML parsing exception and broke the
dashboard circuit. The graph now combines multi-path icons correctly.
Regression introduced in 13.5. Fixes
[#​19489](microsoft/aspire#19489).
([#​19585](microsoft/aspire#19585), backport of
[#​19579](microsoft/aspire#19579),
`@​sebastienros`)

- 🌐 **DevTunnel public URLs were missing from the Dashboard and MCP
snapshots** — DevTunnel port resources could report `Running` and
`Healthy` while showing no public URLs. Proxyless port allocation is now
limited to compute and container resources, allowing DevTunnels to
publish their actual public endpoints. Regression introduced in 13.5.
Fixes [#​19496](microsoft/aspire#19496).
([#​19625](microsoft/aspire#19625), backport of
[#​19590](microsoft/aspire#19590),
`@​karolz-ms`, `@​danegsta`)

### 🏷️ Housekeeping

- 🚀 Bumped branding to 13.5.3

---

*Full Changelog:
[v13.5.2...v13.5.3](microsoft/aspire@v13.5.2...v13.5.3)*

*Full commit:
[b5f143315ffb6968ea939a9978797a5b20e4c688](microsoft/aspire@b5f143315ffb6968ea939a9978797a5b20e4c688)*

## 13.5.2

## What's New in Aspire 13.5.2


Patch release for Aspire 13.5 that removes an unused native helper
binary from the Windows CLI archives so 13.5 servicing releases stay
publishable to WinGet.


### 🐛 Fixes



- 🪟 **Windows CLI archives shipped an unused ~4.9 MB `hex1bpty.exe`** —
The Windows CLI archives (`aspire-cli-win-{x64,arm64}-*.zip`) bundled
Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns
every pseudo-terminal Aspire surfaces). Besides the wasted download, the
extra unexplained executable stalled the WinGet publish, since every
binary in the archive goes through executable and malware validation. A
build-only MSBuild target now drops the file from the CLI publish
output; Unix native assets are unaffected. Regression new in 13.5.
([[#​19557](https://github.com/microsoft/aspire/pull/19557)](https://github.com/microsoft/aspire/pull/19557),
backport of #​19554, `@​mitchdenny`)



### 🏷️ Housekeeping



- 🚀 Bumped branding to 13.5.2




*Full Changelog:
[[v13.5.1...v13.5.2](https://github.com/microsoft/aspire/compare/v13.5.1...v13.5.2)](https://github.com/microsoft/aspire/compare/v13.5.1...v13.5.2)*


*Full commit:
[[a22cec24d76e764b3681977e314ab4a0aeed0240](https://github.com/microsoft/aspire/commit/a22cec24d76e764b3681977e314ab4a0aeed0240)](https://github.com/microsoft/aspire/commit/a22cec24d76e764b3681977e314ab4a0aeed0240)*


## 13.5.1

## What's New in Aspire 13.5.1


Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost
compatibility regression when running the 13.5 SDK under an older
(13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

### 🐛 Fixes


- 🍎 **Polyglot AppHosts could crash on startup on macOS** — On macOS,
polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during
startup due to an interaction between how DCP's Go runtime forks
detached processes and how .NET Native AOT installs its signal handlers.
Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash.
([[#​19528](https://github.com/microsoft/aspire/pull/19528)](https://github.com/microsoft/aspire/pull/19528))

- 🔗 **Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with
`MissingMethodException`** — A TypeScript or Java AppHost built with the
13.5 SDK failed to start when launched by an older (13.4.x) CLI, because
the newer codegen called `Aspire.TypeSystem` members that don't exist in
the CLI's older contract. Code generation now probes for these additive
capabilities before using them, so older CLIs skip only the unsupported
feature and startup succeeds. Regression introduced in 13.5 by #​19365.
Fixes #​19503.
([[#​19524](https://github.com/microsoft/aspire/pull/19524)](https://github.com/microsoft/aspire/pull/19524),
backport of #​19506, `@​adamint`)


### 🏷️ Housekeeping



- 📦 Updated DCP (Developer Control Plane) to 0.25.13
([[#​19528](https://github.com/microsoft/aspire/pull/19528)](https://github.com/microsoft/aspire/pull/19528))

- 🔧 Restored WinGet publication using .NET 9 `wingetcreate`
([[#​19509](https://github.com/microsoft/aspire/pull/19509)](https://github.com/microsoft/aspire/pull/19509))

- 🧹 Removed the pipeline-scoped `Publish-Build-Assets` group from the
release pipeline
([[#​19523](https://github.com/microsoft/aspire/pull/19523)](https://github.com/microsoft/aspire/pull/19523),
[[#​19163](https://github.com/microsoft/aspire/pull/19163)](https://github.com/microsoft/aspire/pull/19163))

- 🚀 Bumped branding to 13.5.1
([[#​19531](https://github.com/microsoft/aspire/pull/19531)](https://github.com/microsoft/aspire/pull/19531))




*Full Changelog:
[[v13.5.0...v13.5.1](https://github.com/microsoft/aspire/compare/v13.5.0...v13.5.1)](https://github.com/microsoft/aspire/compare/v13.5.0...v13.5.1)*


*Full commit:
[[69db530a4816698cf1d5fa4557933e0ac4f127c6](https://github.com/microsoft/aspire/commit/69db530a4816698cf1d5fa4557933e0ac4f127c6)](https://github.com/microsoft/aspire/commit/69db530a4816698cf1d5fa4557933e0ac4f127c6)*

## 13.5.0

# Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more
interactive AppHost, closer C# and TypeScript parity, sharper tooling,
more flexible deployment modeling, and a broad set of runtime-stability
improvements.

## Highlights

- 💬 **Richer AppHost interactions** — The Interaction Service now works
across C# and TypeScript AppHosts with stable prompts and dynamic
inputs, file uploads, progress dialogs, notifications, and user-defined
resource command arguments that surface as dashboard controls and CLI
options.
- 🖥️ **Interactive terminal sessions** — The experimental
`WithTerminal()` API lets resources host REPLs, shells, TUIs, and other
interactive programs directly in the dashboard, with an opt-in `aspire
terminal` CLI command for attaching from your shell.
- 🌐 **TypeScript AppHost is generally available** — Polyglot AppHosts no
longer require the `ASPIREATS001` experimental diagnostic and gain
custom health checks, container file copying, HTTPS developer
certificates, faster startup, and several reliability fixes that further
close the gap with C#.
- 🛠️ **CLI installation and reliability** — The Aspire CLI is available
through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C#
AppHosts enable the CLI bundle by default, while `aspire stop --force`,
`aspire update --migrate`, `aspire doctor`, docs search, signal
handling, and stale-socket cleanup all improve day-to-day workflows.
- 🎨 **Refreshed dashboard** — The dashboard adopts official Aspire
branding and a new accessible design-token system, with timestamp and
exact numeric telemetry filters, console-log text search, clearer
reconnect and health-check experiences, and correct telemetry streaming
while filters are active.
- 💻 **Rebranded VS Code extension** — The extension is now named
**Aspire** and adds an in-editor dashboard, Bun and MAUI debugging,
resource commands in the tree view, discovered AppHosts, improved
parameter handling, and more efficient workspace discovery.
- ☸️ **More expressive deployments** — Kubernetes and AKS gain
first-class persistent volumes, Azure Container Apps adds deterministic
unique resource naming, Azure environments support delegated subnets,
and Docker Compose can publish Blazor gateways and configure shared
memory.
- ☁️ **Expanded hosting integrations** — Azure resources can be
referenced across resource groups, subscriptions, and tenants; the new
`Aspire.Hosting.Dotnet` package models .NET projects by path; Radius
deployment arrives in preview; and Foundry Local, Redis modules, dev
tunnels, Go debugging, and other integrations gain new capabilities.

## ⚠️ Breaking changes

Notable changes include hosting context `ServiceProvider` properties
being renamed to `Services`, `PublishAsConnectionString` becoming
obsolete in favor of `AddConnectionString`, removal of `aspire ps
--resources` and `--include-hidden` in favor of `aspire describe`,
earlier proxyless endpoint port allocation, deprecation of the GitHub
Models integration, removal of the dashboard AI Assistant, and opt-in
rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the [Aspire 13.5 breaking
changes](https://aspire.dev/whats-new/aspire-13-5/#breaking-changes).

## 📖 Learn more

For complete details, examples, migration guidance, and everything new
in this release, read [What's new in Aspire
13.5](https://aspire.dev/whats-new/aspire-13-5/).

Thank you to all the community contributors who helped make Aspire 13.5
possible! 💜

---

_Full Changelog:
[v13.4.6...v13.5.0](microsoft/aspire@v13.4.6...v13.5.0)_

_Full commit:
[e076d8e427cb3afb528dbd605acd74c3aea69f94](microsoft/aspire@e076d8e427cb3afb528dbd605acd74c3aea69f94)_

## 13.4.6

## What's New in Aspire 13.4.6

Patch release for Aspire 13.4 fixing polyglot AppHost code generation
binding when CLI and SDK versions diverge, resource service port
collision in `--isolated` mode, and a MongoDB.Driver dependency update.

### 🐛 Fixes

- 🔗 **Polyglot AppHost code generation silently failed when CLI and SDK
versions diverged** — `Aspire.TypeSystem` used a floating strong-name
`AssemblyVersion` that changed with every build. When the installed
Aspire CLI was built at a different version than the AppHost's SDK, the
CLR couldn't satisfy the strong-name bind and every code generator
(TypeScript, Python, Java, Go, Rust) was silently dropped, surfacing as
`No code generator found for language: <lang>`. The `AssemblyVersion` is
now frozen at a stable constant so any compatible CLI/SDK pair on 13.4
binds successfully. Relates to #​18110 and #​17910.
([#​18160](microsoft/aspire#18160),
`@​sebastienros`)

- 🔌 **Multiple AppHosts started with `--isolated` collided on the
resource service port** — Both instances tried to bind to the same fixed
port from `ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL`, causing an "address
already in use" error on the second instance. `DashboardServiceHost` now
binds to port 0 on loopback when `RandomizePorts` is true (set by
`--isolated`), letting the OS assign a unique port per instance.
([#​18341](microsoft/aspire#18341), `@​JamesNK`)

- 🍃 **MongoDB.Driver updated to 3.9.0** — Removes a wrongly pinned
`SharpCompress` transitive dependency and uses the corrected `Snappier`
transitive. Fixes #​17981.
([#​18279](microsoft/aspire#18279),
`@​Falco20019`)

### 🏷️ Housekeeping

- 🚀 Bumped branding to 13.4.6
([#​18343](microsoft/aspire#18343))

---

_Full Changelog:
[v13.4.5...v13.4.6](microsoft/aspire@v13.4.5...v13.4.6)_

_Full commit:
[87fe259e4fc244c599019a7b1304c85a1488f248](microsoft/aspire@87fe259e4fc244c599019a7b1304c85a1488f248)_

> Generated by [Generate release notes for a new stable Aspire
release](https://github.com/microsoft/aspire/actions/runs/27855270514) ·
131 AIC · ⌖ 13.5 AIC · ⊞ 37.4K

<!-- gh-aw-agentic-workflow: Generate release notes for a new stable
Aspire release, engine: copilot, version: 1.0.60, model:
claude-sonnet-4.6, id: 27855270514, workflow_id: release-notes-generate,
run: https://github.com/microsoft/aspire/actions/runs/27855270514 -->

## 13.4.5

## What's New in Aspire 13.4.5

Patch release for Aspire 13.4 clearing a transitive MessagePack security
advisory, tightening CLI validation for Playwright configuration, and
adding coding-agent detection to CLI telemetry.

### 🐛 Fixes

- 🛡️ **Bumped StreamJsonRpc to 2.25.29 to clear the MessagePack
GHSA-hv8m-jj95-wg3x (CVE-2026-48109) NU1903 advisory** — The transitive
MessagePack 2.5.192 dependency pulled in via StreamJsonRpc 2.22.23 fell
within the advisory's vulnerable LZ4 decompression range. Aspire does
not use `MessagePackFormatter` or LZ4 — all StreamJsonRpc calls use
`SystemTextJsonFormatter` over local Unix sockets — so the vulnerability
was not reachable in practice. The bump clears the NU1903 warning for
consumers of the `Aspire.Hosting` package.
([#​18204](microsoft/aspire#18204),
`@​mitchdenny`)
- 🎭 **`playwrightCliVersion` values that are not valid SemVer 2.0 now
fail fast with a clear diagnostic** — Previously an invalid override
(range expression, dist-tag like `latest`, or a `v`-prefixed string)
would surface as a generic npm resolution failure. The value is now
validated with strict SemVer parsing at startup; an error naming the
configuration key and the offending value is emitted immediately.
([#​18205](microsoft/aspire#18205),
`@​mitchdenny`)
- 🤖 **CLI telemetry now detects and reports the calling coding agent** —
When the Aspire CLI is invoked from inside a known coding agent
environment (GitHub Copilot CLI, VS Code Copilot agent, etc.) the agent
name is included in the main CLI telemetry event. GitHub Copilot CLI is
specifically identified as `copilot-cli`.
([#​18240](microsoft/aspire#18240),
`@​damianedwards`)

### 🏷️ Housekeeping

- 📄 Refreshed the `@​microsoft/aspire-cli` npm package README to be
TypeScript-only — updated examples to the current `ts-starter` template
(`apphost.mts` / `aspire.mjs`), added a backing-services snippet showing
`aspire add` for PostgreSQL and Redis, and documented `aspire dashboard
run` as a standalone dashboard option.
([#​18221](microsoft/aspire#18221), `@​adamint`)

---

_Full Changelog:
[v13.4.4...v13.4.5](microsoft/aspire@v13.4.4...v13.4.5)_

_Full commit:
[73114e86c64aeb9f3f3c7da8e37df1ae4281b27e](microsoft/aspire@73114e86c64aeb9f3f3c7da8e37df1ae4281b27e)_

> Generated by [Generate release notes for a new stable Aspire
release](https://github.com/microsoft/aspire/actions/runs/27667814104/agentic_workflow)
· ● 4.4M

<!-- gh-aw-agentic-workflow: Generate release notes for a new stable
Aspire release, engine: copilot, version: 1.0.40, model:
claude-sonnet-4.6, id: 27667814104, workflow_id: release-notes-generate,
run: https://github.com/microsoft/aspire/actions/runs/27667814104 -->

## 13.4.4

## What's New in Aspire 13.4.4

Patch release for Aspire 13.4 with improved DCP connection reliability
during request execution and consistent `ExcludeFromMcp()` filtering
across all CLI MCP tools.

### 🐛 Fixes

* 🔌 **DCP requests could fail permanently when the connection dropped
mid-request** — If the underlying DCP channel closed while a request was
in flight, the error was surfaced directly instead of being retried.
Reconnection is now attempted as part of the DCP request retry path so
transient disconnections recover automatically without surfacing errors.
([#​18096](microsoft/aspire#18096),
`@​karolz-ms`)
* 🔍 **Resources marked with `ExcludeFromMcp()` were not consistently
filtered from CLI MCP tools** — Resources with the
`resource.excludeFromMcp` property were not excluded uniformly from all
CLI MCP tool results. `list_resources`, `list_console_logs`,
`execute_resource_command`, `list_structured_logs`, `list_traces`, and
`list_trace_structured_logs` all now honor the exclusion, preventing
excluded resources and their telemetry from appearing in agent context.
([#​18150](microsoft/aspire#18150), `@​JamesNK`)

### 🏷️ Housekeeping

* 📦 Improved npm CLI package metadata and hardened npm publish
validation in the release pipeline.
([#​18093](microsoft/aspire#18093),
`@​adamratzman`)

* * *

_Full Changelog:
[v13.4.3...v13.4.4](microsoft/aspire@v13.4.3...v13.4.4)_

_Full commit:
[ccc566c5ab3285c9beb8f38ede34734bb477c029](microsoft/aspire@ccc566c5ab3285c9beb8f38ede34734bb477c029)_


## 13.4.3

## What's New in Aspire 13.4.3

Patch release for Aspire 13.4 with a fix for persistent container
endpoint allocation regressions introduced in 13.4.

### 🐛 Fixes

- 🔌 **Persistent container endpoints had incorrect default behavior** —
Persistent containers were defaulting to proxyless endpoint behavior
instead of the proxied behavior used by normal containers. This caused
integrations that depend on endpoint allocation before resource startup
(such as the KeyVault emulator) to fail. Persistent containers now
default to proxied endpoints matching normal container behavior; opt out
with `isProxied: false` or `WithEndpointProxySupport(false)`. Proxyless
container endpoints with only a `targetPort` specified now also resolve
immediately to that port instead of waiting for delayed allocation.
(#​17960, `@​danegsta`)

### 🏷️ Housekeeping

- 🛠️ Unblocked WinGet manifest publishing on locked-down 1ES agents and
updated manifest tags (#​17958)

---
*Full Changelog:
microsoft/aspire@v13.4.2...v13.4.3*

*Full commit:
[4f218933552e18ff2874d1b6d5dc3fe671e3b6d9](microsoft/aspire@4f218933552e18ff2874d1b6d5dc3fe671e3b6d9)*

> Generated by [Generate release notes for a new stable Aspire
release](https://github.com/microsoft/aspire/actions/runs/27173824611/agentic_workflow)
· ● 4.7M

<!-- gh-aw-agentic-workflow: Generate release notes for a new stable
Aspire release, engine: copilot, version: 1.0.40, model:
claude-sonnet-4.6, id: 27173824611, workflow_id: release-notes-generate,
run: https://github.com/microsoft/aspire/actions/runs/27173824611 -->

Commits viewable in [compare
view](microsoft/aspire@v13.4.2...v13.6.1).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aspire.cli&package-manager=nuget&previous-version=13.4.2&new-version=13.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Oct 14, 2026
Closed
Closed
Closed
Closed
Closed
Closed
@github-actions github-actions Bot locked and limited conversation to collaborators Oct 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mitchdenny Mitch Denny (mitchdenny) mitchdenny approved these changes
@joperezr Jose Perez Rodriguez (joperezr) joperezr approved these changes

Assignees

No one assigned

Labels

area-templates Servicing-consider Issue for next servicing release review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@JamesNK @joperezr @bart-vmware @mitchdenny