Bump the nuget-deps group with 4 updates#141
Merged
Merged
Conversation
Bumps Microsoft.Extensions.Http.Resilience from 10.5.0 to 10.6.0 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.7 to 10.0.8 Bumps Microsoft.SourceLink.GitHub from 10.0.203 to 10.0.300 Bumps System.CommandLine from 2.0.7 to 2.0.8 --- updated-dependencies: - dependency-name: Microsoft.Extensions.Http.Resilience dependency-version: 10.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-deps - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.300 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps - dependency-name: System.CommandLine dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
3 tasks
ptr727
added a commit
that referenced
this pull request
May 13, 2026
## Summary - Updates the [`AGENTS.md`](./AGENTS.md) "Branching Model" section to reflect that the develop ruleset's `strict_required_status_checks_policy` was flipped from `true` to `false` server-side today (rule id 12277308). - Replaces the bullet that said *develop keeps the up-to-date check on, only main omits it* with a two-part bullet covering both rulesets and their distinct reasons (main: graph-reachability after every merge release; develop: bot auto-merge race-proofing). - Adds a do-not-reintroduce warning and threads the relaxed-flag rationale through the parallel-bots bullet so a future template sync can't quietly put the flag back. ## Why [PR #141](#141) sat OPEN with all checks green and auto-merge armed because a sibling Dependabot PR (#140) against develop merged ~10 seconds after #141 opened, pushing #141 into `mergeStateStatus: BEHIND`. Auto-merge cannot fire while the strict flag is on, and nothing in the merge-bot (see [merge-bot-pull-request.yml](./.github/workflows/merge-bot-pull-request.yml)) auto-updates a bot branch in that window. The matching main-side PR ([#142](#142)) merged cleanly because main's ruleset already had strict off — that asymmetry is the smoking gun. ## Upstream template The yesterday-synced ProjectTemplate ruleset has the same `strict_required_status_checks_policy: true` on develop. Filed [ptr727/ProjectTemplate#82](ptr727/ProjectTemplate#82) so the template gets the matching change and downstream consumers don't reintroduce the flag on their next sync. ## Scope Docs only. The actual ruleset flip was applied server-side and is already verifiable via `gh api repos/ptr727/LanguageTags/rules/branches/develop` → `strict_required_status_checks_policy: false`. PR #141 itself was unblocked separately (`gh api -X PUT .../pulls/141/update-branch`, re-arm auto-merge, merged at 14:45:33Z). ## Test plan - [ ] Copilot review on the current head — no factual / phrasing pushback. - [ ] `Check pull request workflow status` green. - [ ] Next pair of same-day Dependabot PRs against develop both auto-merge without anyone touching `gh pr update-branch`. (Will surface organically on the next daily run.)
3 tasks
This was referenced May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Microsoft.Extensions.Http.Resilience from 10.5.0 to 10.6.0.
Release notes
Sourced from Microsoft.Extensions.Http.Resilience's releases.
10.6.0
Version 10.6.0 stabilizes the response continuation token and background-response APIs in Microsoft.Extensions.AI.Abstractions. Most other AI work for May shipped in 10.5.1; this monthly release rolls those changes up alongside dependency updates and a small Resource Monitoring cleanup.
Experimental API Changes
Now Stable
MEAI001) #7512What's Changed
AI
Repository Infrastructure Updates
Acknowledgements
Full Changelog: dotnet/extensions@v10.5.2...v10.6.0
10.5.2
This patch release ships a single fix to
Microsoft.Extensions.VectorData.Abstractions, correctingStorageNameresolution when external serialization is enabled.Microsoft.Extensions.VectorData.ConformanceTests,Microsoft.Extensions.AI.Abstractions,Microsoft.Extensions.AI, andMicrosoft.Extensions.AI.OpenAIare published alongside it for version coherency — they contain no code changes from 10.5.1.Packages in this release
What's Changed
Microsoft.Extensions.VectorData.Abstractions
StorageNamebehavior when external serialization is enabled, and disable a warning fornet462. (by @roji in #7475)Full Changelog: dotnet/extensions@v10.5.1...v10.5.2
10.5.1
Version 10.5.1 of the Microsoft.Extensions.AI packages stabilizes CodeInterpreter, WebSearch, and ImageGeneration tool content types. The release adds new experimental tool search and OpenAI request policy hooks. And the OpenTelemetry gen-ai semantic conventions are updated to align with v1.41.
The 'aiagent-webapi' project template in Microsoft.Agents.AI.ProjectTemplates is updated to align with v1.3.0 of Agent Framework, updating the OpenTelemetry dependencies within the template projects as well.
Packages in this release
Experimental API Changes
Now Stable
The following types previously emitted the
MEAI001experimental diagnostic and are now stable.CodeInterpreterToolCallContentCodeInterpreterToolResultContentWebSearchToolCallContentWebSearchToolResultContentImageGenerationToolCallContentImageGenerationToolResultContentHostedImageGenerationToolImageGenerationOptionsImageGenerationResponseFormat(theHostedenum value remains experimental)IImageGeneratorand the rest of the image generation infrastructure also remain experimentalNew Experimental APIs
The following new APIs emit the
MEAI001experimental diagnostic.HostedToolSearchToolwithDeferredToolsfor tool-search-driven deferred tool loading #7471OpenAIRequestPoliciesextension hook for appendingSystem.ClientModel.PipelinePolicyinstances to outgoing OpenAI requests #7495Breaking Changes to Experimental APIs
WebSearchToolResultContent.Resultswas renamed toOutputsas part of the stabilization in #7493, aligning withCodeInterpreterToolResultContent.Outputs. The originalResultsproperty was included in version 10.4.0 and 10.5.0; this is a binary breaking change and consumers need to update to consume the updated property.... (truncated)
Commits viewable in compare view.
Updated Microsoft.Extensions.Logging.Abstractions from 10.0.7 to 10.0.8.
Release notes
Sourced from Microsoft.Extensions.Logging.Abstractions's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.SourceLink.GitHub from 10.0.203 to 10.0.300.
Release notes
Sourced from Microsoft.SourceLink.GitHub's releases.
10.0.300
You can build .NET 10.0 from the repository by cloning the release tag
v10.0.300and following the build instructions in the main README.md.Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.
Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023
10.0.204
You can build .NET 10.0 from the repository by cloning the release tag
v10.0.204and following the build instructions in the main README.md.Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.
Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023
Commits viewable in compare view.
Updated System.CommandLine from 2.0.7 to 2.0.8.
Release notes
Sourced from System.CommandLine's releases.
No release notes found for this version range.
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions