Bump Aspire.Hosting.AppHost from 13.3.5 to 13.4.2

[dependabot]

Updated Aspire.Hosting.AppHost from 13.3.5 to 13.4.2.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.4.2

What's New in Aspire 13.4.2

Patch release for Aspire 13.4 with a fix for Redis persistent container deadlock on startup when using TLS.

🐛 Fixes

• 🔴 Redis with WithLifetime(ContainerLifetime.Persistent) could deadlock on startup — Redis TLS startup arguments used the public/allocated host ports instead of the internal target ports. When the public port differed from the target port (or was not yet allocated) the container would listen on an unexpected port and become unreachable. The TLS and non-TLS startup arguments now bind to target ports, matching what Redis expects internally. Fixes #​17822. (#​17827, backported via #​17850, @​danegsta)

🏷️ Housekeeping

• 🚀 Bumped branding to 13.4.2 (#​17876)

---

Full Changelog: microsoft/aspire@v13.4.1...v13.4.2

Full commit: d7d0b6759ce4b936c76bc4775814d27db560dd6d

Generated by Generate release notes for a new stable Aspire release · ● 5M

13.4.1

What's New in Aspire 13.4.1

Patch release for Aspire 13.4 with fixes for explicit-start resource lifecycle callbacks, Redis persistent container startup, proxyless endpoint allocation, and a duplicated profiles block in the empty C# AppHost template.

🐛 Fixes

• ⏱️ Explicit-start resources triggered lifecycle callbacks too early — Session-scoped resources marked with WithExplicitStart() were having their execution configuration callbacks (environment variables, arguments, certificates) evaluated at AppHost startup instead of at manual start. This meant user-interaction callbacks such as WithEnvironment(ctx => PromptForValueAsync(...)) were called before the user triggered the resource. DCP registration is now deferred until the user manually starts the resource; persistent explicit-start resources still register immediately but patch the existing DCP record to Start = true rather than deleting and recreating it. Fixes #​17813. (#​17825, backported via #​17826, @​danegsta)
• 🔴 Redis with WithLifetime(ContainerLifetime.Persistent) could deadlock on startup — Redis TLS startup arguments used the public/allocated host ports instead of the internal target ports. When the public port differed from the target port (or was not yet allocated) the container would listen on an unexpected port and become unreachable. The TLS and non-TLS startup arguments now bind to target ports, matching what Redis expects internally. Fixes #​17822. (#​17827, backported via #​17850, @​danegsta)
• 🔌 Proxyless container endpoint could hang when resolved before container creation — Referencing a proxyless container endpoint in an environment variable callback (before the container port spec was finalized) could deadlock. An on-demand allocation path now commits the target port as the fallback host port in that case; once BuildContainerPorts runs, normal DCP dynamic port assignment takes over for any later resolution. (#​17851, backported via #​17859, @​danegsta)
• 📄 Empty C# AppHost template emitted duplicate profiles block — aspire new aspire-empty on 13.4 produced an aspire.config.json with a profiles block that duplicated the content already present in apphost.run.json, causing redundant launch configuration. The embedded template now contains only the required appHost.path binding; profile configuration lives exclusively in apphost.run.json. Fixes #​17660. (#​17781, backported via #​17820, @​mitchdenny)

🏷️ Housekeeping

• 📦 Added Aspire CLI npm package to the release pipeline so the npm distribution is published as part of stable releases. (#​17297, backported via #​17766, @​adamint)
• 🚀 Bumped branding to 13.4.1 (#​17819)

---

Full Changelog: microsoft/aspire@v13.4.0...v13.4.1

Full commit: cf985fa817dd5863e7f62eb74fa1725ab5069ed2

Generated by Generate release notes for a new stable Aspire release · ● 1.0.40

Generated by Generate release notes for a new stable Aspire release · ● 3.9M

13.4.0

Aspire 13.4.0

Aspire 13.4 brings major improvements to Foundry hosted agents, the Aspire skills system, CLI reliability, and TypeScript AppHost stability — with cross-compute-environment deployment now working end-to-end and TypeScript AppHost support — Aspire's polyglot story — reaching general availability (GA).

Highlights

• 🎉 TypeScript AppHost is now GA — First introduced as a preview in an earlier version of Aspire, the TypeScript AppHost — Aspire's polyglot story — has reached the quality bar for general availability and is now officially supported for production use alongside C#. As part of GA, the experimental markers on the Azure TypeScript AppHost (ATS) APIs have been removed and the ATS surface area is stable for 13.4.
• 🤖 Foundry hosted agents — Protocol selection (responses / invocations) is now configurable from both C# and TypeScript AppHosts. Cross-compute-environment deployments (e.g., a Foundry hosted agent + an AKS consumer) now wire up correctly: endpoint resolution and the required Azure AI User RBAC role assignment on the Foundry account are generated automatically — no manual az role assignment create steps needed.
• 🛠️ Aspire skills catalog from bundle — aspire agent init now drives its installable skill catalog from the bundle manifest, surfacing all six bundled skills (previously only three were visible). An embedded snapshot means the full catalog is available even in airgapped / disconnected environments.
• 🔧 CLI reliability — Multiple CLI fixes: implicit-channel discovery restored, aspire stop no longer falsely reports failure on Unix, aspire ps no longer includes raw resource data (use aspire describe for detailed state), aspire new prefers the current CLI template version, friendly error for aspire do --list-steps without a step argument, and improved --search option description with documentation link.
• ⌨️ TypeScript AppHost — Fixed a deadlock that occurred when lazy options callbacks invoked async methods; dev-localhost resource service URLs are now accepted for local development without extra configuration.
• 📊 Dashboard — Summary log formatting improved for readability, dotnet watch dashboard auto-launch signal restored, and dynamic-port handling fixed for DistributedApplicationTestingBuilder.
• ☸️ Kubernetes — The Helm CLI minimum version (≥ 4.2.0) is now validated before a Kubernetes deploy, giving a clear error instead of a cryptic failure.
• ⚠️ Aspire.Hosting.Blazor ships as preview in 13.4 — A packaging issue with the Blazor gateway scripts means the package is intentionally marked preview for this release. Full stable support is targeted for 13.5.

⚠️ Notable changes

• aspire ps no longer includes raw resource data in its output. Use aspire describe <resource> to inspect detailed resource state.
• Foundry hosted agent builder API shape updated — see #​17545 and #​17669 for the updated C# and TypeScript signatures.
• Aspire.Hosting.Blazor is preview-versioned in 13.4 (SuppressFinalPackageVersion=true). A fix for the addBlazorGateway gateway script resolution error in TypeScript AppHosts is tracked in #​17685.

📖 Learn more

For the full details on everything in this release, check out the What's new in Aspire 13.4 documentation.

Thank you to all the community contributors who helped make Aspire 13.4 possible! 💜

---

Full Changelog: microsoft/aspire@v13.3.5...v13.4.0

Full commit: becb48e2d61099e35ae336d527d3875e928d6594

Generated by Generate release notes for a new stable Aspire release · ● 6.5M

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codescene-delta-analysis]

Our agent can fix these. Install it.

No application code in the PR — skipped Code Health checks.

Quality Gate Profile: Clean Code Collective
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[claude]

Claude Code Review

Scope: Single-line Dependabot bump of Aspire.Hosting.AppHost 13.3.5 to 13.4.2 in Directory.Packages.props. Low risk overall.

Summary

• Change is correct and minimal -- just a version attribute update via central package management. The release notes (13.4.0 to 13.4.2) are bug-fix/patch-level changes (Redis persistent-container deadlock, explicit-start lifecycle callbacks, proxyless endpoint hangs, template fixes) with no breaking API changes called out, so it is a safe upgrade.
• Blast radius is tiny -- the only consumer is the sample samples/Scheduler/TickerQ/Greeting.AppHost/Greeting.AppHost.csproj. No shipped library code or tests depend on this package, so production packages are unaffected.

Worth a look

• Version skew with Aspire.Hosting.RabbitMQ. That package is still pinned at 13.3.5 (Directory.Packages.props line 16) and is referenced in the same project as Aspire.Hosting.AppHost. Aspire hosting/integration packages are normally released and consumed in lockstep -- Aspire.Hosting.RabbitMQ transitively depends on Aspire.Hosting, so NuGet will unify on the higher version (13.4.2). For patch-level deltas this usually resolves cleanly, but mixing 13.3.5 and 13.4.2 can surface NU1605/downgrade warnings or subtle runtime mismatches. Recommendation: bump Aspire.Hosting.RabbitMQ to 13.4.2 in the same PR so the two stay aligned. (Dependabot likely opened these as separate PRs; consider grouping Aspire updates in dependabot.yml.)

Notes (pre-existing, not introduced here)

• The AppHost SDK is pinned to Aspire.AppHost.Sdk 9.5.0 in the sample csproj while the hosting package is on the 13.x line. This combination predates this PR (it already shipped with 13.3.5), so it is out of scope -- flagging only in case the build starts warning about SDK/package alignment.

Testing
No test coverage is needed or expected for a transitive sample dependency bump. The meaningful validation is simply that the Greeting.AppHost sample still restores and builds -- worth confirming CI exercises it.

Nothing blocking. The main suggestion is to align Aspire.Hosting.RabbitMQ to the same version before/with merge.

-- Generated with Claude Code