.Net: Bump AWSSDK.BedrockAgent and AWSSDK.Core#14000
Conversation
Bumps AWSSDK.BedrockAgent from 4.0.7.5 to 4.0.8.5 Bumps AWSSDK.Core from 4.0.3.8 to 4.0.6.1 --- updated-dependencies: - dependency-name: AWSSDK.Core dependency-version: 4.0.6.1 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: AWSSDK.BedrockAgent dependency-version: 4.0.8.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
dependabot
Bot
added
dependencies
github-actions
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 4 | Confidence: 95%
✓ Correctness
This is a straightforward Dependabot patch-version bump of AWSSDK.BedrockAgent from 4.0.7.5 to 4.0.8.5. The change itself is correct. However, the PR title and description state that AWSSDK.Core is also being updated from 4.0.3.8 to 4.0.6.1, but no such change appears in the diff — the file still pins AWSSDK.Core at 4.0.3.8 (line 19). If BedrockAgent 4.0.8.5 requires a newer Core version, this could cause a version conflict during NuGet restore.
✓ Security Reliability
This is a straightforward Dependabot patch-level bump of AWSSDK.BedrockAgent from 4.0.7.5 to 4.0.8.5 in the central NuGet package version file. The change is confined to a single version pin in Directory.Packages.props with no code changes. No security or reliability issues identified. Note: the PR description mentions bumping AWSSDK.Core from 4.0.3.8 to 4.0.6.1, but that change does not appear in the diff — AWSSDK.Core remains at 4.0.3.8 on line 19. This is cosmetic (likely a Dependabot description artifact) and not a security concern.
✓ Test Coverage
This is a straightforward Dependabot patch-level version bump of AWSSDK.BedrockAgent from 4.0.7.5 to 4.0.8.5 in the central package versions file. No project source code or behavior is changed—only a transitive dependency version pin is updated. There are no test coverage concerns: dependency version bumps do not introduce new application behavior that would require new or modified tests. Existing tests for the AWS Bedrock connector (if any) continue to exercise the same public API surface.
✗ Design Approach
The dependency bump is incomplete in a way that matters to the repo’s restore graph:
AWSSDK.BedrockAgentis updated, butAWSSDK.Coreremains pinned to4.0.3.8, so projects that referenceAWSSDK.Coredirectly still restore the old version. That means this approach does not actually deliver the PR’s statedAWSSDK.Coreupgrade.
Flagged Issues
-
dotnet/Directory.Packages.props:19still pinsAWSSDK.Coreto4.0.3.8, whileConnectors.Amazon.csprojandConcepts.csprojreferenceAWSSDK.Coredirectly. Bumping onlyAWSSDK.BedrockAgentleaves those projects on the old core package and does not accomplish the PR's statedAWSSDK.Coreupgrade from 4.0.3.8 to 4.0.6.1.
Automated review by dependabot[bot]'s agents
| <PackageVersion Include="AWSSDK.BedrockAgent" Version="4.0.8.5" /> | ||
| <PackageVersion Include="AWSSDK.BedrockAgentRuntime" Version="4.0.8.5" /> | ||
| <PackageVersion Include="AWSSDK.BedrockRuntime" Version="4.0.14.5" /> | ||
| <PackageVersion Include="AWSSDK.Core" Version="4.0.3.8" /> |
There was a problem hiding this comment.
AWSSDK.Core is still pinned to 4.0.3.8 here, but the PR description claims it should be bumped to 4.0.6.1. Direct consumers (dotnet/src/Connectors/Connectors.Amazon/Connectors.Amazon.csproj:20, dotnet/samples/Concepts.csproj:49) will continue restoring the old version.
| <PackageVersion Include="AWSSDK.Core" Version="4.0.3.8" /> | |
| <PackageVersion Include="AWSSDK.Core" Version="4.0.6.1" /> |
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
1 similar comment
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
|
@copilot: fix the CI/CD failures |
Fixed in |
|
@copilot fix the conflicts |
Fixed in |
### Motivation and Context Semantic Kernel currently has 43 open Dependabot pull requests spanning GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This rollup applies their compatible net changes together on the latest `main`, making it possible to validate and merge the updates as one coherent dependency state. Supersedes: - microsoft#13133 - microsoft#13134 - microsoft#13136 - microsoft#13172 - microsoft#13507 - microsoft#13601 - microsoft#13606 - microsoft#13666 - microsoft#13673 - microsoft#13688 - microsoft#13700 - microsoft#13707 - microsoft#13708 - microsoft#13712 - microsoft#13721 - microsoft#13873 - microsoft#13930 - microsoft#13939 - microsoft#13949 - microsoft#13950 - microsoft#13951 - microsoft#13997 - microsoft#14000 - microsoft#14053 - microsoft#14069 - microsoft#14088 - microsoft#14091 - microsoft#14094 - microsoft#14103 - microsoft#14106 - microsoft#14107 - microsoft#14108 - microsoft#14109 - microsoft#14110 - microsoft#14128 - microsoft#14148 - microsoft#14149 - microsoft#14160 - microsoft#14161 - microsoft#14164 - microsoft#14171 - microsoft#14172 - microsoft#14173 ### Description - Updates the requested GitHub Actions and preserves the PR-file-scoped typos workflow fix. - Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript, and SQLite security updates. - Regenerates the npm, Yarn, and uv lockfiles from the combined manifests instead of resolving generated-file conflicts by selection. - Rolls overlapping updates forward to one compatible result: pyasn1 0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only overrides obsolete. - Retains updates already present on current `main` without reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0 and Prompty.Core 2.0.0-beta.3. The full .NET solution builds in Debug with zero warnings and errors. Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests, both frontend production builds, and uv lock consistency checks for the main Python project and OAuth sample. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
|
Superseded by #14176 |
Pull request was closed
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Pinned AWSSDK.BedrockAgent at 4.0.8.5.
Release notes
Sourced from AWSSDK.BedrockAgent's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated AWSSDK.Core from 4.0.3.8 to 4.0.6.1.
Release notes
Sourced from AWSSDK.Core's releases.
No release notes found for this version range.
Commits viewable in compare view.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)