dotnet · dotnet-policy-service · Jul 14, 2026 · Jul 14, 2026 · Jul 14, 2026 · Jul 15, 2026
diff --git a/.github/workflows/check-for-build-warnings.yml b/.github/workflows/check-for-build-warnings.yml
@@ -16,7 +16,7 @@ jobs:
         pull-requests: write
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-orphaned-articles.yml b/.github/workflows/cleanrepo-orphaned-articles.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-orphaned-images.yml b/.github/workflows/cleanrepo-orphaned-images.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-orphaned-includes.yml b/.github/workflows/cleanrepo-orphaned-includes.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-orphaned-snippets.yml b/.github/workflows/cleanrepo-orphaned-snippets.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-redirect-hops.yml b/.github/workflows/cleanrepo-redirect-hops.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-relative-links.yml b/.github/workflows/cleanrepo-relative-links.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/cleanrepo-replace-redirects.yml b/.github/workflows/cleanrepo-replace-redirects.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/dependabot-bot.yml b/.github/workflows/dependabot-bot.yml
@@ -26,7 +26,7 @@ jobs:
     # Checkout the repo into the workspace within the VM
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/do-not-merge-label-check.yml b/.github/workflows/do-not-merge-label-check.yml
@@ -22,7 +22,7 @@ jobs:
         - 'DO NOT MERGE'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/docs-verifier.yml b/.github/workflows/docs-verifier.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/live-protection.yml b/.github/workflows/live-protection.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
+      - uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25 # v24.0.0
         with:
           config: ".markdownlint-cli2.jsonc"
           globs: "**/*.md"
diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml
@@ -28,7 +28,7 @@ jobs:
     if: ${{ github.repository_owner == 'dotnet' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/snippets5000.yml b/.github/workflows/snippets5000.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
     # Checkout the repository for the PR
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit
 

diff --git a/.github/workflows/version-sweep.yml b/.github/workflows/version-sweep.yml
@@ -34,7 +34,7 @@ jobs:
             # Start the .NET version updater action
             # A composite of the .NET Version Sweeper and the .NET Upgrade Assistant
             - name: Harden Runner
-              uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+              uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
               with:
                 egress-policy: audit
 

diff --git a/.openpublishing.redirection.csharp.json b/.openpublishing.redirection.csharp.json
@@ -310,6 +310,10 @@
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs0417.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/generic-type-parameters-errors"
     },
+    {
+      "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs0446.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs0467.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/lambda-expression-errors"
@@ -438,6 +442,10 @@
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1564.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/invalid-build-command-line"
     },
+    {
+      "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1579.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1614.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/attribute-usage-errors"
@@ -446,6 +454,10 @@
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1616.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/invalid-build-command-line"
     },
+    {
+      "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1640.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/language-reference/compiler-messages/cs1656.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/unsafe-code-errors"
@@ -1848,6 +1860,10 @@
       "source_path_from_root": "/docs/csharp/misc/cs0200.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/property-declaration-errors"
     },
+    {
+      "source_path_from_root": "/docs/csharp/misc/cs0202.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/misc/cs0206.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/ref-modifiers-errors"
@@ -1912,6 +1928,10 @@
       "source_path_from_root": "/docs/csharp/misc/cs0227.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/unsafe-code-errors"
     },
+    {
+      "source_path_from_root": "/docs/csharp/misc/cs0230.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/misc/cs0231.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/params-arrays"
@@ -1988,6 +2008,18 @@
       "source_path_from_root": "/docs/csharp/misc/cs0277.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/interface-implementation-errors"
     },
+    {
+      "source_path_from_root": "/docs/csharp/misc/cs0278.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
+    {
+      "source_path_from_root": "/docs/csharp/misc/cs0279.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
+    {
+      "source_path_from_root": "/docs/csharp/misc/cs0280.md",
+      "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/foreach-diagnostics"
+    },
     {
       "source_path_from_root": "/docs/csharp/misc/cs0282.md",
       "redirect_url": "/dotnet/csharp/language-reference/compiler-messages/partial-declarations"

diff --git a/docs/ai/quickstarts/snippets/image-generation/openai/ImagesOpenAI.csproj b/docs/ai/quickstarts/snippets/image-generation/openai/ImagesOpenAI.csproj
@@ -8,7 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="OpenAI" Version="2.11.0" />
+    <PackageReference Include="OpenAI" Version="2.12.0" />
     <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.7.0" />
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.9" />

diff --git a/docs/ai/quickstarts/snippets/prompt-completion/openai/ExtensionsOpenAI.csproj b/docs/ai/quickstarts/snippets/prompt-completion/openai/ExtensionsOpenAI.csproj
@@ -8,9 +8,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.4.1" />
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.5" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.5" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.7.0" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.9" />
   </ItemGroup>
 
 </Project>
diff --git a/docs/ai/snippets/prompt-engineering/multi-turn-chat.csproj b/docs/ai/snippets/prompt-engineering/multi-turn-chat.csproj
@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <PackageReference Include="Azure.AI.OpenAI" Version="2.8.0-beta.1" />
-    <PackageReference Include="Microsoft.Agents.AI.OpenAI" Version="1.12.0" />
+    <PackageReference Include="Microsoft.Agents.AI.OpenAI" Version="1.13.0" />
     <!--
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.2" />
     <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.2" />

diff --git a/docs/azure/sdk/snippets/aspnetcore-guidance/BlazorSample/BlazorSample.csproj b/docs/azure/sdk/snippets/aspnetcore-guidance/BlazorSample/BlazorSample.csproj
@@ -9,7 +9,7 @@
   <ItemGroup>
     <PackageReference Include="Azure.Messaging.ServiceBus" Version="7.20.1" />
 	  <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.11.0" />
-	  <PackageReference Include="Azure.Storage.Blobs" Version="12.29.0" />
+	  <PackageReference Include="Azure.Storage.Blobs" Version="12.29.1" />
 	  <PackageReference Include="Microsoft.Extensions.Azure" Version="1.14.0" />
   </ItemGroup>
 

diff --git a/docs/core/diagnostics/snippets/OTLP-Example/csharp/OTLP-Example.csproj b/docs/core/diagnostics/snippets/OTLP-Example/csharp/OTLP-Example.csproj
@@ -11,8 +11,8 @@
     <PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.16.0" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
     <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
   </ItemGroup>
 
 <ItemGroup>

diff --git a/...tics/snippets/OTel-Prometheus-Grafana-Jaeger/csharp/OTel-Prometheus-Grafana-Jaeger.csproj b/...tics/snippets/OTel-Prometheus-Grafana-Jaeger/csharp/OTel-Prometheus-Grafana-Jaeger.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="OpenTelemetry.Exporter.Prometheus.AspNetCore" Version="1.16.0-beta.1" />
     <PackageReference Include="OpenTelemetry.Exporter.Zipkin" Version="1.16.0" />
     <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
   </ItemGroup>
   <!--</Snippet_References>-->
   <!--<Snippet_AZMReferences>-->

diff --git a/...ts/resource-monitoring-with-manual-metrics/resource-monitoring-with-manual-metrics.csproj b/...ts/resource-monitoring-with-manual-metrics/resource-monitoring-with-manual-metrics.csproj
@@ -14,7 +14,7 @@
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Diagnostics.ResourceMonitoring" Version="10.7.0" />
     <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
-    <PackageReference Include="Spectre.Console" Version="0.57.1" />
+    <PackageReference Include="Spectre.Console" Version="0.57.2" />
   </ItemGroup>
 
 </Project>
diff --git a/docs/core/extensions/caching.md b/docs/core/extensions/caching.md
@@ -365,6 +365,8 @@ Consider any of the available implementations of the `IDistributedCache` from th
 
 - [`Microsoft.Extensions.Caching.SqlServer`](https://www.nuget.org/packages/Microsoft.Extensions.Caching.SqlServer)
 - [`Microsoft.Extensions.Caching.StackExchangeRedis`](https://www.nuget.org/packages/Microsoft.Extensions.Caching.StackExchangeRedis)
+- [`Microsoft.Extensions.Caching.Cosmos`](https://www.nuget.org/packages/Microsoft.Extensions.Caching.Cosmos)
+- [`Microsoft.Extensions.Caching.Postgres`](https://www.nuget.org/packages/Microsoft.Extensions.Caching.Postgres)
 - [`NCache.Microsoft.Extensions.Caching.OpenSource`](https://www.nuget.org/packages/NCache.Microsoft.Extensions.Caching.OpenSource)
 
 ### Distributed caching API

diff --git a/docs/core/extensions/dependency-injection/snippets/anti-patterns/di-anti-patterns.csproj b/docs/core/extensions/dependency-injection/snippets/anti-patterns/di-anti-patterns.csproj
@@ -8,8 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.8" />
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.8" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
   </ItemGroup>
 
 </Project>
diff --git a/docs/core/extensions/snippets/http/generated/generated.csproj b/docs/core/extensions/snippets/http/generated/generated.csproj
@@ -11,7 +11,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.9" />
-    <PackageReference Include="Refit.HttpClientFactory" Version="13.0.0" />
+    <PackageReference Include="Refit.HttpClientFactory" Version="13.1.0" />
   </ItemGroup>
 
   <ItemGroup>