.Net: Bump AWSSDK.BedrockAgent from 4.0.100.7 to 4.0.100.8 - #14297
.Net: Bump AWSSDK.BedrockAgent from 4.0.100.7 to 4.0.100.8#14297dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: AWSSDK.BedrockAgent dependency-version: 4.0.100.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates a .NET package version pin for the AWS Bedrock Agent SDK to the next patch release.
Changes:
- Bumped
AWSSDK.BedrockAgentfrom4.0.100.7to4.0.100.8.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| <PackageVersion Include="AWSSDK.BedrockAgentRuntime" Version="4.0.100.7" /> | ||
| <PackageVersion Include="AWSSDK.BedrockRuntime" Version="4.0.100.7" /> |
github-actions
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): cde7705a41ad
Model: claude-opus-4.8
Overview
This Dependabot change bumps the central-package-management pin for AWSSDK.BedrockAgent from 4.0.100.7 to 4.0.100.8, touching only one line and no source code. The critical hidden effect is that 4.0.100.8 raises its AWSSDK.Core dependency floor from [4.0.100.9, 5.0.0) to [4.0.101, 5.0.0), while the repo still pins AWSSDK.Core at 4.0.100.9. Any project that directly references AWSSDK.Core and also pulls in AWSSDK.BedrockAgent — notably the Concepts samples project — now fails NuGet restore with an NU1605 package-downgrade error. The residual risk is a build break rather than a runtime or security regression.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 high) across 1 file. Details are attached to the affected lines below.
Affected areas: dotnet/Directory.Packages.props
| <PackageVersion Include="Aspire.Hosting.Azure.Search" Version="13.4.6" /> | ||
| <PackageVersion Include="MessagePack" Version="3.1.7" /> <!-- Transitive dependency of Aspire pinned to newer version due to vulnerability in 2.5.192 --> | ||
| <PackageVersion Include="AWSSDK.BedrockAgent" Version="4.0.100.7" /> | ||
| <PackageVersion Include="AWSSDK.BedrockAgent" Version="4.0.100.8" /> |
There was a problem hiding this comment.
Bumping AWSSDK.BedrockAgent to 4.0.100.8 raises its AWSSDK.Core dependency floor from [4.0.100.9, 5.0.0) to [4.0.101, 5.0.0), but AWSSDK.Core is still pinned at 4.0.100.9 (line 20), which is lower than 4.0.101. Any project that references AWSSDK.Core directly and also pulls in AWSSDK.BedrockAgent — for example the Concepts samples project, which references AWSSDK.Core (dotnet/samples/Concepts/Concepts.csproj:51) and the Bedrock agent project (Concepts.csproj:72) — now fails NuGet restore with:
error NU1605: Detected package downgrade: AWSSDK.Core from 4.0.101 to 4.0.100.9
This was confirmed by restore: version 4.0.100.7 restores cleanly, 4.0.100.8 fails. To keep restore working, also raise the AWSSDK.Core pin to at least 4.0.101 alongside this bump (or hold AWSSDK.BedrockAgent at 4.0.100.7 until Core can move).
|
Looks like AWSSDK.BedrockAgent is updatable in another way, so this is no longer needed. |
|
Superseded by #14300. |
Updated AWSSDK.BedrockAgent from 4.0.100.7 to 4.0.100.8.
Release notes
Sourced from AWSSDK.BedrockAgent's releases.
No release notes found for this version range.
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)