chore: Bump the dotnet-deps group with 2 updates

[dependabot]

Updated AWSSDK.S3 from 4.0.103.3 to 4.0.103.4.

Release notes

Sourced from AWSSDK.S3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Dapr.Client from 1.18.7 to 1.18.10.

Release notes

Sourced from Dapr.Client's releases.

1.18.10

What's Changed

• Actors: sync NotFound default-tracker entries after a reentrant save by @​olitomlinson in Actors: sync NotFound default-tracker entries after a reentrant save dapr/dotnet-sdk#1916

This is a fix for a regression introduced in v1.18.9!

Full Changelog: dapr/dotnet-sdk@v1.18.9...v1.18.10

1.18.9

Update to v1.18.10 - there was a regression introduced in v1.18.9 and this package should be skipped.

What's Changed

• Test proving Actors.Next unaffected by reentrancy bug by @​WhitWaldo in Test proving Actors.Next unaffected by reentrancy bug dapr/dotnet-sdk#1911
• Reentrancy refresh in place by @​olitomlinson in Reentrancy refresh in place dapr/dotnet-sdk#1912
• Improve cache not found state in actors by @​WhitWaldo in Improve cache not found state in actors dapr/dotnet-sdk#1913
• Improving actor write performance by skipping runtime "exists" checks on state writes by @​WhitWaldo in Improving actor write performance by skipping runtime "exists" checks on state writes dapr/dotnet-sdk#1914

Huge thanks to @​olitomlinson for his eagle eye in spotting and filing an issue for each of these perf improvements. He shared a benchmark with me against 1.18.4 and this release in his dapr-mq message queue implementation atop Dapr demonstrated a dramatic improvement when modeling 20 publish/relay cycles:

• 54% fewer reads against runtime state
• Because of #​1913, "not found" was cached and resulted in a single runtime read instead of 44 on a circuit subscription
• Because of #​1914, there were no runtime reads incurred when publishing compared to a prior 21

Especially for implementations that favor heavy writes and updates, you should see similar improvement.

Full Changelog: dapr/dotnet-sdk@v1.18.8...v1.18.9

1.18.8

What's Changed

• (feat): Dapr.Messaging full implementation by @​WhitWaldo in (feat): Dapr.Messaging full implementation dapr/dotnet-sdk#1906
• Update Dapr.Actors.Next to use latest Dapr.Messaging pubsub bits instead of recreating streaming pubsub impl by @​WhitWaldo in Update Dapr.Actors.Next to use latest Dapr.Messaging pubsub bits instead of recreating streaming pubsub impl dapr/dotnet-sdk#1907

Dapr.Messaging Overhaul

Prior to this release, Dapr.Client provided basis publish and dynamic streaming subscription methods, Dapr.AspNetCore offered controller-based programmatic topic subscription and Dapr.Messaging offered streaming subscription support. In this release. Dapr.Messaging now unifies and modernizes the approach:

1. Unified publishing and subscribing: Publish events with IDaprPublishSubscribeClient (including single events, raw byte streams, and bulk publishing) and author subscribers using a single ITopicHandler<TMessage> interface.
2. Three unified delivery modes: Subscriptions support DeliveryMode.Streaming (streaming subscriptions), DeliveryMode.Programmatic (programmatic subscriptions), and DeliveryMode.Http (declarative subscriptions), all configured through the same [DaprTopic] attribute.
3. Source generators eliminate reflection: The Dapr.Messaging.Generators source generator inspects [DaprTopic] handlers at compile time and emits typed dispatchers, subscriber registries, and dependency injection wiring. No runtime reflection or runtime code generation is performed on the invocation path, dramatically improving startup times.
4. AOT and trimming considerations: Like other modern Dapr packages, this package was also built with AOT in mind, but with some considerations. Handler discovery and dispatch registration are generated at compile time, but the current generated subscriber dispatchers use runtime System.Text.Json metadata. Native AOT and trimming scenarios require explicit validation with the target SDK version.
5. Roslyn analyzers and diagnostics: The SDK includes 8 new analyzers DAPR1610 through DAPR1617 that catch misconfigurations directly in your IDE at you write code
6. Standard options and simplified DI: Uses IOptions<DaprMessagingOptions> and a single services.AddDaprMessaging() method that registers options, the publishing client, source-generated subscriber dispatches, and required hosting services in a single atomic operation.

Read more about this new functionality in the docs!

Full Changelog: dapr/dotnet-sdk@v1.18.7...v1.18.8

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: deps/nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
nuget/AWSSDK.S3	4.0.103.4	Unknown	Unknown
nuget/Dapr.Client	1.18.10	🟢 5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 3 Found 11/29 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• samples/aws/aws.csproj
• samples/dapr/ui/ui.csproj