Aspire 13

Last reviewed Sep 19, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. C# 14106 lines · 4.4K tokens
  2. Aspire 1369 lines · 3.6K tokens
Total175 lines · 8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 89
  • 94
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 257
  • 287
  • 295
  • 306
  • 319
  • 323
  • 327
  • 338
  • 362
  • 367
  • 378
  • 426
  • 434
  • 497
  • 502
  • 532
  • 611
  • 636
  • 668
  • 674
  • 732
  • 759
  • 770
  • 772
  • 775
  • 798
  • 807
  • 862
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1395
  • 1427

Prompt Preview

Apply the C# 14 baseline first. These rules cover Aspire 13 C# AppHosts, service defaults, integrations, dashboard, local orchestration, and deployment. Use the .NET 10 SDK for C# AppHosts; referenced .NET applications can target .NET 8 or later on a supported, patched runtime. The Aspire.Hosting package's net8.0 target does not establish the AppHost SDK requirement.

Version scope and AppHost authority

  • Microsoft supports only the latest Aspire release at its latest servicing update, and a minor release loses support when the next minor or major ships, so the newest patch of an older minor isn't a supported state. These rules cover the Aspire 13 line and were checked against 13.5.3; plan upgrades to the current release rather than holding production on any one release, and recheck these rules against each new release's notes when you move.
  • Pin compatible Aspire SDK, CLI, hosting integrations, and dashboard versions. Account for AspireUseCliBundle=true in new 13.5 C# templates: dotnet run can acquire the CLI through dnx, so package feeds and tool resolution belong in the trusted build boundary.
  • Define the AppHost resource graph in trusted code and prevent request data from selecting resource types, images, commands, arguments, mounts, endpoints, or lifecycle actions.
  • Treat AppHost packages, AddExecutable, build callbacks, and deployment pipeline steps as executable code with the AppHost identity's permissions. Use separate credentials and execution environments for development, CI, and production administration.
  • Review integration containers