## Description

13.6.1 has shipped; prepare `release/13.6` for the next servicing
release.

- **Version:** Increment `PatchVersion` in `eng/Versions.props` from `1`
to `2`, producing version `13.6.2`.

## Checklist

- Is this feature complete?
  - [x] Yes. Ready to ship.
  - [ ] No. Follow-up changes expected.
- Are you including unit tests for the changes and scenario tests if
relevant?
  - [ ] Yes
  - [x] No
- Did you add public API?
  - [ ] Yes
    - If yes, did you have an API Review for it?
      - [ ] Yes
      - [ ] No
- Did you add `<remarks />` and `<code />` elements on your triple slash
comments?
      - [ ] Yes
      - [ ] No
  - [x] No
- Does the change make any security assumptions or guarantees?
  - [ ] Yes
    - If yes, have you done a threat model and had a security review?
      - [ ] Yes
      - [ ] No
  - [x] No

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: danegsta <[email protected]>

Backport of #21051 to release/13.6

## Customer Impact

NuGet reports NU1902 (vulnerable MessagePack 2.5.302, pulled in
transitively by StreamJsonRpc) and fails restores/builds that treat
warnings as errors. Pinning to MessagePack 2.5.307 picks up the patched
2.x releases.

## Testing

Validated on main per #21051: repo restore with `-warnaserror
-p:NuGetAudit=true` (0 warnings/errors), CLI backchannel tests passed
(29), Hosting pack nuspec requires MessagePack 2.5.307. Not separately
re-run on release/13.6. Conflict in Directory.Packages.props (previous
2.5.302 pin) resolved by taking 2.5.307.

## Risk

Low. Dependency patch bump within MessagePack 2.x; StreamJsonRpc
unchanged.

## Regression?

No.

Co-authored-by: Mitch Denny <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 25f67c97-c7d9-43c6-be44-a406e0bf1b17

## Description

13.6.2 has shipped; prepare `release/13.6` for the next servicing
release.

Increment `PatchVersion` in `eng/Versions.props` from `2` to `3`,
producing version `13.6.3`, following #20877.

Validation:
- `git diff --check` — passed.
- `xmllint --noout eng/Versions.props` — passed.
- `version=$(xmllint --xpath
'concat(/Project/PropertyGroup[1]/MajorVersion,".",/Project/PropertyGroup[1]/MinorVersion,".",/Project/PropertyGroup[1]/PatchVersion)'
eng/Versions.props) && test "$version" = '13.6.3'` — passed.
- Build and unit tests not run; this only changes the servicing version
property.

Fixes # (issue)

## Checklist

- Is this feature complete?
  - [x] Yes. Ready to ship.
  - [ ] No. Follow-up changes expected.
- Are you including unit tests for the changes and scenario tests if
relevant?
  - [ ] Yes
  - [x] No
- Did you add public API?
  - [ ] Yes
    - If yes, did you have an API Review for it?
      - [ ] Yes
      - [ ] No
- Did you add `<remarks />` and `<code />` elements on your triple slash
comments?
      - [ ] Yes
      - [ ] No
  - [x] No
- Does the change make any security assumptions or guarantees?
  - [ ] Yes
    - If yes, have you done a threat model and had a security review?
      - [ ] Yes
      - [ ] No
  - [x] No

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 90328248-d3d0-4663-8634-237fc08799ba

…ons (#21002)

## Description

Backport of #20972 to release/13.6.

Aspire can leave a DCP watch open without an active reader when watch
setup is canceled or resource handlers pause event consumption. An
unread HTTP/2 watch can block DCP watcher publication and resource
mutations, leaving resource operations stalled. This backport explicitly
owns and closes watch responses and independently drains events without
changing resource event ordering or lifecycle callback dispatch. The
existing five-minute reconnection safeguard remains in place.

Related to [#20609](#20609)
and [microsoft/dcp#286](microsoft/dcp#286).
These are client-side fixes, not a replacement for API-server
slow-consumer handling. No dependency or public API changes.

## Checklist

- Is this feature complete?
  - [x] Yes. Ready to ship.
  - [ ] No. Follow-up changes expected.
- Are you including unit tests for the changes and scenario tests if
relevant?
  - [x] Yes
  - [ ] No
- Did you add public API?
  - [ ] Yes
    - If yes, did you have an API Review for it?
      - [ ] Yes
      - [ ] No
- Did you add `<remarks />` and `<code />` elements on your triple slash
comments?
      - [ ] Yes
      - [ ] No
  - [x] No
- Does the change make any security assumptions or guarantees?
  - [ ] Yes
    - If yes, have you done a threat model and had a security review?
      - [ ] Yes
      - [ ] No
  - [x] No

## Customer Impact

Customers whose DCP watch setup is canceled or whose resource handlers
stall event consumption can experience blocked resource updates and
mutations. This fix keeps the watch reader draining and closes abandoned
connections while preserving event ordering and lifecycle dispatch.

## Testing

On the resolved release/13.6 implementation, `.\restore.cmd` passed. The
following Windows run passed: **364 tests, 0 failures, 1 Linux-only
platform skip**. Coverage includes watch cancellation/disposal, paused
consumers, ordering across reconnections, periodic restart,
framing/malformed records, Status handling, retryable HTTP statuses,
existing release timeout behavior, and DCP executor lifecycle behavior.

```powershell
$env:MSBUILDTERMINALLOGGER='false'
dotnet test --project .\tests\Aspire.Hosting.Tests\Aspire.Hosting.Tests.csproj --no-launch-profile -- --filter-class '*.KubernetesServiceTests' --filter-class '*.DcpExecutorTests' --filter-class '*.PeriodicRestartAsyncEnumerableTests' --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true'
```

Source-PR-only evidence: the original head passed 367 focused tests with
one Windows platform skip, all PR checks, and Linux dogfood with
concurrent restart rounds, exit-7 recovery, and mutations after more
than five minutes idle. That dogfood was not repeated on this release
branch; no local E2E tests were run.

## Risk

Medium. No public API changes, but the fix changes core watch
concurrency and HTTP response lifetimes. Lossless buffering preserves
events; a persistently blocked handler can accumulate queued events
instead of backpressuring DCP. Release-specific API timeout and create
behavior are unchanged.

## Regression?

Unknown — no specific regression introduction or affected release was
established.

---------

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d4e69fd0-651a-47cb-aeed-cff843f6aecc

## Description

Update `release/13.6` to DCP `0.26.6`, equivalent to #21181 targeting
`main`. The release branch currently uses `0.26.5`; this PR updates all
seven platform packages in `eng/Versions.props` and their versions and
source commit in `eng/Version.Details.xml`.

- Build:
[0.26.6](https://dev.azure.com/dnceng/internal/_build/results?buildId=3110162)
- Source commit: `6096b60432a281962920b8c7d2e9cba20118b750`

Validation:
- `git diff --check` — passed.
- Python XML consistency check against #21181's head — passed: all seven
dependency records and MSBuild version properties match the source PR,
both XML files parse successfully, and no unrelated XML content changed.
- Build and runtime tests were not run locally; dependency integration
validation is left to CI.

Fixes # (issue)

## Checklist

- Is this feature complete?
  - [x] Yes. Ready to ship.
  - [ ] No. Follow-up changes expected.
- Are you including unit tests for the changes and scenario tests if
relevant?
  - [ ] Yes
  - [x] No
- Did you add public API?
  - [ ] Yes
    - If yes, did you have an API Review for it?
      - [ ] Yes
      - [ ] No
- Did you add `<remarks />` and `<code />` elements on your triple slash
comments?
      - [ ] Yes
      - [ ] No
  - [x] No
- Does the change make any security assumptions or guarantees?
  - [ ] Yes
    - If yes, have you done a threat model and had a security review?
      - [ ] Yes
      - [ ] No
  - [x] No

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 38aae934-4281-41bd-9372-2f63522ed221