Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

#7513)

Stabilize HostedFileContent.SizeInBytes and HostedFileContent.CreatedAt

Remove [Experimental] from HostedFileContent.SizeInBytes and CreatedAt so
IChatClient consumers can use them without MEAI001 suppression. These two
properties are widely available across hosted-file providers (OpenAI Files,
OpenAI Containers) and have stable shapes.

- Remove [Experimental] and [JsonIgnore] from SizeInBytes/CreatedAt and
  delete the internal SizeInBytesCore/CreatedAtCore workaround pair. The
  default JsonSerializerDefaults.Web naming policy keeps the wire names
  ('sizeInBytes' / 'createdAt') unchanged.
- Update API baseline (Experimental -> Stable) for both members.
- Purpose and Scope remain experimental (provider-shaped vocabulary/IDs).

Tests:
- Replace the file-wide '#pragma warning disable MEAI001' in
  HostedFileContentTests.cs with narrow disable/restore blocks around only
  the Purpose/Scope accesses, so the file compiles without project-level
  MEAI001 suppression.
- Add narrow disable/restore blocks in ImageGenerationOptionsTests.cs
  around the still-experimental ImageGenerationResponseFormat.Hosted and
  IImageGenerator references; switch the JSON serialization tests to
  AIJsonUtilities.DefaultOptions so the file no longer depends on the
  TestJsonSerializerContext source-gen context.
- Link both HostedFileContentTests.cs and ImageGenerationOptionsTests.cs
  into Microsoft.Extensions.AI.Stabilization.Tests; update its
  <Description>.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update dependencies from https://github.com/dotnet/arcade build 20260507.4
On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Templating , Microsoft.DotNet.Helix.Sdk From Version 10.0.0-beta.26222.2 -> To Version 10.0.0-beta.26257.4

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

---
updated-dependencies:
- dependency-name: dotnet-reportgenerator-globaltool
  dependency-version: 5.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---
updated-dependencies:
- dependency-name: dotnet-coverage
  dependency-version: 18.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---
updated-dependencies:
- dependency-name: PowerShell
  dependency-version: 7.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update dependencies from https://github.com/dotnet/arcade build 20260519.10
On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Templating , Microsoft.DotNet.Helix.Sdk From Version 10.0.0-beta.26257.4 -> To Version 10.0.0-beta.26269.10

* Update dependencies from https://github.com/dotnet/arcade build 20260525.1
On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Templating , Microsoft.DotNet.Helix.Sdk From Version 10.0.0-beta.26257.4 -> To Version 10.0.0-beta.26275.1

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

…AI.Evaluation.Reporting/TypeScript (#7532)

Bump qs

Bumps [qs](https://github.com/ljharb/qs) from 6.15.1 to 6.15.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.1...v6.15.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…o stable (#7253)

* Move Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes to stable

* Disable EnablePackageValidation

* Update src/Libraries/Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes/Microsoft.Extensions.Diagnostics.ResourceMonitoring.Kubernetes.csproj

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add suppression file

* Run ApiChief on ResourceMonitoring libs

* Update APIs

* Fix api warning

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…I.Evaluation.Reporting/TypeScript (#7537)

Bump tmp

Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.6.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.5...v0.2.6)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…leware workaround (#7538)

Remove the special case in ExtractAndRemoveApprovalRequestsAndResponses that
handled ToolApprovalResponseContent with InformationalOnly=true for sessions
serialized before PR #7468. Instead, provide a middleware workaround
(ApprovalHistoryNormalizingChatClient) that normalizes the InformationalOnly
flags on TARC/TAResp pairs before FICC processes them.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…7545)

Upgrade OpenAI package from 2.10.0 to 2.11.0 (#7544)

- Bump OpenAI version to 2.11.0 in central package management

Co-authored-by: David Cantú <dacantu@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… objects (#7547)

* Fix ToolJson.AdditionalProperties to accept sub-schema objects

Change AdditionalProperties from bool to JsonElement so that
JSON Schema additionalProperties values like {"type":"string"}
are preserved instead of throwing a JsonException during deserialization.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use JsonElement.Parse instead

---------

Co-authored-by: David Cantu <dacantu@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Suppress NU1507 in Directory.Build.props (no package source mapping on internal branches)
- Remove packageSourceMapping section from NuGet.config
- Set StabilizePackageVersion=true and DotNetFinalVersionKind=release in eng/Versions.props
- Add private feeds credentials setup tasks and comment out integration tests in BuildAndTest.yml
- Remove codecoverage stage and its post-build dependency from azure-pipelines.yml

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Lift CVE-impacted transitive dependencies in test projects

* eng/packages/Tests.props: pin OpenTelemetry.Api 1.15.3,
  NuGet.Packaging 6.8.2, and NuGet.Protocol 6.8.2 (keep
  OpenTelemetry.Exporter.InMemory at 1.9.0).
* Add explicit OpenTelemetry.Api PackageReference to AI.Tests,
  AI.Integration.Tests, AI.OllamaSharp.Integration.Tests, and
  DataIngestion.Tests to lift the vulnerable transitive (GHSA-g94r-2vxg-569j).
* Add explicit NuGet.Packaging and NuGet.Protocol PackageReferences
  to the AI/McpServer/Agents.AI template integration tests to lift
  the vulnerable transitive (GHSA-g4vj-cjjj-v7hg).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>