.NET: Request 1.3.1 patch release — OpenTelemetry.Api GHSA-g94r-2vxg-569j still present in published NuGet packages

@chetantoshniwal is already working on this.

Since May 5, 2026.

## Summary

PR [#5478](https://github.com/microsoft/agent-framework/pull/5478) fixed the `OpenTelemetry.Api` GHSA-g94r-2vxg-569j vulnerability in the MAF source tree, but it was merged ~13 hours **after** the `dotnet-1.3.0` NuGet packages were published. As a result, downstream .NET consumers who reference `Microsoft.Agents.AI 1.3.0` (or any `1.3.x` package) via NuGet still receive `OpenTelemetry.Api 1.15.0` transitively — the vulnerable version.

## Affected releases

| NuGet package | Version | Published | Transitive `OpenTelemetry.Api` |
|---|---|---|---|
| `Microsoft.Agents.AI` | 1.3.0 | 2026-04-24 09:18 UTC | 1.15.0 ⚠️ |
| `Microsoft.Agents.AI.OpenAI` | 1.3.0 | 2026-04-24 09:18 UTC | 1.15.0 ⚠️ |
| `Microsoft.Agents.AI.Workflows` | 1.3.0 | 2026-04-24 09:18 UTC | 1.15.0 ⚠️ |

## Vulnerability details

- **Advisory**: [GHSA-g94r-2vxg-569j](https://github.com/advisories/GHSA-g94r-2vxg-569j) — OpenTelemetry.Api ≥ 1.0.0, < 1.15.3, Severity: **Moderate**
- **Patched in**: `OpenTelemetry.Api` 1.15.3
- **Trigger**: `dotnet list package --vulnerable --include-transitive` reports `NU1902` (Warning as Error in most CI configurations)

## Impact on downstream consumers

Any .NET project that adds `` will resolve `OpenTelemetry.Api 1.15.0` transitively unless they apply their own override. NuGet Central Package Management (CPM) users are especially at risk: a `` entry for `OpenTelemetry.Api` in `Directory.Packages.props` is silently ignored for transitive packages unless `CentralPackageTransitivePinningEnabled=true` is also set.

## Workaround (for consumers until a patch is released)

In `Directory.Packages.props`:

```xml

true

```

For projects that opt out of CPM (`ManagePackageVersionsCentrally=false`), add an explicit direct reference:

```xml

```

## Requested action

Please cut a **`.NET 1.3.1` patch release** from the current `main` (which already contains the fix from PR #5478) so that:

1. The published NuGet packages declare `OpenTelemetry.Api >= 1.15.3` in their dependency graph.
2. Consumers no longer need to apply manual overrides.
3. `dotnet list package --vulnerable --include-transitive` reports clean results for MAF consumers without workarounds.

This is a straightforward patch release — no API changes, only the version bump already merged in PR #5478.

---

*Note: Issue [#5481](https://github.com/microsoft/agent-framework/issues/5481) (now closed) tracked the internal build fix. This issue tracks the missing patch release for the published NuGet packages.*