Skip to content

Bump the nuget-minor-patch group with 6 updates#24

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-27e587f8ff
Closed

Bump the nuget-minor-patch group with 6 updates#24
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-27e587f8ff

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated AndreGoepel.AppFoundation from 1.1.2 to 1.2.0.

Release notes

Sourced from AndreGoepel.AppFoundation's releases.

1.2.0

What's Changed

Full Changelog: andregoepel/app-foundation@v1.1.2...v1.2.0

Commits viewable in compare view.

Updated AndreGoepel.AppFoundation.Hosting from 1.1.2 to 1.2.0.

Release notes

Sourced from AndreGoepel.AppFoundation.Hosting's releases.

1.2.0

What's Changed

Full Changelog: andregoepel/app-foundation@v1.1.2...v1.2.0

Commits viewable in compare view.

Updated AndreGoepel.Marten.Identity.Blazor from 1.1.3 to 1.3.0.

Release notes

Sourced from AndreGoepel.Marten.Identity.Blazor's releases.

1.3.0

Design system overhaul + extraction.

  • The UI now uses the app-neutral AndreGoepel.Design.Blazor design system (emerald light/dark tokens, ag-* classes, AppShell, LoginShell, AppPageTitle, self-hosted fonts). AndreGoepel.Marten.Identity.Blazor now depends on AndreGoepel.Design.Blazor 1.0.0.
  • Per-page breadcrumbs, reusable theme toggle + icons, responsive off-canvas shell, admin dialog styling aligned to the design.
  • Fixes: personal-data export guard, collocated JS module paths.

1.2.0

What's Changed

Full Changelog: andregoepel/marten-identity@v1.1.3...v1.2.0

1.2.0-preview1

What's Changed

Full Changelog: andregoepel/marten-identity@v1.1.3...v1.2.0-preview1

Commits viewable in compare view.

Updated Marten from 9.12.0 to 9.14.0.

Release notes

Sourced from Marten's releases.

9.14.0

Marten 9.14.0 is the recommended upgrade for all 9.x users. It combines the LINQ SQL-injection security fix (first shipped in 9.13.0) with the fix for the projection-coordinator shutdown race in #​4874 and the accompanying dependency updates.

Beyond the LINQ updates, this made the new Per-Tenant Event Partitioning much more robust as we're testing that in conjunction with a JasperFx client for ludicrous scalability.

🔒 Security — SQL injection in the LINQ provider (GHSA-rfx3-98h7-v3xp)

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization. A value containing a single quote could break out of the literal and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter (a common "filter by attribute name" / EAV pattern) — was reported privately with an executed proof-of-concept and enabled filter / multi-tenant authorization bypass and blind data exfiltration.

Fixed sinks (#​4911):

  • DictionaryItemMember — dictionary indexer key, e.g. Where(x => x.Attributes[key] == v)
  • DictionaryContainsKeyFilter — Dictionary.ContainsKey(key) (Newtonsoft serializer + the Enum branch, which bypass System.Text.Json's quote escaping)
  • SelectParser — a constant string projected through Select(x => new { L = runtimeString })
  • DeleteAllForTenant — tenant id reaching per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id inlined into partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

Each sink now escapes embedded single quotes or binds the value as a parameter; regression tests lock down every vector, and a follow-up LINQ-wide audit cleared the rest of the query hot path (full-text search, string-method translations, comparisons, IsOneOf/Contains/subset operators, and patching paths). Affected versions: 7.0.0 – 9.12.0. Also patched in 8.37.4 (8.x line) and 9.13.0.

Reported responsibly by @​svenclaesson — thank you. See advisory GHSA-rfx3-98h7-v3xp (CVE pending assignment).

🛠️ Reliability — projection-coordinator shutdown drain race (#​4874)

On host shutdown, the native HotCold projection coordinator could abort with ObjectDisposedException: 'Npgsql.PoolingDataSource' — the coordinator's leadership poll issued an OpenAsync against an already-disposed data source while tenancy was tearing down. This is the "case B" ordering storm reported against #​4874 (distinct from the async-tenancy foundation laid in #​4907, which did not resolve it).

The fix ships through the dependency updates below, with a Marten-side regression test (Bug_4874_coordinator_drain_ordering, #​4912):

  • JasperFx 2.24.1 (jasperfx#​499/#​500) — ProjectionCoordinatorBase terminates the leadership loop on a disposed data source / wrapped cancellation instead of re-polling.
  • Weasel 9.16.2 (weasel#​349/#​350) — AdvisoryLock guards against a disposed NpgsqlDataSource during shutdown (short-circuits while disposing and treats a disposed-pool ObjectDisposedException as a non-acquire rather than propagating).

⬆️ Dependency updates

  • JasperFx 2.24.0 → 2.24.1
  • Weasel 9.16.1 → 9.16.2
  • Weasel.EntityFrameworkCore 9.2.1 → 9.16.2 (released from its prior version hold now that the Weasel line is published)

Full changelog since 9.13.0

  • #​4911 — SQL injection fix in the LINQ provider (carried into this release)
  • #​4912 — regression test for the #​4874 case-B coordinator-drain ordering storm
  • JasperFx 2.24.1 / Weasel 9.16.2 / EFCore 9.16.2 bump (#​4874 shutdown-race fix)

9.13.0

Security release. Fixes SQL injection in the LINQ provider via unescaped string literals (#​4911).

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization; a value containing a single quote could break out and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter — was reported privately with an executed proof-of-concept (filter / multi-tenant authorization bypass, blind exfiltration).

Fixed sinks:

  • DictionaryItemMember — dictionary indexer key
  • DictionaryContainsKeyFilter — ContainsKey key (Newtonsoft serializer + Enum branch)
  • SelectParser — constant string projected via Select(...)
  • DeleteAllForTenant — tenant id in per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id in partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

All 9.x users should upgrade. The 8.x line is fixed in 8.37.4. See advisory GHSA-rfx3-98h7-v3xp.

Commits viewable in compare view.

Updated Radzen.Blazor from 11.1.0 to 11.1.3.

Release notes

Sourced from Radzen.Blazor's releases.

11.1.2

11.1.2 - 2026-07-06

Improvements

  • RadzenSpeechToTextButton — speech recognition now automatically restarts when the browser ends it prematurely (browsers stop the Web Speech API session after a pause in speech), so dictation keeps going until you actually stop it.
  • Further accessibility improvements: decorative icons across components — Accordion, Chip, ColorPicker, DataGrid, DropDownDataGrid, Fieldset, Menu, PanelMenu, Panel, ProfileMenu, SelectBar, Sidebar, Tabs, Upload, HtmlEditor and Spreadsheet — are now hidden from screen readers with aria-hidden.

Fixes

  • RadzenChart: an additional value axis no longer shows category axis labels when its series is hidden (e.g. via a legend click) — the axis keeps its own numeric scale, for both bar and column series. Fixes #​2607.

11.1.1

11.1.1 - 2026-07-06

Improvements

  • RadzenChart axis Width — new property that sets the axis width in pixels. If not specified, the width is calculated automatically; setting a fixed width helps reduce unnecessary spacing when using multiple Y-axes. Thanks to @​wimsoetens-cmd!
  • RadzenQRCode / RadzenBarcode / RadzenChart ToPng — can now return the PNG data directly and accept output size options.
  • RadzenSpreadsheet Excel-style clipboard — pasting a copied range into a larger selection now tiles the copied cells to fill the selection, and paste, cut and autofill transfer the full cell state, matching Excel: formats, quote prefixes and hyperlinks are copied, empty source cells blank their destinations, cut clears the source, entering a value over a formula cell replaces the formula, and undo restores cells exactly as captured.
  • RadzenSpreadsheet column auto-fit — double-clicking a column edge resizes the column to fit its longest cell (capped at 800px).
  • RadzenDropDown / RadzenDropDownDataGrid — new public OpenPopup(), ClosePopup() and TogglePopup() methods.
  • Localization: more built-in strings are now localizable (Pager, DataGrid, DatePicker, HtmlEditor table dialogs, Dialog, Notification, Slider, Steps and more), with updated German, Spanish, French, Italian and Japanese translations.
  • Further accessibility improvements across components — AutoComplete, Alert, BreadCrumb, Carousel, CheckBox, Dialog, DropDown and more — plus unified focus-outline styles for ListBox, Pager, ProfileMenu, SelectBar, SplitButton and Tabs.

Fixes

  • RadzenRequiredValidator: no longer shows the "required" message for a filled RadzenTextBox / RadzenTextArea / RadzenPassword / RadzenMask / RadzenAutoComplete on blur and no longer blocks form submission. Fixes #​2605.
  • RadzenSpreadsheet: XLSX column widths no longer render too narrow in Excel — auto-fitted columns are measured against the rendered text using Excel's font metrics, account for East Asian wide glyphs, and are slightly over-fitted to absorb renderer differences.
  • RadzenChart: multiple value axes with RadzenBarSeries no longer behave like category axes. Fixes #​2597.
  • RadzenChart: fixed crosshair label formatting and null handling at axis edges.
  • RadzenChart: the legend line swatch now uses the custom series stroke color.
  • RadzenPieSeries: fixed the pie not displaying anything in certain scenarios.
  • RadzenPivotDataGrid: Sum/Average aggregates no longer degrade to Count for dynamic data (e.g. IDictionary) — the configured aggregate Type is used when reflection cannot resolve the property type.
  • RadzenDataGrid: escaped the popup id in setPopupAriaExpanded to fix a querySelector error with dynamically generated columns.

Breaking changes

  • RangeSnapshotCommandBase (Spreadsheet) now snapshots cells as detached clones (Dictionary<CellRef, Cell?>) instead of a value/formula/format tuple — only affects code deriving from this class.

Commits viewable in compare view.

Updated WolverineFx.Marten from 6.16.0 to 6.17.0.

Release notes

Sourced from WolverineFx.Marten's releases.

6.17.0

Why is this such a big release? Because @​jeremydmiller went on a 3 night vacation and the community decided to throw in issues and pull requests left and right!

A big theme was filling in the remaining gaps of "Name Broker" and "Broker per Tenant" support in every external messaging transport where it made sense to add that rather than just being Rabbit MQ, Azure Service Bus, and hit and miss everywhere else. We also added HTTP QUERY support.

What's Changed

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget-minor-patch group with 6 updates
4b1195a 
Bumps AndreGoepel.AppFoundation from 1.1.2 to 1.2.0
Bumps AndreGoepel.AppFoundation.Hosting from 1.1.2 to 1.2.0
Bumps AndreGoepel.Marten.Identity.Blazor from 1.1.3 to 1.3.0
Bumps Marten from 9.12.0 to 9.14.0
Bumps Radzen.Blazor from 11.1.0 to 11.1.3
Bumps WolverineFx.Marten from 6.16.0 to 6.17.0

---
updated-dependencies:
- dependency-name: AndreGoepel.AppFoundation
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: AndreGoepel.Marten.Identity.Blazor
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: AndreGoepel.AppFoundation.Hosting
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Marten
  dependency-version: 9.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Radzen.Blazor
  dependency-version: 11.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.Marten
  dependency-version: 6.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #26.

@dependabot dependabot Bot closed this Jul 12, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/nuget-minor-patch-27e587f8ff branch July 12, 2026 06:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants