Skip to content

Bump the nuget-minor-patch group with 4 updates - #168

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-d0b7952943
Open

Bump the nuget-minor-patch group with 4 updates#168
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-d0b7952943

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor

Updated bunit from 2.8.6 to 2.9.0.

Release notes

Sourced from bunit's releases.

2.9.0

Changed

  • Update to stable package of AngleSharp.Css

Commits viewable in compare view.

Updated Marten from 9.22.0 to 9.22.4.

Release notes

Sourced from Marten's releases.

9.22.4

What's Changed

Full Changelog: JasperFx/marten@V9.22.3...V9.22.4

9.22.3

What's Changed

Full Changelog: JasperFx/marten@V9.22.1...V9.22.3

9.22.1

Security release. Upgrade is recommended for anyone using sharded tenancy together with Events.UseTenantPartitionedEvents.

A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.

You are affected only if you use sharded tenancy, have UseTenantPartitionedEvents enabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls — GetTenantAsync / FindOrCreateDatabase auto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.

Affected versions: 9.4.0 through 9.22.0.

Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw

What changed

  • PerTenantEventSequences.QuotedSequenceName escapes embedded quotes, matching quote_ident/%I so the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.
  • BulkEventAppender no longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug: PreserveSourceSequence bulk imports previously failed with 42601 for hyphenated and GUID tenant ids under sharded tenancy.
  • ShardedTenancy validates tenant ids destined for DDL, closing a long-standing asymmetry with the DefaultTenancy provisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.

Dependency

Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#​416). Both halves are needed; the dependency is pulled in automatically.

Credit to Barak Srour (Apiiro) for the report.

Commits viewable in compare view.

Updated Marten.AspNetCore from 9.22.0 to 9.22.4.

Release notes

Sourced from Marten.AspNetCore's releases.

9.22.4

What's Changed

Full Changelog: JasperFx/marten@V9.22.3...V9.22.4

9.22.3

What's Changed

Full Changelog: JasperFx/marten@V9.22.1...V9.22.3

9.22.1

Security release. Upgrade is recommended for anyone using sharded tenancy together with Events.UseTenantPartitionedEvents.

A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.

You are affected only if you use sharded tenancy, have UseTenantPartitionedEvents enabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls — GetTenantAsync / FindOrCreateDatabase auto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.

Affected versions: 9.4.0 through 9.22.0.

Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw

What changed

  • PerTenantEventSequences.QuotedSequenceName escapes embedded quotes, matching quote_ident/%I so the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.
  • BulkEventAppender no longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug: PreserveSourceSequence bulk imports previously failed with 42601 for hyphenated and GUID tenant ids under sharded tenancy.
  • ShardedTenancy validates tenant ids destined for DDL, closing a long-standing asymmetry with the DefaultTenancy provisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.

Dependency

Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#​416). Both halves are needed; the dependency is pulled in automatically.

Credit to Barak Srour (Apiiro) for the report.

Commits viewable in compare view.

Updated Radzen.Blazor from 11.2.0 to 11.2.2.

Release notes

Sourced from Radzen.Blazor's releases.

11.2.2

11.2.2 - 2026-08-04

Improvements

  • RadzenDropDown, RadzenListBox and RadzenDropDownDataGrid - Ctrl+A now selects all items in multiple selection when AllowSelectAll is enabled - press again to clear the selection. The shortcut is documented in the Keyboard Navigation section of each component.

Fixes

  • RadzenDropDown and RadzenDropDownDataGrid - the popup no longer flickers when clicking a component with OpenOnFocus and no longer reopens when clicking outside of it. Clicking the component while its popup is open now closes it. Fixes #​2640
  • RadzenDataGrid - self-reference hierarchy view no longer degrades to O(n²) per enumeration - grids with tens of thousands of rows render instantly instead of taking seconds. Fixes #​2637
  • RadzenDataGrid - custom column filter expressions are now applied even when no other filters are active (#​2639).
  • RadzenSpreadsheet - opening xlsx files with shared formulas no longer fails - XlsxReader and XlsxWriter now support them. Fixes #​2638

11.2.1

11.2.1 - 2026-08-03

Improvements

  • RadzenSpreadsheet - copy and cut now highlight the source cell range with an animated marching ants marquee (#​2625).
  • RadzenDatePicker - now passes its InputSize to the calendar inputs - Month and Year drop downs and Hour, Minutes and Seconds numerics.

Fixes

  • RadzenCarousel - pages align correctly when ItemsPerPage is an even number - middle pages no longer show neighboring items cut in half and the pager no longer jumps back after navigation.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget-minor-patch group with 4 updates
630fddb 
Bumps bunit from 2.8.6 to 2.9.0
Bumps Marten from 9.22.0 to 9.22.4
Bumps Marten.AspNetCore from 9.22.0 to 9.22.4
Bumps Radzen.Blazor from 11.2.0 to 11.2.2

---
updated-dependencies:
- dependency-name: bunit
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Marten
  dependency-version: 9.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Marten.AspNetCore
  dependency-version: 9.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Radzen.Blazor
  dependency-version: 11.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants