Skip to content

Bump the nuget-minor-patch group with 10 updates - #75

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-2561ed3269
Open

Bump the nuget-minor-patch group with 10 updates#75
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-2561ed3269

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Updated AngleSharp from 1.8.5 to 1.9.0.

Release notes

Sourced from AngleSharp's releases.

1.9.0

Released on Friday, October 30 2026.

What's Changed

  • Improved performance of TextContent, :contains(), GetElementById, GetElementsByName, GetElementsByClassName, GetElementsByTagName and Normalize, which also continue with an explicit stack below 128 levels instead of recursing (#​1389) @​michaelthyregod
  • Improved performance of IHtmlParser.ParseFragment and of inserting many nodes at once (Append, Prepend, ...): finding a template's host no longer scans the whole document, and removing a node's last child no longer scans its siblings
  • Improved performance of removing or inserting a node's first child, which no longer shifts all its siblings, so moving every child of a large node one by one (or replacing it via innerHTML) takes linear time; each node with children also allocates one object less
  • Improved quadratic parse time on hostile markup: elements and text foster-parented out of a table, a text run split by ignored end tags (x</q>x</q>...), and repeated html / body start tags piling up attributes; attribute name lookups on elements with many attributes no longer scan them
  • Improved performance of :has(): relative arguments only walk what they can reach (:has(> a) the descendants, :has(+ a) / :has(~ a) the following siblings) instead of the parent's whole subtree, the walk no longer allocates, and a :has() is tested after the rest of its compound and its ancestor chain, so rules such as .tree :has(.skeleton):hover only walk subtrees of hovered elements inside .tree
  • Fixed setInterval with a delay of 0 never yielding: every round completed synchronously and queued tasks until memory ran out; a negative delay of setTimeout or setInterval threw instead of counting as 0 (nested intervals now wait at least 4ms, as in browsers)
  • Fixed fragment parsing (ParseFragment, innerHTML) to break out of svg / math on HTML start tags such as p, b or div, which previously stayed foreign elements
  • Fixed CreateElement<TElement>() depending on reflection that trimming can break; IElement, IHtmlElement and ISvgElement now throw instead of returning an arbitrary element @​michaelthyregod
  • Fixed IHtmlParser.ParseFragment to keep an SVG or MathML context element in its namespace (and an annotation-xml context's encoding), instead of parsing as if the context were an HTML element of the same name, and to find a form ancestor of the context, so a nested <form> start tag is ignored as with innerHTML
  • Fixed inserting a detached template into its own contents not throwing a HierarchyRequestError
  • Fixed AwaitEventAsync removing its listener off-thread while a dispatch was still running (#​1397) @​michaelthyregod
  • Fixed event listener registration racing a dispatch on another thread @​michaelthyregod
  • Fixed IHtmlSelectElement.SelectedIndex gaining a setter; set Options.SelectedIndex to change the selection (#​1395) @​SimonCropp
  • Added AwaitEventAsync overload taking a CancellationToken @​michaelthyregod
  • Added trimming and Native AOT compatibility (IsAotCompatible) for the .NET 8 and .NET 10 targets (#​1398) @​michaelthyregod
  • Added trim-safe generic overloads of SubmitAsync, Attr, VirtualResponse.Headers and ToDictionary, which calls with an anonymous object bind to when recompiled; the Object overloads are now obsolete @​michaelthyregod
  • Released 1.9.0 by @​FlorianRappl in Release 1.9.0 AngleSharp/AngleSharp#1399

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.8.6...v1.9.0

1.8.6

Released on Sunday, October 25 2026

What's Changed

  • Removed temporary copies when serializing text that needs no HTML escaping @​perfloop-agent in Avoid rebuilding unescaped text during HTML serialization AngleSharp/AngleSharp#1388
  • Fixed INode.Equals (isEqualNode) to compare what the DOM spec compares: character data, doctype identifiers, processing instructions, element prefixes and attribute local names, no longer base URLs, without overflowing the stack on deep trees
  • Fixed IAttr.Equals comparing the prefix instead of the local name
  • Fixed IDocument.Import (importNode) returning nodes owned by the source document instead of the importing one
  • Fixed IDocument.Import accepting a shadow root instead of throwing NotSupported
  • Fixed INode.Clone and Import overflowing the stack on deeply nested trees and templates
  • Fixed a shallow clone of a <template> copying its contents
  • Fixed serializing < and > in attribute values unescaped, which let markup break out when reparsed under different rules (mutation XSS); they are now written as &lt; and &gt; like browsers do since the HTML spec change of May 2025
  • Fixed IRange.CopyContent and ExtractContent overflowing the stack on deeply nested ranges
  • Fixed Dispatch (dispatchEvent) returning true for a canceled event
  • Fixed MutationObserver not observing a document itself and throwing for one without a root element
  • Fixed MutationObserver.Disconnect keeping the previous targets for a later Connect
  • Fixed a failing navigation or submission from DoClick crashing the process; it is reported as a context error
  • Fixed URLSearchParams treating non-ASCII values as single bytes and leaving + undecoded @​NotAFlightRisk in Decode URLSearchParams as UTF-8 and treat + as a space AngleSharp/AngleSharp#1390
  • Added the IHtmlSelectElement.SelectedIndex setter
  • Added HtmlParserOptions.MaximumDepth (default 512) to stop deeply nested markup from building trees that overflow the stack
  • Added focusing of elements with a tabindex and blurring of any focused element
  • Added DoClickAsync to await a click's navigation or form submission
  • Added toggling the parent <details> when clicking its <summary>
  • Added declarative shadow DOM: the parser attaches <template shadowrootmode="open"> (or closed) as the shadow root of its parent
  • Added :host(<compound>), and selectors in a shadow tree reaching its host (only through :host)
  • Released 1.8.6 by @​FlorianRappl in Release 1.8.6 AngleSharp/AngleSharp#1391

New Contributors

Full Changelog: AngleSharp/AngleSharp@v1.8.5...v1.8.6

Commits viewable in compare view.

Updated Aspire.Hosting.AppHost from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.AppHost's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.PostgreSQL from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.6.1 to 13.6.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.6.4

What's New in Aspire 13.6.4

Patch release for Aspire 13.6 that improves resource startup reliability, fixes Azure publishing with parameterized enum properties in TypeScript AppHosts, and tightens CLI diagnostic log permissions on Unix.

🐛 Fixes

  • 🖥️ Resources could fail to start after a DCP create request timed out — AppHost now checks whether a resource was created before retrying a timed-out or HTTP 504 request, avoiding a premature FailedToStart state when DCP completed the operation. API operations default to a 40-second timeout with an additional 20-second allowance before the first successful operation, and resource creation has a two-minute recovery budget. These limits can be configured through DcpPublisher:KubernetesApiTimeout, DcpPublisher:KubernetesInitializationAdditionalTimeout, and DcpPublisher:KubernetesCreateRecoveryTimeout. Established watch and log streams are not limited by these operation timeouts. Addresses startup timeouts reported in 13.6. Fixes #​20691. (#​20868, backport of #​20752, @​danegsta)

  • ☁️ TypeScript AppHosts could fail to publish parameterized Azure enum properties — Assigning a bicep().parameter(...) expression to an enum-valued provisioning property, such as an Azure Storage SKU name, now works instead of failing with a type-assignment error. Type checking for literal values and incompatible expression types is preserved. Fixes a scenario introduced with the Azure provisioning proxy feature in 13.6. (#​20767, backport of #​20557, @​sebastienros)

  • 🔒 CLI diagnostic logs now use owner-only permissions on Unix — Log files are restricted to owner read/write access (0600), including reused files, and the dedicated Aspire logs directory uses owner-only access (0700), repairing existing permissions when needed. Newly created custom log directories also use 0700; existing custom parent directories and Windows permission behavior are unchanged. Diagnostic logs can contain sensitive data, including dashboard login URLs, so review them before sharing. (#​21282, backport of #​21276, @​mitchdenny)

Full Changelog: v13.6.3...v13.6.4

Full commit: c89352703f78ae46de90fbf751ed8b52b77b89bf

13.6.3

What's New in Aspire 13.6.3

Patch release for Aspire 13.6 that improves resource orchestration reliability by preventing unread resource watches from stalling resource updates and operations.

🐛 Fixes

  • 🖥️ Resource operations could stall when a watch stopped being read — AppHost now closes abandoned watch connections when setup is canceled and keeps reading resource events even when event handlers are slow. Resource event ordering, lifecycle callback dispatch, and the existing periodic reconnection safeguard are preserved. (#​21002, backport of #​20972, @​danegsta)

  • 🔄 Slow watchers could block other resource updates or watcher shutdown — The bundled Developer Control Plane (DCP) is updated to 0.26.6, which keeps internal lifecycle watches draining and uses bounded, asynchronous watch delivery to prevent unread watches from blocking resource-change publication and unrelated watcher shutdown. (#​21215, @​danegsta; includes microsoft/dcp#​307)

Full Changelog: v13.6.2...v13.6.3

Full commit: 38294b1b31552dae42a516cffa0cbc737ec08976

13.6.2

Full commit: af07e33f8d1ef733645138b3f8e36067d073148d

What's Changed

Full Changelog: microsoft/aspire@v13.6.1...v13.6.2

Commits viewable in compare view.

Updated Marten from 9.50.3 to 9.56.0.

Release notes

Sourced from Marten's releases.

9.56.0

What's Changed

Full Changelog: JasperFx/marten@V9.55.0...v9.56.0

9.55.0

Read before upgrading

Apps running under a Turkish or Azerbaijani culture (tr-TR, az-AZ) with document types whose names contain an uppercase I. Document aliases (#​5778), DdlTemplate lookups and flat-table upsert function names (#​5783) are now lowered with the invariant culture. Before this release, those cultures turned I into a dotless ı, so a document type Invoice was stored in mt_doc_ınvoice. From 9.55.0 it maps to mt_doc_invoice, and Marten will create that table empty. Rename the existing tables (and their upsert functions) to the invariant name before upgrading, or the existing documents will appear to be missing. Apps on any other culture are unaffected: the names they generate are unchanged.

Behaviour change: StoredDocument.Version for projection documents (#​5773). For a mapping that uses UseVersionFromMatchingStream with revisions, the diagnostics version token is now <mt_version>:<mt_last_modified as epoch microseconds> (or an md5 of the document body when last-modified tracking is disabled). It used to be mt_version alone, which did not change when the daemon rewrote the document at the same stream version. Anything that parsed the token as an integer must be updated. Undeleting a projection document through the diagnostics writer also no longer bumps mt_version past the stream's version.

Fixes worth calling out

  • HiLo ids recover after an outage (#​5784). If the first id allocation on a fresh store hit a database outage, every later allocation on that store rethrew the same exception after the database came back. Thanks to @​kentcooper for the report and the reproduction the regression test is built from.
  • Subclass queries use nested duplicated-field columns (#​5777). A query on a subclass now uses the duplicated column for a nested member such as x.Inner.Value, instead of falling back to the JSONB path.
  • Verbose connection tracing (#​5772). With TrackConnections = TrackLevel.Verbose, a marten.append.event activity event is now emitted on every append route, including the Quick routes that are the V9 default. Expect more events per append than before.
  • Weasel 9.47.1 fixes index readback for a DatabaseSchemaName that is a reserved word or contains uppercase. Before, every schema apply after the first failed with 42P07 (weasel#​750, contributed by @​marc-RocketRez).
  • StreamPagedByCursor writes each page's bytes directly and disposes its pooled stream (#​5776, @​chrisbbe).

What's Changed

New Contributors

Full Changelog: JasperFx/marten@v9.54.2...V9.55.0

9.54.2

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V9.54.1...v9.54.2

9.54.1

Full Changelog: JasperFx/marten@V9.54.0...V9.54.1

9.54.0

Full Changelog: JasperFx/marten@v9.53.0...V9.54.0

9.53.0

9.53.0 is a minor release. It picks up JasperFx 2.94.0 and implements the three members that release adds, for CritterWatch's Document Store Explorer and Event Store Explorer (#​5756).

New

  • IReadOnlyEventStore.QueryEventData<T>(tenantId) (jasperfx#​1073): store-agnostic LINQ over the bodies of one event type, across every stream. It runs through the shared DocumentQueryableExtensions terminators (ToListAsync, CountAsync, AnyAsync, FirstOrDefaultAsync).
    • It is QueryRawEventDataOnly<T>() under the shared name. Events in archived streams are excluded, as they are there.
    • An untranslatable member is refused with BadLinqExpressionException naming it.
    • The tenant rule is the same as QueryStreamStates:
      • a non-null tenant without conjoined event tenancy throws NotSupportedException;
      • with conjoined tenancy, a non-null tenant scopes the query to that tenant;
      • null uses the session's tenant.
  • IDocumentStoreDiagnosticsWriter.PreviewDocumentJsonAsync (jasperfx#​1071): a dry run of SaveDocumentJsonAsync.
    • It shares the save's type resolution, deserialization and id check, so it refuses exactly what a save refuses.
    • It returns the JSON as the store's serializer (System.Text.Json or Newtonsoft) would store it, so a console can show that a member is about to be dropped.
    • It opens no session and ignores ExpectedVersion.
  • DocumentTypeRef.IsSoftDeleted (jasperfx#​1070): IDocumentStoreDiagnostics.DocumentTypesAsync reports whether each type uses DeleteStyle.SoftDelete. A sub-class reports its root mapping's delete style.

Compliance

  • EventDataQueryCompliance is newly enrolled.
  • The ReportsDocumentDeleteStyle and SupportsDocumentWritePreview gates are on.

Dependencies

  • JasperFx, JasperFx.Events, JasperFx.Events.ComplianceTests, JasperFx.SourceGenerator and JasperFx.Events.SourceGenerator: 2.93.1 → 2.94.0 (release notes).

9.52.0

Highlights and behaviour changes

Built on JasperFx 2.93.1.

  • New table: mt_event_projection_floors. Every event store gets this table as a schema migration on its next
    apply (#​5740). It holds the persisted projection start floors behind the new AsyncOptions.SubscribeFromFirstRun().
    A database whose schema has not been migrated yet keeps starting its projections exactly as before. Floors survive
    DeleteAllDocumentsAsync, DeleteAllEventDataAsync and ResetAllData, and they are removed along with a tenant.
  • New option: StoreOptions.Advanced.ExceptionTransforms (#​5682). Register your own exception transforms, consulted
    before Marten's built-in ones, to turn a PostgresException with your own SQLSTATE into a typed exception.
  • Document diagnostics for CritterWatch (#​5740): restore a soft-deleted document (UndeleteDocumentAsync), and order
    a document page by last modified, numeric revision or created time ("newest first").
  • A permanent database error in projection code is now attributed to the event that hit it (#​5741). The paused
    shard reports ShardFailureCategory.ApplyEvent and names the event, where it used to report Other with no event.
    It is still not dead-lettered, and it was never retried before either.
  • IEventStore.PreviewHighWaterAdvanceAsync / AdvanceHighWaterMarkToLatestAsync (#​5738): preview, then
    advance, the high-water mark to the latest event, the store-agnostic operation CritterWatch calls.
  • Fixes:
    • removing a tenant under UseTenantPartitionedEvents no longer fails with 23503, whether the store has DCB tag
      rows (#​5720) or a [NaturalKey] aggregate (#​5742);
    • a multi-stream projection's revision is no longer truncated through int past int.MaxValue, so ILongVersioned
      works as #​4526 advised (#​5723);
    • UndoDeleteWhere / HardDeleteWhere no longer cause a false ConcurrencyException on a numeric-revision write
      later in the same session (#​5743).
  • The Aspire sample now uses Aspire.AppHost.Sdk 13.6.3 with a PostgreSQL resource. The NuGet publish workflow no
    longer installs the obsolete aspire workload (#​5724).

What's Changed

Full Changelog: JasperFx/marten@v9.51.0...v9.52.0

9.51.0

What's Changed

Full Changelog: JasperFx/marten@V9.50.3...v9.51.0

Commits viewable in compare view.

Updated MessagePack from 2.5.303 to 2.5.307.

Release notes

Sourced from MessagePack's releases.

2.5.307

Security fix

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.305...v2.5.307

2.5.305

Security fix

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.303...v2.5.305

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Playwright from 1.63.0 to 1.64.1.

Release notes

Sourced from Microsoft.Playwright's releases.

1.64.1

Highlights

#​3391 - chore(driver): bump bundled Node.js to 24.22.1

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155

1.64.0

🧰 WebMCP

New page.Webmcp and frame.Webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like
any other part of your app:

var browser = await playwright.Chromium.LaunchAsync(new() { Args = new[] { "--enable-features=WebMCP" } });
var page = await browser.NewPageAsync();
await page.GotoAsync("https://example.com");

foreach (var tool in await page.Webmcp.ToolsAsync())
    Console.WriteLine($"{tool.Name}: {tool.Description}");

var result = await page.Webmcp.CallToolAsync("add", new { a = 2, b = 40 });
Console.WriteLine(result?.GetProperty("content")[0].GetProperty("text")); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

await page.Screencast.StartAsync(new()
{
    Path = "video.webm",
    Size = new() { Width = 1920, Height = 1080 },
    Fps = 60,
});
await page.Screencast.ShowActionsAsync(new()
{
    Style = new()
    {
        Point = "width: 20px; height: 20px; border-radius: 50%; background: red",
        Highlight = "outline: 2px solid #​333; background: rgba(0, 128, 255, .15)",
        Title = "font-size: 16px",
    },
});
  • New RecordVideoFps option and new Fps option in Screencast.StartAsync(). Firefox and WebKit currently capture up to 25 frames per second.
  • New Style option takes CSS declarations for the Point marker, the target Highlight and the action Title. It replaces the FontSize option, which is now deprecated.
    ... (truncated)

Commits viewable in compare view.

Updated Radzen.Blazor from 12.1.4 to 12.1.9.

Release notes

Sourced from Radzen.Blazor's releases.

12.1.9

12.1.9 - 2026-10-31

Improvements

  • Spreadsheet formulas support the ^ and % operators, which returned #NAME? before. ^ is left associative and binds looser than unary minus and % is a postfix operator, as in Excel, so =2^3^2 is 64, =-2^2 is 4 and =5%% is 0.0005. ^ and POWER share one calculation: 0^0 returns #NUM!, 0^-1 returns #DIV/0!, overflow returns #NUM! and odd roots of negative numbers such as (-8)^(1/3) work. POWER returned #DIV/0! on overflow before, and arithmetic overflow such as =10^308*10 now returns #NUM! instead of infinity.
  • Spreadsheet accepts a sheet qualified #REF! such as Sheet1!#REF! and 'My Sheet'!#REF!, the form Excel writes when a referenced row or column is deleted. These formulas evaluated to #NAME? before.
  • Spreadsheet deletes several rows or columns in one pass. On a sheet with 60000 formulas, deleting 2000 rows drops from 61s to about 0.5s.
  • DataGrid can expand or collapse all groups from the header of the group expand column. The new ShowGroupExpandAll parameter renders a toggle button in the first group header cell and the public ToggleAllGroupsExpand method does the same from code. The title and aria-label come from the new ExpandAllGroupsTitle and CollapseAllGroupsTitle parameters.
  • Tabs supports closable tabs. RadzenTabsItem gets a Closable parameter that renders a close icon after the title, and clicking it or pressing Delete raises the new Close event with the tab and its index. RemoveItem keeps the same tab selected when an earlier tab is removed and selects a neighbouring enabled tab when the selected tab is removed.
  • Menu can share a header row with other items on small screens through the new rz-display-contents utility on a responsive menu, and rz-display-sm-flex restores it above 768px.

Fixes

  • Spreadsheet row and column deletes update formula references the way Excel does. References after the deleted rows move, a range shrinks when its start or end is deleted, and a reference left with no cells becomes #REF!. Before, remaining rows read the wrong cells, ranges returned #REF! and undo left shifted formulas behind. Undo and redo now restore every formula in the workbook, including validation formulas and chart series.
  • Spreadsheet defined names follow row and column inserts and deletes, and formulas using them keep tracking the moved cells. Names were never updated before, so a name kept pointing at its old address.
  • Spreadsheet row and column inserts keep formulas the parser cannot represent. An insert used to rewrite the formula from a partial parse, which corrupted it.
  • Spreadsheet formulas on other sheets recalculate when a row or column delete changes what a whole column or row reference covers.
  • Spreadsheet context menus act on the whole selection. Right-clicking inside a selection keeps it, and Delete, Hide and Unhide apply to every selected row or column (#​2782). Sort limits itself to a multi-cell selection outside tables and autofilters (#​2784).
  • Spreadsheet filter menu shows the active filter when it reopens. Every checkbox came back unchecked for text values, and OK then replaced the filter with one on blanks (#​2783). Custom, top and above or below average filters reopened with every box ticked and OK cleared them; the checkboxes now show what the filter keeps and OK with no change leaves the filter alone.
  • Steps no longer sends a Blazor Server process into a runaway render loop when an async CanChange handler is combined with a Change handler and a bound SelectedIndex. CanChange is raised for user-initiated changes only and SelectedIndexChanged is raised before Change (#​2785).
  • Tabs raises SelectedIndexChanged before Change, so an async CanChange no longer leaves the tab on the old index, and handled keys no longer swallow the next keystroke.
  • Scheduler aligns the all-day row with the time grid when the week view groups by resource.
  • Themes replace :root:has(.rz-layout) with depth-bounded selectors to reduce style recalculation cost.

12.1.8

12.1.8 - 2026-10-28

Improvements

  • DataGrid can be given an accessible name through the new AriaLabel and AriaLabelledBy parameters, rendered on the element with the grid or treegrid role. The role element rendered no name and aria-label or aria-labelledby splatted onto the component landed on the role-less wrapper where assistive technology ignores them, so screen readers announced an unnamed grid and axe reported "ARIA grid must have an accessible name". When the parameters are not set a splatted aria-label or aria-labelledby is used instead and those two attributes no longer reach the wrapper, because ARIA 1.2 prohibits naming a generic element (#​2780).

Fixes

  • AppearanceToggle has an accessible name and reports aria-pressed for the dark theme. The button rendered no name, because RadzenToggleButton wrote its AriaLabel parameter after the splatted attributes and removed an aria-label placed on the component; the toggle button now falls back to the splatted aria-label and omits the attribute when neither is given, and RadzenAppearanceToggle gains an AriaLabel parameter that defaults to the localized "Dark theme" text. The pressed state used to mean the light theme was active, so screen readers announced "Dark theme, pressed" in the light theme; aria-pressed, the active state and the toggled style now follow the dark theme while the icons and click behavior are unchanged. When the light and dark names resolve to the same theme the button is rendered disabled instead of flipping a pressed state that changed nothing (#​2781).
  • DataGrid applies KeyProperty regardless of where it appears in the markup. The key getter used to match selected, expanded and child-data items by key was created only when Data changed, so a KeyProperty placed after Data was ignored on the first render and a Value item that was a different instance with the same key was not highlighted; a later change of KeyProperty was ignored as well. The getter is now created after the parameters are set and recreated when KeyProperty changes.
  • DataGrid keeps the selection when Value is bound before Data and both change in the same render. Reset, which runs whenever Data changes, emptied the Value backing field without touching the selected items, so Blazor assigned Value first, the Data setter wiped it and no row was highlighted until the next render while Value reported no selection. The field is now cleared only together with the selected items when Reset is asked to reset row state.
  • DataGrid merges a class added through RowRender with the row class instead of replacing it. The consumer class was splatted after the computed row class and removed rz-data-row and the rz-state-highlight selection class, so styled rows lost their selection highlight; the classes are now combined, also when a RowClick handler adds the row click to the same attributes.

12.1.7

12.1.7 - 2026-10-26

Improvements

  • Spreadsheet gains ShowColumnHeaders and ShowRowHeaders parameters, both true by default. Setting one to false hides the column letters or the row numbers together with the space they take, their resize handles and whole-row or whole-column selection, which suits presentation grids where the axis labels live in frozen rows and columns instead. The setting applies to every sheet of the workbook and can be toggled at runtime, and frozen pane splitters stay in place when the headers are hidden (#​2728). Thanks to @​panoskentros!
  • Spreadsheet formula engine supports the LOOKUP and INDIRECT functions, which returned #NAME? before. LOOKUP covers the vector and array forms with Excel's case-insensitive comparison, type skipping and vector extension rules. INDIRECT accepts A1 text with or without a sheet name, a defined name and R1C1 text with offsets relative to the formula cell, returns #REF! and #VALUE! as Excel does, and is volatile so dependent formulas recalculate on every change. Both are shown in the Spreadsheet formulas demo (#​2777).
  • Spreadsheet keeps sheet-scoped, built-in and hidden defined names. Worksheet has a DefinedNames dictionary for names scoped to that sheet, a formula resolves a sheet-scoped name before a workbook name of the same name, renaming a sheet rewrites references in both, and xlsx files round-trip Print_Area, Print_Titles, _FilterDatabase and the hidden attribute instead of dropping them (#​2777).
  • Chart stacked column and bar series gain a StackGroup parameter. Stacked series that share a group form one stack and different groups render side by side in the same category, each with its own value axis fit, so revenue and expense breakdowns can sit next to each other and next to a plain column series (#​2776).

Fixes

  • Spreadsheet tables, filters, conditional formats, data validation, images and charts now follow row and column insertion and deletion. The worksheet shifted cells, sizes, merged cells and formulas but left every other structure at its old address, so inserting a row inside a table kept the header, totals and banding styles on the old rows while the values moved, and the row appeared to be inserted several rows below the cursor. Table ranges and columns, sheet and per-column filters with the columns in their criteria, conditional format and validation ranges, validation formulas, drawing anchors and chart series references on any sheet now move or resize with the edit, and deleting rows or columns snapshots every table so undo restores a trimmed or removed table exactly (#​2779).
  • Spreadsheet VLOOKUP, HLOOKUP, MATCH and XMATCH treat a blank lookup value and blank cells as Excel does, so a blank lookup no longer matches the first blank cell of the lookup column and shows an empty string where Excel shows 0. The approximate modes no longer fail on a column that mixes numbers and text (#​2777).
  • Spreadsheet XLOOKUP and XMATCH match Excel for blank cells, empty strings and values of different types. A blank lookup value and an empty string are no longer treated as equal, and the approximate and binary search modes order values as Excel does, so the next-larger mode returns the smallest larger value instead of the first larger one it meets.
  • Spreadsheet saves xlsx files that Excel opens. Shared formulas that reference a sheet by name are written as plain formulas, external workbook links and the names and formulas that use them survive a load and save, a list validation whose source is a range is read as a reference and written unquoted, and a list of several items is written in the form Excel accepts (#​2777).
  • Tooltip content taller than the viewport scrolls inside the tooltip instead of growing the document. When no side of the target had room, the popup was clamped to the viewport edge and overflowed the page, which added a document scrollbar, covered the target and raised a spurious MouseLeave that reopened the tooltip in a loop. The fallback now picks the side with the most room, caps the popup at the viewport edge with max-height and inner scrolling, and keeps a max-height from TooltipOptions.Style (#​2548).
  • Chart column series and stacked column series no longer overlap when used in the same chart, and the same holds for bar and stacked bar series. Each family laid itself out from its own siblings only, so a stacked series centered its stack on the category tick regardless of the plain columns next to it. One band per category is now shared by all column-type or bar-type series for rendering, tooltips, data labels and hit-testing (#​2776).
  • AutoComplete no longer flashes stale suggestions after the input drops below MinLength. Backspacing kept the previous matches on screen until the filter delay elapsed, and the next keystroke reopened the popup with the same stale items. The search text is cleared when the popup closes and the input listener keeps the popup closed while the value is shorter than MinLength (#​2775).

12.1.6

12.1.6 - 2026-10-22

Improvements

  • Localization ships a built-in Portuguese translation. The new RadzenStrings.pt.resx satellite covers every resource key and uses the neutral pt culture, so it applies to pt, pt-BR and pt-PT apps without any setup. The wording follows common Brazilian usage in business software. Portuguese is also available in the localization demos (#​2774).

Fixes

  • AIPrompt no longer loses typed characters in interactive server mode. The textarea was a manually controlled input, so every keystroke re-rendered it with a value that was already stale by the time it reached the browser. It now uses two-way binding, and Enter without Shift is blocked on the client by a static keydown listener instead of a per-render handler, so the newline is prevented from the very first render. Shift+Enter still inserts a newline (#​2772). Thanks to @​felippenvieira!
  • Menu no longer swallows Tab and Shift+Tab on the menubar, so keyboard focus leaves the menu in one keystroke (WCAG 2.1.2). The render-time preventDefault flag was applied from the previous render, which blocked the first Tab after the menubar took focus and every Tab after a handled key. A static document listener now prevents the default per key in the browser for arrows, Home, End, Enter, Space, Escape and typeahead characters only (#​2773).
  • DataGrid in FilterMode.SimpleWithMenu no longer shows the filter value through the operator button on a narrow column. The compact layout cleared the button with text-indent, which only offsets the first character, so a scrolled value was painted under the translucent button. The input now uses inline padding, which works in every theme and in RTL (#​2771).
  • DropDown popups no longer overflow the viewport after a visual viewport resize. The resize handler sized the items list to the whole space between the trigger and the viewport edge, ignoring the filter input, the multiselect header and the header and footer templates, so a popup flipped above the trigger went past the top of the screen and never shrank back once grown. The handler now accounts for the popup chrome and restores the original size when it fits again.
  • Upload with Auto="false" no longer shows a broken image for non-image files. An object URL was created for every selected file and rendered as an img, so a PDF or text file displayed the browser's broken-image glyph. The preview is now rendered only for image/* files, and other files show a document icon in the same slot so rows stay aligned.

12.1.5

12.1.5 - 2026-10-19

Improvements

  • Validators get a PopupPosition parameter that shows a popup validator above, below, to the left or to the right of its field. Bottom stays the default, so existing validators look the same. The popup stays next to its field when the layout changes, and a validator positioned while its field is hidden, for example on submit with the field in an inactive tab or a collapsed panel, is placed once the field is shown instead of off-screen (#​640). Thanks to @​panoskentros!

Fixes

  • HtmlEditor table commands keep working after a row or column is deleted. Deleting the active row or column left the caret outside any cell, so the next table command failed. The caret now moves to a remaining cell, which is highlighted. Context menu commands restore the clicked cell's selection and close the menu even when the command fails, and right-clicking a cell no longer scrolls the editor. An inserted row gets the table's full column count when cells are merged with colspan, and the internal rz-html-editor-cell-selected class is no longer saved in Value. Thanks to @​Radium001!
  • DataGrid renders a column bound to a nullable enum with FilterMode.Simple in trimmed Blazor WebAssembly apps instead of throwing ArgumentException (NotAMemberOfType). The "No value" entry of the filter dropdown was an anonymous type whose properties the trimmer removed. It is now a DropDownItem<object>, like the enum entries.

Commits viewable in compare view.

Updated System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget-minor-patch group with 10 updates
fc7c74b 
Bumps AngleSharp from 1.8.5 to 1.9.0
Bumps Aspire.Hosting.AppHost from 13.6.1 to 13.6.4
Bumps Aspire.Hosting.PostgreSQL from 13.6.1 to 13.6.4
Bumps Aspire.Hosting.Testing from 13.6.1 to 13.6.4
Bumps Marten from 9.50.3 to 9.56.0
Bumps MessagePack from 2.5.303 to 2.5.307
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14
Bumps Microsoft.Playwright from 1.63.0 to 1.64.1
Bumps Radzen.Blazor from 12.1.4 to 12.1.9
Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14

---
updated-dependencies:
- dependency-name: AngleSharp
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: MessagePack
  dependency-version: 2.5.307
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.PostgreSQL
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Marten
  dependency-version: 9.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Playwright
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Radzen.Blazor
  dependency-version: 12.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

A single timed-out or 504 DCP Create call permanently fails the resource (FailedToStart); not retried since 13.6.0

0 participants