[dependabot]

Updated Fido2 from 4.3.1 to 4.3.2.

Release notes

Sourced from Fido2's releases.

4.3.2

What's Changed

• Trust Microsoft's new 2026-09-23 NuGet author-signing certificate - backport to 4.x by @​aseigler in Trust Microsoft's new 2026-09-23 NuGet author-signing certificate - backport to 4.x passwordless-lib/fido2-net-lib#697
• Backport: Fix appid extension not being sent to the client by @​enmande in Backport: Fix appid extension not being sent to the client passwordless-lib/fido2-net-lib#693
• Remove [Flags] from Fido2ErrorCode - backport to 4.x by @​aseigler in Remove [Flags] from Fido2ErrorCode - backport to 4.x passwordless-lib/fido2-net-lib#695

New Contributors

• @​enmande made their first contribution in Backport: Fix appid extension not being sent to the client passwordless-lib/fido2-net-lib#693

Full Changelog: passwordless-lib/fido2-net-lib@4.3.1...4.3.2

Commits viewable in compare view.

Updated HtmlSanitizer from 9.2.1039 to 10.0.1120.

Release notes

Sourced from HtmlSanitizer's releases.

10.0.1120

• Rename AllowedCssClasses to AllowedClasses; HtmlSanitizerOptions defaults

• HtmlSanitizerOptions collections now start pre-populated from
  HtmlSanitizerDefaults, matching the parameterless HtmlSanitizer() constructor. See #​570
• Renamed AllowedCssClasses to AllowedClasses for consistency with
  HtmlSanitizer.AllowedClasses.
• Replaced CreateDefault() with Empty(), which now returns the blank-slate
  instance instead.

10.0.1037-beta

First beta of a major version. Please test against your usage before GA — see Breaking changes below, especially if you have a custom IHtmlSanitizer implementation or construct HtmlSanitizerOptions yourself.

Breaking changes

• IHtmlSanitizer gained new members. Anything implementing the interface directly (not just consuming HtmlSanitizer) needs updating: StyleFormatter, EncodeComment, EncodeLiteralTextElementContent, UriListAttributes, AllowCssCustomProperties, the FilterCssRule event, both SanitizeFragment overloads, and SanitizeDocument(Stream, ...).
• HtmlSanitizerOptions collections are now pre-populated by default. new HtmlSanitizerOptions() now seeds every collection from HtmlSanitizerDefaults — the same defaults new HtmlSanitizer() uses — instead of starting empty (#​570). If you build HtmlSanitizerOptions yourself, audit it: code that relied on the old emptiness to build a minimal allowlist (e.g. setting only AllowedTags and expecting everything else to stay locked down) now gets the full default attribute/scheme/URI-attribute set for anything it doesn't explicitly reassign. Use the new HtmlSanitizerOptions.Empty() for the old blank-slate behavior.
• HtmlSanitizerOptions.AllowedCssClasses renamed to AllowedClasses, matching HtmlSanitizer.AllowedClasses / IHtmlSanitizer.AllowedClasses. It's also now case-insensitive by default like every other collection on the class (it wasn't before — a latent bug).
• SanitizeDom(string) no longer preserves attributes on the synthetic <html>/<head>/<body> wrapper elements it creates. Fixes an attribute-injection bypass (e.g. <body onload=alert(1)>) for callers that serialize more of the returned document than dom.Body.ChildNodes.
• AssemblyVersion bumped to 10.0.0.0. Update any binding redirects pinned to 9.0.0.0.

New

• SanitizeFragment(html, context, ...) — sanitize a fragment as if inserted into a given element/tag context (e.g. tr, ul) instead of always parsing under <body>, so context-dependent markup like a lone <th> survives.
• SanitizeDocument(Stream, ...) overload.
• UriListAttributes — screens attributes holding a list of URLs (srcset, ping) entry-by-entry, rather than as one URL.
• AllowCssCustomProperties — opt in to allowing CSS custom properties (--*).
• StyleFormatter, EncodeComment, EncodeLiteralTextElementContent — now configurable on the sanitizer/interface.
• FilterCssRule event, raised per CSS rule during sanitization.
• HtmlSanitizerOptions.Empty() for building an allowlist from scratch.

Security / stricter sanitization

Output for some previously-passing input is now more restrictive:

• cite and longdesc are now screened as URL attributes.
• @​font-face and @​import at-rule declarations are now sanitized.
• srcdoc content is now recursively sanitized, and URI-list attributes (srcset, ping) are screened per-entry.
• <style type=""> content is now sanitized (previously an empty type could skip CSS filtering).
• Fixed CSS var-in-shorthand handling and a resolved-URI check.
• Fixed multiple enumeration of URLs (#​625) and #​629.
• Foreign-namespace contexts (SVG/MathML) are now rejected by SanitizeFragment rather than silently mis-parsed under HTML rules.

Dependencies

• AngleSharp 1.7.1 → 1.7.2, AngleSharp.Css 1.0.1 → 1.0.2.

Commits viewable in compare view.

Updated Ical.Net from 5.2.3 to 5.2.4.

Release notes

Sourced from Ical.Net's releases.

5.2.4

What's Changed

• Update GitHub Actions in Update GitHub Actions ical-org/ical.net#957
• v5: Escape backslash for TEXT values by @​maknapp in v5: Escape backslash for TEXT values ical-org/ical.net#966
• Chore(deps): Bump actions/setup-dotnet from 5 to 6 in Chore(deps): Bump actions/setup-dotnet from 5 to 6 ical-org/ical.net#972
• fix: Backport StringSerializer to v5 for correct escaping in fix: Backport StringSerializer to v5 for correct escaping ical-org/ical.net#1012
• fix: VTimeZone.FromSystemTimeZone for southern-hemisphere time zones v5 in fix: VTimeZone.FromSystemTimeZone for southern-hemisphere time zones v5 ical-org/ical.net#1014
• chore: Update release notes for v5.2.4 in chore: Update release notes for v5.2.4 ical-org/ical.net#1019

Full Changelog: ical-org/ical.net@v5.2.3...v5.2.4

Commits viewable in compare view.

Updated Stripe.net from 52.4.0 to 52.4.2.

Release notes

Sourced from Stripe.net's releases.

52.4.2

• #​3445 Validate that webhook secrets are non-empty

See the changelog for more details.

52.4.1

• #​3441 Harden API requestor code against malicious URLs

See the changelog for more details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions