[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updated Casl.Net from 0.1.0 to 0.2.0.

Release notes

Sourced from Casl.Net's releases.

0.2.0

Security

• A placeholder whose variable is null now fails the build, as a missing one already did. Before, a null variable was
  filled in as JSON null (a whole placeholder) or as empty text (inside a longer string), so { "assigneeId": "${user.id}" } with a null id matched every unassigned record, in memory and in SQL, and a cannot rule written the
  same way stopped denying. Abilities built with null variables now throw CaslConfigurationException.

• ToMongoQuery now follows RuleSemantics.DenyOverrides. It used CASL's "last rule wins" whatever the semantics, so
  a cannot rule added before an allow rule was left out: Cannot(read, Post, { secret: true }) then
  Can(read, Post) gave {} (every document) instead of { "$nor": [{ "secret": true }] }, unlike Can and
  Filter.

• PermittedFields now leaves out fields that a cannot rule's pattern denies. It removed a deny's field strings
  literally, so Cannot(read, WorkItem, fields: "cost.*") removed nothing and cost.total stayed listed while
  Can(read, item, "cost.total") returned false.

• $regex now decides the same in memory and on PostgreSQL. The pattern ran as .NET syntax in memory but as
  PostgreSQL syntax in SQL, so { "$regex": "\\bconfidential\\b" } in a cannot rule denied in Can but matched
  nothing in AccessibleBy (\b is a backspace in PostgreSQL), which returned the rows Can refused.

  • Breaking: constructs PostgreSQL reads differently now fail the build: \d \D \w \W \s \S \b \B \A \Z \z \G,
    \p{…}, \x…, back-references and octal escapes, named, atomic and conditional groups, inline options, POSIX
    classes and class subtraction, and the options m and s together. See
    Conditions for replacements.
  • Without m, $ no longer matches before a final newline, and unless s is set, [^…] no longer matches a
    newline, in memory and on SQLite too, as on PostgreSQL.
  • A pattern is now validated with its $options, so one that is valid only without them fails the build.

• Placeholder text inside a $regex pattern is now matched literally. It was filled in as raw text, so a variable
  such as a self-chosen slug x|.* turned "^/teams/${user.slug}/" into a pattern matching every value. A pattern
  that is exactly one placeholder is still used as it is.

• In-memory $regex matches stop after AbilityOptions.RegexMatchTimeout (100 ms by default) and throw
  RegexMatchTimeoutException, so a costly pattern from a rule author can't hold a request thread. Field patterns
  (**.**.zz) match in linear time.

• With a strict registry, $elemMatch on a path the registry doesn't list now fails with the same "not allowed"
  message as any other condition. It used to say whether the member existed and what type it had.

• A rule whose conditions isn't an object (a string, an array, a number) or whose subject list is empty now fails.
  The first used to be dropped, making the rule unconditional, and the second became a rule on every subject.

• With listed fields (a strict registry), an allow rule's field patterns now reach only the fields the registry
  lists, as its literal fields already did. A pattern such as ** skipped the field allowlist, so it granted fields
  the registry leaves out, including through FieldMatch.Named. PermittedFields now lists the listed fields an
  allow pattern matches instead of the pattern itself. cannot patterns still reach every field, and open
  registries are unchanged.

Added

• The release workflow's NuGet and npm jobs run in a release environment, and the workflow stops when the tag
  isn't on main. See CONTRIBUTING.md for the environment, tag ruleset and registry settings that make this a gate.
• AbilityOptions.RegexMatchTimeout.
• tests/Casl.Net.PostgresTests and the optional postgres workflow: the equivalence test and $regex comparisons on
  a real PostgreSQL, run when CASL_POSTGRES holds a connection string.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.12 to 10.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.14.1 to 17.14.2.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

17.14.2

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 17.14.0 and 17.14.1.
Fixed in: Microsoft.TestPlatform.CLI 17.14.2.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

• Security fix for CVE-2026-105544, see Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability microsoft/vstest#16654

Full Changelog: microsoft/vstest@v17.14.1...v17.14.2

Commits viewable in compare view.

Updated MimeKit from 4.16.0 to 4.18.2.

Release notes

Sourced from MimeKit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenIddict.AspNetCore from 7.7.1 to 7.8.0.

Release notes

Sourced from OpenIddict.AspNetCore's releases.

7.8.0

This release introduces the following changes:

• A new SetAllowedDecompressionMethods() API was introduced in the System.Net.Http integration packages to limit the decompression methods they can use when extracting HTTP responses. While not recommended, this new option can be used to mitigate the recent CVE-2026-111497 vulnerability. See Add an option to limit the decompression methods the System.Net.Http integration packages are allowed to use openiddict/openiddict-core#2568 for more information (thanks @​m3nax! ❤️)

• HTTP response payloads are no longer logged by default when encountering an error. A new EnableSensitivePayloadLogging() API was added to opt out this new behavior. See Cancellation during token response handling logs the full token response (incl. access_token) at Error level (event 6183) openiddict/openiddict-core#2558 for more information (thanks @​zengqinglei and @​m3nax! ❤️)

• All the .NET and third-party dependencies have been updated to their latest version.

7.7.2

This release introduces the following changes:

• The Quartz.NET integration now uses ConfigureAllQuartzSchedulers() instead of AddQuartz() on .NET 10+ to ensure options previously configured by the user are not overwritten by OpenIddict when registering the pruning job (thanks @​gabrielkim13! ❤️)

• The Discord web provider was updated to use server configuration discovery, which allows the OpenIddict client to dynamically determine whether the iss parameter is allowed in the authorization responses returned by Discord (thanks @​StellaAlexis! ❤️)

Commits viewable in compare view.

Updated QRCoder from 1.8.0 to 1.8.1.

Release notes

Sourced from QRCoder's releases.

1.8.1

What's Changed

• a couple places where ArtQRCode creates a short lived Bitmap but neve… by @​danFbach in a couple places where ArtQRCode creates a short lived Bitmap but neve… Shane32/QRCoder#695
• Minor performance improvement in BitmapByteQRCode + clarify padding calculation by @​KrisVandermotten in Minor performance improvement in BitmapByteQRCode + clarify padding calculation Shane32/QRCoder#698
• Cleanup and optimize CalculateGeneratorPolynom by @​KrisVandermotten in Cleanup and optimize CalculateGeneratorPolynom Shane32/QRCoder#702
• Optimize AlignmentPatterns by @​KrisVandermotten in Optimize AlignmentPatterns Shane32/QRCoder#699
• Some cleanup (and minor optimizations) in BitmapByteQRCode by @​KrisVandermotten in Some cleanup (and minor optimizations) in BitmapByteQRCode Shane32/QRCoder#703
• Optimizations in mask patterns by @​KrisVandermotten in Optimizations in mask patterns Shane32/QRCoder#706

New Contributors

• @​danFbach made their first contribution in a couple places where ArtQRCode creates a short lived Bitmap but neve… Shane32/QRCoder#695
• @​KrisVandermotten made their first contribution in Minor performance improvement in BitmapByteQRCode + clarify padding calculation Shane32/QRCoder#698

Full Changelog: Shane32/QRCoder@v1.8.0...v1.8.1

Commits viewable in compare view.

Updated System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.15.

Release notes

Sourced from System.Security.Cryptography.Pkcs's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.4 to 3.1.5.

Release notes

Sourced from xunit.runner.visualstudio's releases.

3.1.5

Release notes: https://xunit.net/releases/visualstudio/3.1.5

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions