Repository navigation
Dependency report — outdated & vulnerable packages #87
Description
Generated by .github/workflows/dependency-report.yml on 2026-10-01 12:03 UTC for commit ecfe1c9.
This issue is updated in place every run — it exists instead of Dependabot version PRs.
Bump the versions locally, then commit. Known CVEs are also tracked under Security → Dependabot alerts and gated in CI.
NuGet — vulnerable
| Package | Resolved | Severity | Advisory |
|---|---|---|---|
| Microsoft.Build.Tasks.Git | 10.0.301 | Moderate | GHSA-23fw-v26w-5fgq |
NuGet — outdated (top-level)
| Package | Resolved | Latest |
|---|---|---|
| Cocoar.Configuration | 6.1.0 | 6.1.1 |
| Cocoar.Configuration.AspNetCore | 6.1.0 | 6.1.1 |
| Cocoar.JsEval.Engine | 4.1.0 | 5.0.0 |
| Cocoar.JsEval.Linq | 4.1.0 | 5.0.0 |
| Cocoar.JsEval.TsDefinition | 4.1.0 | 5.0.0 |
| Cocoar.JsEval.TypeScript | 4.1.0 | 5.0.0 |
| Cocoar.SignalARRR.Server | 5.1.0 | 5.2.0 |
| Cocoar.SignalARRR.Server.Backplane.Postgres | 5.1.0 | 5.2.0 |
| Fido2.AspNet | 4.0.1 | 4.1.1 |
| ITfoxtec.Identity.Saml2 | 4.20.1 | 4.21.0 |
| ITfoxtec.Identity.Saml2.MvcCore | 4.20.1 | 4.21.0 |
| MailKit | 4.17.0 | 4.18.1 |
| Marten | 9.23.0 | 9.44.0 |
| Marten.AspNetCore | 9.23.0 | 9.44.0 |
| Microsoft.AspNetCore.Authentication.JwtBearer | 10.0.10 | 10.0.12 |
| Microsoft.AspNetCore.Authentication.OpenIdConnect | 10.0.10 | 10.0.12 |
| Microsoft.AspNetCore.Mvc.Testing | 10.0.10 | 10.0.12 |
| Microsoft.AspNetCore.OpenApi | 10.0.10 | 10.0.12 |
| Microsoft.Extensions.DependencyInjection.Abstractions | 10.0.10 | 10.0.12 |
| Microsoft.IdentityModel.Tokens | 8.19.2 | 8.23.0 |
| Microsoft.NET.Test.Sdk | 18.8.1 | 18.10.1 |
| Microsoft.OpenApi | 2.7.5 | 3.10.2 |
| Microsoft.SourceLink.GitHub | 10.0.301 | 10.0.401 |
| OpenIddict | 7.6.0 | 7.7.1 |
| OpenIddict.Abstractions | 7.6.0 | 7.7.1 |
| OpenIddict.AspNetCore | 7.6.0 | 7.7.1 |
| OpenIddict.Server | 7.6.0 | 7.7.1 |
| OpenIddict.Server.AspNetCore | 7.6.0 | 7.7.1 |
| OpenIddict.Validation | 7.6.0 | 7.7.1 |
| OpenTelemetry.Exporter.OpenTelemetryProtocol | 1.17.0 | 1.19.1 |
| OpenTelemetry.Exporter.Prometheus.AspNetCore | 1.17.0-beta.1 | Not found at the sources |
| OpenTelemetry.Extensions.Hosting | 1.17.0 | 1.19.1 |
| OpenTelemetry.Instrumentation.AspNetCore | 1.17.0 | 1.19.0 |
| OpenTelemetry.Instrumentation.Http | 1.17.0 | 1.19.0 |
| OpenTelemetry.Instrumentation.Runtime | 1.17.0 | 1.19.0 |
| Quartz.Extensions.Hosting | 3.18.2 | 4.3.0 |
| Quartz.Serialization.SystemTextJson | 3.18.2 | 4.3.0 |
| Testcontainers | 4.13.0 | 4.15.0 |
| Testcontainers.PostgreSql | 4.13.0 | 4.15.0 |
| WolverineFx.Marten | 6.27.1 | 6.44.0 |
| WolverineFx.RuntimeCompilation | 6.27.1 | 6.44.0 |
| coverlet.collector | 10.0.1 | 10.1.0 |
| xunit.runner.visualstudio | 3.1.5 | 4.0.0 |
| xunit.v3 | 3.2.2 | 4.0.1 |
pnpm — outdated (src/frontend-vue)
| Package | Current | Wanted | Latest | Type |
|---|---|---|---|---|
| @cocoar/signalarrr | 5.1.0 | 5.1.0 | 5.2.0 | dependencies |
| @cocoar/vue-data-grid | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @cocoar/vue-fragment-parser | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @cocoar/vue-localization | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @cocoar/vue-page-builder | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @cocoar/vue-script-editor | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @cocoar/vue-ui | 3.0.0 | 3.0.0 | 3.1.0 | dependencies |
| @fontsource-variable/fraunces | 5.2.9 | 5.2.9 | 5.3.0 | dependencies |
| @fontsource-variable/instrument-sans | 5.2.8 | 5.2.8 | 5.3.0 | dependencies |
| @playwright/test | 1.61.1 | 1.61.1 | 1.63.0 | devDependencies |
| @tailwindcss/vite | 4.3.2 | 4.3.2 | 4.3.3 | devDependencies |
| @vitejs/plugin-vue | 6.0.7 | 6.0.7 | 6.0.9 | devDependencies |
| monaco-editor | 0.55.1 | 0.55.1 | 0.57.0 | dependencies |
| otplib | 13.4.1 | 13.4.1 | 13.5.0 | devDependencies |
| pinia | 3.0.4 | 3.0.4 | 4.0.3 | dependencies |
| tailwindcss | 4.3.2 | 4.3.2 | 4.3.3 | devDependencies |
| typescript | 6.0.3 | 6.0.3 | 7.0.2 | devDependencies |
| vite | 8.1.2 | 8.1.2 | 8.3.2 | devDependencies |
| vue | 3.5.39 | 3.5.39 | 3.5.43 | dependencies |
| vue-router | 5.1.0 | 5.1.0 | 5.3.1 | dependencies |
| vue-tsc | 3.3.6 | 3.3.6 | 3.3.11 | devDependencies |
Activity
chore(deps): risk-arm dependency bumps (#87) (#156)
windischb commentedon Jul 19, 2026
Manual bump wave — #156
dotnet list package --vulnerablecurrently reports zero vulnerabilities across the graph; the previously-listed High (Microsoft.OpenApi 2.0.0) is resolved by the intentional2.7.5transitive-CVE pin. So this was pure hygiene, gated by a full build + the complete test suite (1395 unit + 516 integration).Bumped:
Microsoft.AspNetCore.*10.0.8 → 10.0.10 ·Microsoft.IdentityModel.Tokens8.19.1 → 8.19.2 ·Microsoft.NET.Test.Sdk18.6.0 → 18.8.1 ·Microsoft.SourceLink.GitHub10.0.300 → 10.0.301 ·ITfoxtec.Identity.Saml2(+MvcCore) 4.18.0 → 4.20.1 ·Quartz.Extensions.Hosting3.18.1 → 3.18.2 ·Testcontainers(+PostgreSql) 4.12.0 → 4.13.0 ·Postmark5.3.0 → 5.4.1.Held for their own careful PRs: Marten 9.8→9.16 / WolverineFx 6.9→6.20 (Critter Stack) · OpenIddict 7.5→7.6 (OAuth core) · Microsoft.OpenApi 2.7.5→3.x (major + intentional pin) · System.Reactive 6→7 (major) · OpenTelemetry 1.15→1.17 (move the line together, Prometheus exporter still beta).
This tracking issue stays open — it re-generates in place and still lists the held items.
chore(deps): #87 held-back bump wave — OpenIddict 7.6, OTel 1.17, Sys…