Dependency report — outdated & vulnerable packages

[github-actions]

Generated by .github/workflows/dependency-report.yml on 2026-07-01 07:25 UTC for commit fe39297.

This issue is updated in place every run — it exists instead of Dependabot version PRs.
Bump the versions locally, then commit. Known CVEs are also tracked under Security → Dependabot alerts and gated in CI.

NuGet — vulnerable

Package	Resolved	Severity	Advisory
Microsoft.OpenApi	2.0.0	High	GHSA-v5pm-xwqc-g5wc

NuGet — outdated (top-level)

Package	Resolved	Latest
ITfoxtec.Identity.Saml2	4.18.0	4.20.1
ITfoxtec.Identity.Saml2.MvcCore	4.18.0	4.20.1
Marten	9.8.0	9.12.0
Marten.AspNetCore	9.8.0	9.12.0
Microsoft.AspNetCore.Authentication.JwtBearer	10.0.8	10.0.9
Microsoft.AspNetCore.Authentication.OpenIdConnect	10.0.8	10.0.9
Microsoft.AspNetCore.Mvc.Testing	10.0.8	10.0.9
Microsoft.AspNetCore.OpenApi	10.0.8	10.0.9
Microsoft.Extensions.DependencyInjection.Abstractions	10.0.8	10.0.9
Microsoft.NET.Test.Sdk	18.6.0	18.7.0
OpenTelemetry.Exporter.OpenTelemetryProtocol	1.15.3	1.16.0
OpenTelemetry.Exporter.Prometheus.AspNetCore	1.15.3-beta.1	Not found at the sources
OpenTelemetry.Extensions.Hosting	1.15.3	1.16.0
OpenTelemetry.Instrumentation.AspNetCore	1.15.2	1.16.0
OpenTelemetry.Instrumentation.Http	1.15.1	1.16.0
Quartz.Extensions.Hosting	3.18.1	3.18.2
WolverineFx.Marten	6.9.0	6.16.0
WolverineFx.RuntimeCompilation	6.9.0	6.16.0

pnpm — outdated (src/frontend-vue)

Package	Current	Wanted	Latest	Type
@cocoar/signalarrr	4.3.1	4.3.1	4.3.2	dependencies
@cocoar/vue-data-grid	2.7.0	2.7.0	2.13.0	dependencies
@cocoar/vue-fragment-parser	2.7.0	2.7.0	2.13.0	dependencies
@cocoar/vue-localization	2.7.0	2.7.0	2.13.0	dependencies
@cocoar/vue-page-builder	2.7.0	2.7.0	2.13.0	dependencies
@cocoar/vue-script-editor	2.7.0	2.7.0	2.13.0	dependencies
@cocoar/vue-ui	2.7.0	2.7.0	2.13.0	dependencies
@playwright/test	1.60.0	1.60.0	1.61.1	devDependencies
@tailwindcss/vite	4.3.0	4.3.0	4.3.2	devDependencies
tailwindcss	4.3.0	4.3.0	4.3.2	devDependencies
vite	8.0.16	8.0.16	8.1.2	devDependencies
vue	3.5.35	3.5.35	3.5.39	dependencies
vue-tsc	3.3.4	3.3.4	3.3.6	devDependencies

[windischb]

Manual bump wave — #156

dotnet list package --vulnerable currently reports zero vulnerabilities across the graph; the previously-listed High (Microsoft.OpenApi 2.0.0) is resolved by the intentional 2.7.5 transitive-CVE pin. So this was pure hygiene, gated by a full build + the complete test suite (1395 unit + 516 integration).

Bumped: Microsoft.AspNetCore.* 10.0.8 → 10.0.10 · Microsoft.IdentityModel.Tokens 8.19.1 → 8.19.2 · Microsoft.NET.Test.Sdk 18.6.0 → 18.8.1 · Microsoft.SourceLink.GitHub 10.0.300 → 10.0.301 · ITfoxtec.Identity.Saml2 (+MvcCore) 4.18.0 → 4.20.1 · Quartz.Extensions.Hosting 3.18.1 → 3.18.2 · Testcontainers (+PostgreSql) 4.12.0 → 4.13.0 · Postmark 5.3.0 → 5.4.1.

Held for their own careful PRs: Marten 9.8→9.16 / WolverineFx 6.9→6.20 (Critter Stack) · OpenIddict 7.5→7.6 (OAuth core) · Microsoft.OpenApi 2.7.5→3.x (major + intentional pin) · System.Reactive 6→7 (major) · OpenTelemetry 1.15→1.17 (move the line together, Prometheus exporter still beta).

This tracking issue stays open — it re-generates in place and still lists the held items.