Bump the all-nuget group with 4 updates

[dependabot]

Updated MessagePack from 3.1.9 to 3.1.10.

Release notes

Sourced from MessagePack's releases.

3.1.10

Security fix

• Fixes Unescaped dot metacharacters in AssemblyNameVersionSelectorRegex cause catastrophic backtracking

Other fixes

• Consolidation of AssemblyBuilderAccess when generating dynamic assemblies by @​MarcusChr in Consolidation of AssemblyBuilderAccess when generating dynamic assemblies MessagePack-CSharp/MessagePack-CSharp#2119

New Contributors

• @​MarcusChr made their first contribution in Consolidation of AssemblyBuilderAccess when generating dynamic assemblies MessagePack-CSharp/MessagePack-CSharp#2119

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.9...v3.1.10

Commits viewable in compare view.

Updated Microsoft.Playwright from 1.62.0 to 1.63.0.

Release notes

Sourced from Microsoft.Playwright's releases.

1.63.0

🪟 Locate across frames

Page.FrameLocator() and Frame.FrameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await Page.FrameLocator().GetByRole(AriaRole.Button).ClickAsync();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New Locator.Visible returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await Page.Locator("button").Visible.ClickAsync();

🖼️ Aria and screen snapshots in traces

New AriaSnapshots and ScreenSnapshots options of Tracing.StartAsync() capture an aria snapshot and a screenshot of the page on every action:

await context.Tracing.StartAsync(new()
{
  Snapshots = true,
  AriaSnapshots = true,
  ScreenSnapshots = true
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• HttpCredentialsList now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option Opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events Page. DialogClosed and BrowserContext. DialogClosed are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Command line

• pwsh bin/Debug/netX/playwright.ps1 install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• pwsh bin/Debug/netX/playwright.ps1 codegen --http-credentials records against pages behind HTTP authentication.

Announcements

... (truncated)

Commits viewable in compare view.

Updated Radzen.Blazor from 11.4.2 to 11.5.1.

Release notes

Sourced from Radzen.Blazor's releases.

11.5.1

11.5.1 - 2026-09-27

Improvements

• ODataQuery translates ToString() in filters. A number, Guid or bool (or its nullable) is sent as cast(Member,Edm.String), so a search such as p.Year.ToString().Contains(search) works; an enum's ToString() compared with a value (Contains, StartsWith, EndsWith, ==, Equals, with or without ToLower/ToUpper) becomes a comparison with the members whose names match, for example Status eq 'Open' or Status eq 'Pending'. Dates and [Flags] enums still throw NotSupportedException with a message naming what to use instead.

11.5.0

11.5.0 - 2026-09-26

Improvements

• ODataQuery builds OData queries from EF Core-style lambdas instead of query strings: new ODataQuery<Order>().Where(o => o.Freight > 10).Include(o => o.OrderDetails).ThenInclude(d => d.Product).OrderByDescending(o => o.OrderDate) sends $filter=Freight gt 10, $expand=OrderDetails($expand=Product) and $orderby=OrderDate desc, so a misspelled property is a compile error instead of a 400. It covers filters with nested Any/All, filtered includes, paging and count, and GroupBy(...).Select(...) aggregates ($apply). uri.GetODataUri(query, args) merges a RadzenDataGrid's LoadDataArgs.

Fixes

• Chart no longer writes NaN into its axis lines, tick labels, grid lines and clip path when a string category axis has no categories. A chart rendered before its data arrived, which is the first render of any chart whose data loads in OnInitializedAsync, logged an "Expected number" error to the browser console for every axis line, tick label and grid line. Regression from 11.0.0.
• DataGrid OData filters of DateOnly columns write the year with four digits. The value was formatted with yyy-MM-dd, which wrote years before 1000 with three digits.

11.4.3

11.4.3 - 2026-09-24

Improvements

• Spreadsheet custom cell editors work with the keyboard without relying on built-in editor internals: keys typed before the editor has focus are flushed into any input, textarea or contenteditable in it, the new SpreadsheetCellEditContext.Value holds the text being edited and is committed when the user moves to another cell, and Escape, Enter, Tab and Context.CommitAsync return focus to the grid instead of the page body. The custom cell types demo gains a text editor for the Status column and a section describing the editor contract.
• Premium themes updated.

Fixes

• DataGrid rows no longer render columns removed in the same render against the new data. Replacing the Columns fragment and Data together, for example a DataRow grid whose columns come from a settings list and whose DataTable changes shape, threw ArgumentException (Column 'COL2' does not belong to table) from the old columns' Template, because the dropped columns were disposed after the grid render had already handed them to the rows. Regression from 11.3.0.
• Popup repositions when its content changes size while open. A popup opened above its anchor kept its top when the content shrank, for example when a RadzenTree inside it collapsed, and drifted away from the anchor; a popup opened below ran past the bottom of the viewport when its content grew. Smart-positioned popups now observe their size and flip above or below as space allows, as DropDown already did after filtering.
• Spreadsheet reads cells past a worksheet's grid as empty cells, as Excel does. A loaded sheet was sized to its used range, so =SUM(A1:A100) or =A50 over data in A1:A3 evaluated to #REF! where Excel shows 6 and 0; a reference past Excel's last row or column is #NAME? and negative or deleted references stay #REF!. A range such as A2:XFD1048576 no longer takes minutes to register (#​2732).
• Spreadsheet ROW() and COLUMN() read through another formula return the row and column of their own cell. Functions received the cell being recalculated instead of the cell whose formula they belong to, so with B1 =ROW() and A5 =B1, A5 showed 5 or 1 depending on recalculation order.
• Spreadsheet evaluates operators and functions over ranges like Excel array formulas. Any arithmetic, comparison or concatenation with a range operand threw InvalidCastException, so =SUMPRODUCT((A1:A3>=2)B1:B3) or =INDEX(B1:B3,MATCH(1,(A1:A3=2)(B1:B3=20),0)) failed a recalculation or Workbook.LoadFromStream. Operators and single-value functions now apply to every cell with Excel's broadcasting, and a range used where one value is needed is implicitly intersected with the formula cell (#​2732).
• Spreadsheet formulas that reference a cell whose formula does not parse return #NAME?. The syntax tree of such a cell was evaluated anyway, so a dependent of =SUM( threw InvalidOperationException and aborted a recalculation or Workbook.LoadFromStream (#​2732).
• Spreadsheet loads xlsx hyperlinks whose ref is a range. Excel writes ref="J2:O2" for a link over merged or adjacent cells, which threw ArgumentException (Invalid A1 notation) and aborted Workbook.LoadFromStream; the link now applies to every cell of the range (#​2732).
• Spreadsheet evaluates formulas that use an unquoted sheet or defined name outside ASCII, such as 入荷実績 or Übersicht. The lexer only started an identifier at an ASCII letter, so the cell showed #NAME? and any formula referencing it threw InvalidOperationException, which aborted Workbook.LoadFromStream (#​2732).
• Spreadsheet clipboard shortcuts inside a cell editor or the formula bar no longer also act on the grid, so pasting into the editor does not paste into the selected cells and copying text inside it does not replace the clipboard with the cell selection. Keys typed in a text field of a cell editor stay in it instead of restarting type-to-edit, clearing the cell or undoing a grid action, and Enter during IME composition no longer commits.
• Spreadsheet keeps typed and pasted input as literal text in cells with a Text number format, so 0071 stays 0071 and =1+1 stays text as in Excel; a leading apostrophe is still stripped and sets QuotePrefix. Undo of a cell edit restores a snapshot of the cell instead of replaying its old text.
• Chart keeps its hover state consistent after a fast mouse exit. A mousemove queued by the Blazor Server throttle fired after the leave was sent, so the chart froze its last tooltip and ignored synced hovers from other charts in the same SyncGroup until the cursor re-entered it. Zoomed charts also no longer snap the tooltip, active point and synced marker to points scrolled out of view.
• DropDown, ListBox and DropDownDataGrid re-filter when SearchText is changed programmatically. The parameter setter only stored the text, so the cached filtered view stayed in place and LoadData was never invoked with the new filter; setting the bound value to null left the list filtered (#​2731).

Commits viewable in compare view.

Updated Scalar.AspNetCore from 2.17.8 to 2.17.10.

Release notes

Sourced from Scalar.AspNetCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.95%. Comparing base (8aaaa12) to head (53a6130).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #239      +/-   ##
==========================================
- Coverage   82.05%   81.95%   -0.11%     
==========================================
  Files         117      115       -2     
  Lines        2709     2666      -43     
  Branches      389      386       -3     
==========================================
- Hits         2223     2185      -38     
+ Misses        405      399       -6     
- Partials       81       82       +1     

see 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.