chore(deps): Bump the minor-and-patch group with 8 updates

[dependabot]

Updated Microsoft.AspNetCore.Components.Authorization from 10.0.8 to 10.0.9.

Release notes

Sourced from Microsoft.AspNetCore.Components.Authorization's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.Web from 10.0.8 to 10.0.9.

Release notes

Sourced from Microsoft.AspNetCore.Components.Web's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Components.WebAssembly from 10.0.8 to 10.0.9.

Release notes

Sourced from Microsoft.AspNetCore.Components.WebAssembly's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.8 to 10.0.9.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.8 to 10.0.9.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Updated microsoft.openapi.kiota from 1.32.2 to 1.32.5.

Release notes

Sourced from microsoft.openapi.kiota's releases.

1.32.5

Added

• Added the --allowed-external-origins parameter to commands that load OpenAPI descriptions. External references are now not loaded by default to improve security; use this parameter to allow *, full URIs, URI patterns, full paths, relative paths, or path patterns.
• Added support for the isNonConsequential confirmation property in the AI capabilities extension (x-ai-capabilities) and mapped it to the generated plugin manifest confirmation object (plugin manifest 2.4). #​7857
• Added a DOM-surface regression integration test that diffs the kiota public API export between the published NuGet generator and the current changeset to catch breaking changes in generated SDKs. #​7858

Changed

• Rejected unsafe static_template.file references in generated plugin manifests, preventing path traversal outside the manifest package.
• Workspace client and plugin generation now rejects workspace configuration entries whose outputPath is rooted or escapes the workspace.
• Sanitized client class and namespace names loaded from settings or the x-ms-kiota-info OpenAPI extension before using them in generated code and file paths.
• Removed support for specifying dependency install commands through the x-ms-kiota-info OpenAPI description extension.

1.32.4

Added

Changed

• Fixed a code injection vulnerability in PHP generation by escaping $ in double-quoted string literals. #​7863

1.32.3

Added

Changed

• Fixed a generated-source code injection vulnerability (CWE-94) in the C# emitter where newlines in an OpenAPI externalDocs.description could break out of the /// doc comment and inject arbitrary code. #​7831
• Fixed a bug that generares an empty model when allOf inheritance schema is reached via a composed type #​7791
• Fixed a bug in PHP generation where parent::__construct() was generated for parent classes without a constructor #​7809 #​7810

Commits viewable in compare view.

Updated Testcontainers.PostgreSql from 4.12.0 to 4.13.0.

Release notes

Sourced from Testcontainers.PostgreSql's releases.

4.13.0

What's Changed

Thank you to everyone who contributed and shared their feedback 🤜🤛.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​33686956.

🚀 Features

• feat: Add Aspire dashboard module (#​1194) @​NikiforovAll
• feat: Add image name substitution hook (#​1710) @​HofmeisterAn
• feat(CosmosDb): Add get method AccountEndpoint (#​1707) @​srollinet
• feat: Improve image build failure messages (#​1700) @​HofmeisterAn

🐛 Bug Fixes

• fix: Restore tar archive write performance regressed by padding trim (#​1719) @​HofmeisterAn
• chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
• chore(AspireDashboard): Cover connection string provider (#​1713) @​HofmeisterAn

📖 Documentation

• docs: Add missing TC languages and reorder docs navigation (#​1711) @​mdelapenya
• docs: Add note about unsupported BuildKit Dockerfile features (#​1696) @​HofmeisterAn
• docs: Explain immutable builder behavior (#​1693) @​HofmeisterAn

🧹 Housekeeping

• chore: Enable Dependabot cooldown (#​1716) @​HofmeisterAn
• chore: Add nuget.config (#​1715) @​Rob-Hague
• chore(AspireDashboard): Cover connection string provider (#​1713) @​HofmeisterAn
• chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
• chore: Bump sshd-docker image from 1.3.0 to 1.4.0 (#​1709) @​HofmeisterAn
• chore: Rename runtime label and add buildkit and stale labels (#​1703) @​HofmeisterAn
• fix: Guard expensive argument evaluation when logging (#​1702) @​HofmeisterAn
• chore: Defer container ID truncation in logging (#​1701) @​HofmeisterAn
• chore: Migrate to LoggerMessageAttribute (#​1697) @​HofmeisterAn

📦 Dependency Updates

• chore(deps): Bump the actions group with 2 updates (#​1721) @dependabot[bot]
• chore(deps): Bump the actions group with 7 updates (#​1717) @dependabot[bot]
• chore: Bump Docker.DotNet from 4.3.2 to 4.3.3 (#​1714) @​HofmeisterAn
• chore: Bump Docker.DotNet from 4.2.0 to 4.3.2 (#​1712) @​HofmeisterAn
• chore(deps): Bump the actions group with 4 updates (#​1698) @dependabot[bot]

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[GuillaumeBodson]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in 56b87da. The only conflict was in Directory.Packages.props — main had added a Microsoft.OpenApi 2.7.5 transitive pin to work around a security advisory in 10.0.8. Since this PR bumps Microsoft.AspNetCore.OpenApi to 10.0.9 (which references the patched version), the pin is no longer needed and was dropped, as its own comment prescribed.