Bump the nuget-minor-patch group with 5 updates

[dependabot]

Updated AngleSharp from 1.8.1 to 1.8.2.

Release notes

Sourced from AngleSharp's releases.

1.8.2

Released on Friday, September 18 2026

What's Changed

• Improved attribute selector serialization to write only the case-sensitivity modifier that was specified (#​1351)
• Improved id/name lookup on collections (document.forms["x"], form.elements["x"], ...) to enumerate the underlying sequence once instead of twice
• Improved performance of form.elements / fieldset.elements by walking the tree directly (#​1350)
• Improved GetElementsByTagName / GetElementsByClassName traversal to stop double-scanning each element's children
• Improved selector specificity (Selectors.Specificity, ComplexSelector.Specificity) to be computed once instead of recomputed on every read
• Improved ListSelector.GetMatchingSelector to sort its selectors once instead of on every call
• Improved performance of HTML tree construction by keeping mutation logic out of it (#​1347)
• Improved performance of DOM mutations by building a mutation record only when an observer will consume it (#​1347)
• Improved performance of parser attribute duplication check
• Fixed Document.Forms allocating a new collection instance per read, contradicting its own [DomSameObject] contract
• Fixed classList and the other reflected token lists writing their content attribute without running the attribute change steps or queueing a mutation record
• Fixed clearing a reflected boolean attribute such as disabled removing it without running the attribute change steps or queueing a mutation record
• Fixed vulnerability via SVG style serialization (GHSA-cgp3-27rh-pcp2)
• Fixed a StackOverflowException when parsing a document with deeply nested unclosed <template> elements
• Added Document.MutationVersion, a synchronous counter of DOM mutations that a parse leaves unchanged (#​1344, #​1347)
• Released 1.8.2 by @​FlorianRappl in Release 1.8.2 AngleSharp/AngleSharp#1353

New Contributors

• @​RichardJansma made their first contribution in Fix broken image download URLs in FAQ AngleSharp/AngleSharp#1352

Full Changelog: AngleSharp/AngleSharp@v1.8.1...v1.8.2

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.5.4

What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

• 📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #​20091. (#​20094, backport of #​20092, @​davidfowl)

• 🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #​18790. (#​19853, backport of #​19230, @​Vladipz)

• ☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #​19617. (#​19998, backport of #​19843, @​eerhardt)

• 🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #​20030. (#​20110, backport of #​20031, @​bart-vmware, @​JamesNK)

• 🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#​20119, backport of #​19965, @​askpt, @​joperezr)

• 🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#​19874, @​sebastienros)

---

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated bunit from 2.10.3 to 2.11.3.

Release notes

Sourced from bunit's releases.

2.11.3

Fixed

• InvokeOnSpacerBeforeVisible now uses 4 parameters on .NET 11.0. Reported by @​vnbaaij in #​1915. Fixed by @​vnbaaij in #​1919.
• A JSInterop timeout elapsing while a result was set could crash the test host with InvalidOperationException: Nullable object must have a value. Reported by @​calebcwells in #​1920. Fixed by @​linkdotnet.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.10.1

What's Changed

• Isolate code coverage files in published output by @​azat-msft in [rel/18.10] Isolate code coverage files in published output microsoft/vstest#16476

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

Commits viewable in compare view.

Updated xunit.v3.extensibility.core from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.v3.extensibility.core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions