[ajs-uk-dev]

Closes #836

What this does

Brings the NuGet packages up to date. Versions only: no C# changed.

• 25 direct packages and the dotnet-ef tool move to their newest stable version.
• One new direct reference, Microsoft.AspNetCore.WebUtilities 2.3.14 in Infrastructure, clears the one advisory that dotnet list package --vulnerable reported.
• The lock files are regenerated.

Licences

No package moves to a version that needs a paid licence. Every package version that changed in any packages.lock.json, transitive packages included (58 versions), was checked against its licence on nuget.org: all are MIT, BSD-2-Clause (Markdig), BSD-3-Clause (Polly) or the Microsoft ASP.NET Core 2.x licence. No new package id comes in.

Packages

Package	From	To
AngleSharp (also the E2E project)	1.9.0	1.10.1
HtmlSanitizer	10.0.1120	11.0.26
Markdig	1.5.1	1.6.0
Microsoft.AspNetCore.Authentication, .Cookies, .Core	2.3.13	2.3.14
Microsoft.AspNetCore.Http, .Http.Extensions	2.3.13	2.3.14
Microsoft.AspNetCore.WebUtilities (new direct reference)	2.3.12	2.3.14
Microsoft.AspNetCore.Authentication.OpenIdConnect, .DataProtection	10.0.14	10.0.15
Microsoft.EntityFrameworkCore, .Design, .Relational, .Tools	10.0.14	10.0.15
Microsoft.Extensions.Caching.Abstractions, .Configuration.Abstractions, .DependencyInjection, .DependencyInjection.Abstractions, .Http	10.0.14	10.0.15
System.Security.Cryptography.Pkcs, .Xml	10.0.14	10.0.15
Microsoft.AspNetCore.TestHost (integration tests)	10.0.14	10.0.15
Microsoft.Identity.Web	4.16.1	4.18.0
Polly	8.9.0	8.9.1
Microsoft.NET.Test.Sdk (three test projects)	18.11.0	18.12.0
dotnet-ef (.config/dotnet-tools.json)	10.0.14	10.0.15

Not updated, on purpose

Package	Stays at	Why
CsvHelper	33.1.0	34 is a rewrite with looser defaults (existing hold in dependabot.yml)
Deque.AxeCore.Playwright	4.13.0	axe 4.14 false positive on the File upload button (#696)
DfeAnalytics.AspNetCore, .Core, .EFCore	0.6.4	0.7.0 came out on 11 Nov and changes how the Airbyte sync mode is set. Airbyte is off in every environment, so nothing here would test it. It belongs with the Airbyte rollout. There is no dependabot.yml entry for this, so Dependabot will propose 0.7.0 once it is a week old
Anything to 11.0.0	10.x	That is the .NET 11 upgrade
xunit	2.9.3	Marked legacy on nuget.org; moving to xunit.v3 is a migration

The WebUtilities reference

Microsoft.AspNetCore.WebUtilities came into Infrastructure as a transitive package at 2.3.12, which nuget.org flags. Moving the other 2.3.x packages to 2.3.14 only lifts it to 2.3.13, which is still flagged, so Infrastructure now references 2.3.14 directly (it already uses that namespace). The web app and the worker take this assembly from the .NET 10 shared framework, not from the 2.3.x package, and the advisory names only the 2.3 package, so this clears the audit warning; it is not a change to what the deployed service runs.

Behaviour to know about

• HtmlSanitizer 11 removes the name attribute from img and form (and from iframe, embed and object, which we do not allow anyway) and no longer allows contenteditable. Nothing in the seeded content, the shipped bundles or the views uses either. The breaking API change in 11 is for classes that implement IHtmlSanitizer; we have none.
• HtmlSanitizer 11 needs AngleSharp 1.10, which is why AngleSharp goes past 1.9.1. This replaces Bump AngleSharp from 1.9.0 to 1.9.1 #831.
• Several of these versions are less than a week old, which is sooner than Dependabot would propose them: AngleSharp 1.10.1, HtmlSanitizer 11.0.26, Microsoft.Identity.Web 4.18.0, Polly 8.9.1, Microsoft.NET.Test.Sdk 18.12.0 and Microsoft's 10.0.15 / 2.3.14 servicing releases.
• The 10.0.15 packages run on the 10.0.14 aspnet image until its next digest update, as after earlier servicing releases.

How it was checked

• Locked restore, build (0 errors, 121 warnings) and the unit tests (7,893 passed) in the pinned SDK image.
• dotnet list package --vulnerable --include-transitive: nothing reported.
• Both Docker images built with the locked restore. On the local stack: all 41 admin page editors and all 25 public CMS pages load, 57 images with none broken, no raw markup and no console errors; the worker started cleanly.
• One independent review of the diff and the lock files: only the listed packages moved, no downgrade, no new package.

Not checked

• Integration tests and the E2E suite were not run locally; the Build workflow and the review app run them.
• Sign-in through DfE Sign-in. The OpenID Connect handler moves from 10.0.14 to 10.0.15 and no automated test signs in that way, so it is worth one sign-in on the development environment after merge.
• Saving content in the CMS editor was not walked by hand.

🤖 Generated with Claude Code

[github-actions]

Deployments

Review app is available at these URLs:
https://check-performance-data-pr-840.test.teacherservices.cloud

[github-actions]

E2E tests passed

397 passed, 0 failed, 4 skipped in 16 min 0 s

Commit 6180e5e against https://check-performance-data-pr-840.test.teacherservices.cloud (run)