- Dependencies (security): `System.Security.Cryptography.Pkcs` 10.0.0, which `MimeKit` 4.18.1 (through `MailKit` in `NetReporter.Identity`) pulls in, has two known denial-of-service advisories (GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7; fixed in 10.0.13), and `System.Security.Cryptography.Xml` 10.0.12 (through ASP.NET Core Data Protection, seen in `tools/assistant-eval`) has three (GHSA-r955-8q5j-3h83, GHSA-7hqp-7c5m-4vq6, GHSA-c399-9853-6jmj; fixed in 10.0.13). `NetReporter.Identity` now references `Pkcs` 10.0.13 directly, which lifts it in the ReportServer API and UI, the template editor and the tests, and the ASP.NET Core and EF Core packages moved from 10.0.12 to 10.0.13 (this also fixes `Xml`). The published NuGet packages `NETReporter`, `NETReporter.Abstractions` and `NETReporter.Client` never depended on these two packages; the vulnerable copy was in the server images (`api`, `ui`, `editor`). - **Behavior change** (dependencies): all NuGet packages were raised to the latest version, so the published packages have higher dependency floors. `NETReporter` needs `Microsoft.CodeAnalysis.CSharp.Scripting` 5.9.0 (was 4.14.0; the C# expressions of the bindings), `Microsoft.Extensions.DependencyInjection.Abstractions` and `Microsoft.Extensions.Logging.Abstractions` 10.0.13 (were 8.0.0), `Microsoft.Extensions.Configuration.UserSecrets` 10.0.13 (was 6.0.1) and `ZXing.Net` 0.16.11; `NETReporter.Client` needs `Microsoft.Extensions.Http` and `Microsoft.Extensions.Options.ConfigurationExtensions` 10.0.13 (were 8.0.x). A consumer that pins Roslyn 4.x or an older `Microsoft.Extensions.*` must raise it (the packages target .NET 10, whose own `Microsoft.Extensions.*` are 10.0.x). - Dependencies (server and editor): Syncfusion Blazor 32.1.19 to **34.2.9** (the umbrella package `Syncfusion.Blazor` ends at 33.2.15, so the editor references the components it uses: `Core`, `Buttons`, `DropDowns`, `Inputs`, `Navigations`, `Popups`, `Ribbon`, `SplitButtons` and `Themes`, all on one version), Serilog 8 to 10 (`Serilog.AspNetCore` 10.0.0, `Settings.Configuration` 10.0.1, sinks `Console` 6.1.1 and `File` 7.0.0, enrichers `Environment` 3.0.1, `Process` 3.0.0, `Thread` 4.0.0), `FluentStorage` and `FluentStorage.AWS` 6.0.2 to 8.0.22 and 8.0.23 (the storage code moved to the new `IStore` API: `SetObject`, `OpenRead`, `ObjectExists`, `DeleteObject`, `ListObjects`, `AwsS3Storage.FromCredentials` and `FromThirdPartyCredentials`; behavior is unchanged, verified against the disk storage and an S3-compatible server), `AWSSDK.Core` 4.0.102.11, `Anthropic` 12.57.0, `Microsoft.Extensions.AI` 10.11.0, `MinVer` 8.0.0 and `dotnet-ef` 10.0.13. `Microsoft.EntityFrameworkCore.Design` is 10.0.13 now, and the ReportServer API pins `Microsoft.CodeAnalysis.CSharp.Workspaces` and `Workspaces.MSBuild` to 5.9.0 so it matches the Roslyn of the expression scripting (the Design package asks for exactly 5.0.0, NU1107). The test packages moved to `xunit` 2.9.3 (the last 2.x; the package is marked legacy in favor of `xunit.v3`), `xunit.runner.visualstudio` 4.0.1, `Microsoft.NET.Test.Sdk` 18.11.0 and `coverlet.collector` 10.1.0; the new analyzer rules xUnit2029 and xUnit2031 are fixed in the tests. - Template editor: with the individual Syncfusion packages the host page loads the Syncfusion script from `_content/Syncfusion.Blazor.Core/scripts/…` (the umbrella package `Syncfusion.Blazor` and its `_content/Syncfusion.Blazor/…` path are gone). The new test `EditorHostStaticAssetsTests` checks that every `_content/…` address in the host page is served by the editor, so a replaced package cannot leave a dead script reference. Celý seznam změn: CHANGELOG.md v balíčku a https://dev.azure.com/advsoft/Knihovny/_git/NetReporter?path=/src/NetReporter/CHANGELOG.md