fix(deps): resolve AngleSharp vulnerability (GHSA-pgww-w46g-26qg)

[djb-fnz]

Our assemblies that reference BlazorBlueprint.Components have recently begun to fail to build due to a vulnerability in one of the transitive nuget packages.

HtmlSanitizer 9.0.892 hard-pins AngleSharp to exactly [0.17.1], which nuget audit flags as vulnerable (GHSA-pgww-w46g-26qg, Moderate). The exact pin means the transitive AngleSharp cannot be overridden with a direct PackageReference.

Bump HtmlSanitizer to 9.1.949-beta, whose dependency chain pins AngleSharp 1.5.1 (past the 1.0.0 fix). The Sanitize API used by BbRichTextEditor and BbMarkdownEditor is unchanged.

Description

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Testing Checklist

• Blazor Server
• Blazor WebAssembly
• Blazor Hybrid (MAUI)
• Keyboard navigation / accessibility
• Dark mode

[mathewtaylor]

Merged — thanks for tracking this down, and for the inline comment explaining the pin.

I verified the reasoning before merging: 9.0.892 is the newest stable release, its AngleSharp [0.17.1] / AngleSharp.Css [0.17.0] pins are exact, and lifting AngleSharp with a direct PackageReference raises NU1608 on both (a hard error here, since the repo builds with TreatWarningsAsErrors). So the 9.1 beta really is the only route past the advisory right now. dotnet list package --vulnerable --include-transitive goes from flagging AngleSharp 0.17.1 on develop to clean on this branch, and the Components project builds with zero warnings.

I also diffed sanitizer output between 9.0.892 and 9.1.949-beta across 41 inputs — XSS vectors, Quill rich-text markup, Markdig output, malformed and non-ASCII HTML — exercising the same new HtmlSanitizer() + Sanitize(string) path BbRichTextEditor and BbMarkdownEditor use. Byte-identical on every case, so your "Sanitize API is unchanged" note holds for behaviour as well as signature.

One thing to flag for anyone reading this later: the trade-off is that HtmlSanitizer (and AngleSharp.Css 1.0.0-beta.216) is now a prerelease transitive dependency of BlazorBlueprint.Components. That resolves fine for consumers — the prerelease opt-in only governs direct package selection — but it may trip supply-chain policies that ban prerelease packages outright. On balance an active Moderate advisory breaking downstream builds is the worse problem, so this ships as-is.

We will bump this again to a stable release as soon as the 9.1.x line leaves prerelease. Noted in the changelog entry alongside this change so it does not get forgotten.