[rolandbanks]

Summary

Two commits: the .NET 10.0.15 security bump that main needs before it can restore again, then four file explorer and context menu fixes for the Magic Suite Files search (MS-23441).

Bump .NET 10 servicing packages to 10.0.15

GHSA-x33c-w48q-qrgc (CVE-2026-114149, ASP.NET Core denial of service, high, published 10 November) covers Microsoft.AspNetCore.WebUtilities up to 10.0.14. With NuGetAuditMode All and warnings as errors, restore on main now fails with NU1903, so nothing builds or publishes until this lands. 10.0.15 is the first patched version, and the other 10.0.14 pins move with it. After the bump, dotnet list package --vulnerable --include-transitive reports nothing for any of the six projects.

PDFileExplorer.NavigateToFolderAsync(folderPath)

Opens a folder itself. Like NavigateToItemAsync, the folders above it are only loaded into the tree, so the table loads once and FolderChanged is raised once. Opening a folder no longer first shows the folder holding it. It returns false when the folder is not there, leaving the deepest folder found open. The two methods share their loading, and the demo's file explorer page has an "Open a folder" row beside "Show a file".

PDContextMenu: placed fixed, above what it opens over, and guarded

• Placement. It asked popper for fixed positioning with popper 1's positionFixed, which popper 2 ignores, so menus were positioned absolute against their offset parent. Under CSS zoom or a scaled parent that puts the menu well away from the pointer: about 70px off at a zoom of 1.25, measured in a stand-alone page, with the fixed strategy landing exactly at the pointer, flipped or not. Menus could also be clipped by a panel that scrolls. It now uses strategy: "fixed". Nothing changes where the old placement was right.
• z-index. var(--pd-contextmenu-z-index, 1000), Bootstrap's drop-down level, so a menu sits above a sticky table header. Apps can override it.
• Opt-in ExceptionHandler. A failure in showing the menu or in an item's click, such as its script failing, is passed to the handler rather than ending the Blazor circuit. Without one it is thrown exactly as before. PDFileExplorer passes its handler to both of its menus, as it already does for its tree and table.

PDFilePreview.IsVisible

PDFileExplorer only sizes a hidden preview panel to zero, so PDFilePreview went on fetching a preview for every selection. While IsVisible is false nothing is fetched, and the item chosen meanwhile is fetched once it shows. The explorer passes the panel's visibility. Nothing visible changes.

Test fix

PDChatTests.Interrupting_leaves_the_text_box_unchanged fired its input outside InvokeAsync and could race a re-render (UnknownEventHandlerId). It failed intermittently on one checkout and not another with identical code. Wrapped in InvokeAsync, it passed 8 runs out of 8.

Testing

• The full suite passes, 4,748 out of 4,748.
• New tests:
  • NavigateToFolderAsync: opens only the folder, a missing folder, the root, and a blank path.
  • The context menu's failure is passed on, and is thrown without a handler.
  • The explorer gives its menus a handler only when the application gives it one.
  • A hidden preview fetches nothing until shown, in both PDFilePreview and the explorer.
• The fixed placement was measured in a stand-alone page with popper 2.11.8 under zoom: 1.25. It isn't unit tested, because bUnit runs no layout.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 13 complexity · 5 duplication

Metric	Results
Complexity	13
Duplication	5

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation
Diff coverage	✅ 100.00% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (a3eea5f)	19377	19246	99.32%
Head commit (d0dc9c7)	19379 (+2)	19248 (+2)	99.32% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#362)	2	2	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}