[elinohlsson]

Summary

Upgrades the low-risk NuGet package dependencies across the ActiveLogin.Authentication solution. This PR is restricted to packages not tied to the .NET 10 TFM/runtime and with no anticipated breaking API changes — safe, incremental groundwork before tackling riskier package upgrades in a follow-up PR.

No functional behavior changes are expected; this is a dependency maintenance pass.

What changed

Core / library packages

• ActiveLogin.Identity.Swedish: 3.0.0 → 3.2.0
  (ActiveLogin.Authentication.BankId.Core, ActiveLogin.Authentication.BankId.AspNetCore)
• QRCoder: 1.7.0 → 1.8.0
  (ActiveLogin.Authentication.BankId.QRCoder)

Build / source tooling

• Microsoft.TypeScript.MSBuild: 5.9.3 → 7.0.1
  (ActiveLogin.Authentication.BankId.AspNetCore)
  • TypeScriptModuleKind changed from None to esnext (required by the new compiler).
  • Updated Client/activelogin-main.ts for TypeScript 7's stricter nullability checks (explicit nullable/undefined unions, a non-null assertion, and safer event-target casts). No behavioral change — purely type-level fixes.

Test infrastructure (all 5 test projects)

Package	From	To
Microsoft.NET.Test.Sdk	18.0.1	18.10.1
Moq	4.20.72	4.21.0
xunit.runner.visualstudio	3.1.5	4.0.0
AngleSharp (AspNetCore.Test only)	1.5.0	1.8.3
coverlet.collector (UAParser.Test only)	6.0.4	10.1.0

• Fix included: The newer test-SDK/Moq/xunit versions no longer transitively pull in Newtonsoft.Json. Two test projects (Api.Test, AspNetCore.Test) use Newtonsoft.Json/JToken directly in test helpers and assertions but never had an explicit reference — added <PackageReference Include="Newtonsoft.Json" Version="13.0.4" /> to both.

Explicitly excluded from this PR (deferred — breaking changes)

These packages have confirmed breaking API changes and are intentionally out of scope here; they'll be handled in a follow-up branch/PR:

• Azure.Identity (1.17.1 → 1.21.0) and Azure.Security.KeyVault.Secrets (4.8.0 → 4.11.1) — coupled; upgrading one without the other causes CS0433 ambiguous-type errors (ClientSecretCredential, DefaultAzureCredential, DefaultAzureCredentialOptions) via a newer transitive Azure.Core. Must be upgraded together.
• Microsoft.ApplicationInsights / Microsoft.ApplicationInsights.AspNetCore (2.23.0 → 3.1.2)
• Duende.IdentityServer (7.4.5 → 8.0.9)

Also deferred (tied to a future TFM/runtime-aligned upgrade, not included here): Microsoft.Extensions.*, Microsoft.AspNetCore.* test/runtime-compilation packages, System.Text.Json, NETStandard.Library.

Notes for reviewers

• No Directory.Packages.props / Central Package Management in use — versions are set per project file as per existing convention.

[Copilot]

Copilot review overview

🟢 Approval recommended

The dependency and type-level changes are consistent, compatible with existing usage, and introduce no identified defects.

Review effort: Balanced
Findings: None

What changed in this PR

Updates low-risk NuGet dependencies and TypeScript tooling without intended runtime changes.

Changes:

• Upgrades library and test dependencies.
• Adds explicit Newtonsoft.Json test dependencies.
• Updates TypeScript configuration and nullability annotations.

File	Description
test/​ActiveLogin.Authentication.BankId.UAParser.Test/​ActiveLogin.Authentication.BankId.UAParser.Test.csproj	Updates test and coverage tooling.
test/​ActiveLogin.Authentication.BankId.Core.Test/​ActiveLogin.Authentication.BankId.Core.Test.csproj	Updates test tooling.
test/​ActiveLogin.Authentication.BankId.AzureKeyVault.Test/​ActiveLogin.Authentication.BankId.AzureKeyVault.Test.csproj	Updates test tooling.
test/​ActiveLogin.Authentication.BankId.AspNetCore.Test/​ActiveLogin.Authentication.BankId.AspNetCore.Test.csproj	Updates test packages and adds Newtonsoft.Json.
test/​ActiveLogin.Authentication.BankId.Api.Test/​ActiveLogin.Authentication.BankId.Api.Test.csproj	Updates test packages and adds Newtonsoft.Json.
src/​ActiveLogin.Authentication.BankId.QRCoder/​ActiveLogin.Authentication.BankId.QRCoder.csproj	Upgrades QRCoder.
src/​ActiveLogin.Authentication.BankId.Core/​ActiveLogin.Authentication.BankId.Core.csproj	Upgrades Swedish identity support.
src/​ActiveLogin.Authentication.BankId.AspNetCore/​Client/​activelogin-main.ts	Adds TypeScript 7-compatible types.
src/​ActiveLogin.Authentication.BankId.AspNetCore/​ActiveLogin.Authentication.BankId.AspNetCore.csproj	Upgrades dependencies and TypeScript configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.