Bump OpenIddict.AspNetCore from 7.6.0 to 7.7.0

[dependabot]

Updated OpenIddict.AspNetCore from 7.6.0 to 7.7.0.

Release notes

Sourced from OpenIddict.AspNetCore's releases.

7.7.0

This release introduces the following changes:

• A vulnerability affecting the validation of audiences contained in client assertions by the OpenIddict server stack was identified earlier today (thanks @​x-redacted! ❤️) and fixed.

[!CAUTION]
Upgrading to OpenIddict 7.7 or 8.0 preview 4 is strongly advised. See GHSA-925x-4h4v-2792 for more information.

• On .NET 10 and higher, the OpenIddict.Quartz package now references the 4.0 version of Quartz.NET. See https://www.quartz-scheduler.net/documentation/quartz-4.x/migration-guide.html for more information about Quartz.NET 4.0.

[!IMPORTANT]
On .NET Framework and .NET Standard 2.0/2.1, the package keeps referencing the 3.x branch, as Quartz.NET 4.0 is only compatible with .NET 10 and higher.

• The aud claim in client assertions can now be represented as a JSON array, as allowed by the recent versions of the Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants specification.

• The OpenIddict.Client.WebIntegration package now supports JoinRpg (thanks @​leotsarev! ❤️)

• grant_type=urn:ietf:params:oauth:grant-type:device_code token requests that don't include a client identifier are now rejected earlier by the OpenIddict server stack.

• The net9.0-android, net9.0-ios, net9.0-maccatalyst and net9.0-macos target framework monikers are no longer supported by Microsoft and have been removed from the OpenIddict.Client.SystemIntegration package and the OpenIddict metapackage. Users of the OpenIddict.Client.SystemIntegration package are invited to migrate to .NET 10.0.

• All the .NET and third-party dependencies have been updated to their latest version.

• The System.Interactive.Async dependency (used only on .NET Framework and .NET Standard) was downgraded to 3.2.0 to fix a TypeLoadException that prevented using the OpenIddict Entity Framework Core 2.3 stores on .NET Framework after migrating to OpenIddict 7.6.0.

7.6.1

This release introduces the following changes:

• The GitHub web provider was fixed to support the iss parameter now returned by GitHub. As part of this change, the issuer was also changed to https://github.com/login/oauth, which is the value now officially used by GitHub.

• The ReplaceDefault*Entity() methods exposed by OpenIddictMongoDbBuilder now register the stores as singleton services instead of scoped services.

• The client system integration was updated to always attach an IASWebAuthenticationPresentationContextProviding object to the ASWebAuthenticationSession on Mac Catalyst and macOS, matching the logic already used on iOS (thanks @​amirburbea for reporting this issue).

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)