Skip to content

Bump Microsoft.Identity.Web and Microsoft.Identity.Web.UI - #1629

Merged
berviantoleo merged 1 commit into
mainfrom
dependabot/nuget/SimplePasswordManagerService/multi-57daf6e746
Jul 20, 2026
Merged

Bump Microsoft.Identity.Web and Microsoft.Identity.Web.UI#1629
berviantoleo merged 1 commit into
mainfrom
dependabot/nuget/SimplePasswordManagerService/multi-57daf6e746

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 4.10.0 to 4.13.2.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.13.2

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@4.13.0...4.13.2

4.13.0

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@4.12.2...4.13.0

4.12.2

Bug fixes

  • Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

  • Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

  • Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
  • Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

  • Build the solution in the PR pipeline before running tests. See #​3911.
  • Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
  • Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

  • Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
  • Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

  • Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

  • Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
  • Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
  • Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

4.11.0

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@4.10.0...4.11.0

Commits viewable in compare view.

Updated Microsoft.Identity.Web.UI from 4.10.0 to 4.13.2.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.13.2

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@4.13.0...4.13.2

4.13.0

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@4.12.2...4.13.0

4.12.2

Bug fixes

  • Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

  • Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

  • Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
  • Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

  • Build the solution in the PR pipeline before running tests. See #​3911.
  • Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
  • Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

  • Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
  • Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

  • Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

  • Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
  • Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
  • Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

4.11.0

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@4.10.0...4.11.0

Commits viewable in compare view.

@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Jul 18, 2026
This was referenced Jul 18, 2026
Closed
Closed
@dependabot
Bump Microsoft.Identity.Web and Microsoft.Identity.Web.UI
42afe39 
Bumps Microsoft.Identity.Web from 4.10.0 to 4.13.2
Bumps Microsoft.Identity.Web.UI from 4.10.0 to 4.13.2

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Microsoft.Identity.Web.UI
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/SimplePasswordManagerService/multi-57daf6e746 branch from 12ab28d to 42afe39 Compare July 20, 2026 01:37
@sonarqubecloud

sonarqubecloud Bot commented Jul 20, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@berviantoleo
berviantoleo merged commit 2727cc3 into main Jul 20, 2026
10 of 11 checks passed
@dependabot
dependabot Bot deleted the dependabot/nuget/SimplePasswordManagerService/multi-57daf6e746 branch July 20, 2026 01:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@berviantoleo berviantoleo

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@berviantoleo