Bump the non-major-versions group with 3 updates

[dependabot]

Updated Microsoft.AspNetCore.SpaProxy from 8.0.28 to 8.0.31.

Release notes

Sourced from Microsoft.AspNetCore.SpaProxy's releases.

8.0.31

Release

What's Changed

• [release/8.0] Update branding to 8.0.31 by @​dotnet-bot in [release/8.0] Update branding to 8.0.31 dotnet/aspnetcore#68235
• [release/8.0] Backport FormsInputDateTest fixes by @​ilonatommy in [release/8.0] Backport FormsInputDateTest fixes dotnet/aspnetcore#68125
• [release/8.0] (deps): Bump src/submodules/googletest from 3064a60 to 3940de9 by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from 3064a60 to 3940de9 dotnet/aspnetcore#68173
• [release/8.0] Update dependencies from dotnet/source-build-assets by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-assets dotnet/aspnetcore#68189
• [release/8.0] Update dependencies from dotnet/source-build-externals by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#67801
• [release/8.0] Quarantine System_UsesProvidedCertificateNotFromStore by @​wtgodbe in [release/8.0] Quarantine System_UsesProvidedCertificateNotFromStore dotnet/aspnetcore#68242
• [8.0] Fix Debian package descriptions by @​wtgodbe in [8.0] Fix Debian package descriptions dotnet/aspnetcore#68255
• Remove Publish-Build-Assets variable group from release/8.0 by @​missymessa in Remove Publish-Build-Assets variable group from release/8.0 dotnet/aspnetcore#68265
• [release/8.0] Drop Microsoft.AspNetCore.Grpc.Swagger by @​Youssef1313 with @​Copilot in [release/8.0] Drop Microsoft.AspNetCore.Grpc.Swagger dotnet/aspnetcore#67955
• Merging internal commits for release/8.0 by @​dotnet-bot in Merging internal commits for release/8.0 dotnet/aspnetcore#68361
• [release/8.0] Update OpenAPI to latest by @​Youssef1313 in [release/8.0] Update OpenAPI to latest dotnet/aspnetcore#68491

Full Changelog: dotnet/aspnetcore@v8.0.30...v8.0.31

8.0.30

Release

What's Changed

• [release/8.0] Update branding to 8.0.30 by @​dotnet-bot in [release/8.0] Update branding to 8.0.30 dotnet/aspnetcore#67621
• [release/8.0] (deps): Bump src/submodules/googletest from 7140cd4 to 973323e by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from 7140cd4 to 973323e dotnet/aspnetcore#67525
• [release/8.0] (deps): Bump src/submodules/MessagePack-CSharp from 9614e6f to 365965f by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/MessagePack-CSharp from 9614e6f to 365965f dotnet/aspnetcore#67524
• Update ws package version to 7.5.11 by @​birarroshan in Update ws package version to 7.5.11 dotnet/aspnetcore#67408
• [release/8.0] Update CI pipeline to use Windows 2022 image by @​github-actions[bot] in [release/8.0] Update CI pipeline to use Windows 2022 image dotnet/aspnetcore#67289
• [release/8.0] Update Selenium and Playwright versions to match main by @​wtgodbe in [release/8.0] Update Selenium and Playwright versions to match main dotnet/aspnetcore#67273
• [release/8.0] improve CI flakiness by @​wtgodbe in [release/8.0] improve CI flakiness dotnet/aspnetcore#67645
• [release/8.0] (deps): Bump src/submodules/googletest from 973323e to 3064a60 by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from 973323e to 3064a60 dotnet/aspnetcore#67654
• Merging internal commits for release/8.0 by @​dotnet-bot in Merging internal commits for release/8.0 dotnet/aspnetcore#67796
• Use build identity (System.AccessToken) for internal feed creds instead of expired dn-bot-dnceng-artifact-feeds-rw PAT (release/8.0) by @​missymessa in Use build identity (System.AccessToken) for internal feed creds instead of expired dn-bot-dnceng-artifact-feeds-rw PAT (release/8.0) dotnet/aspnetcore#67854
• [release/8.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#67943

New Contributors

• @​birarroshan made their first contribution in Update ws package version to 7.5.11 dotnet/aspnetcore#67408

Full Changelog: dotnet/aspnetcore@v8.0.29...v8.0.30

8.0.29

Release

What's Changed

• Update branding to 8.0.29 by @​vseanreesermsft in Update branding to 8.0.29 dotnet/aspnetcore#66982
• [release/8.0] (deps): Bump src/submodules/googletest from d72f9c8 to a721f1b by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from d72f9c8 to a721f1b dotnet/aspnetcore#66973
• [release/8.0] Update System.Security.Cryptography.Xml in RepoTasks by @​wtgodbe in [release/8.0] Update System.Security.Cryptography.Xml in RepoTasks dotnet/aspnetcore#66766
• [release/8.0] Update dependencies from dotnet/source-build-externals by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-externals dotnet/aspnetcore#66699
• [release/8.0] Update dependencies from dotnet/source-build-assets by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/source-build-assets dotnet/aspnetcore#66664
• [release/8.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#66946
• [release/8.0] Add 1ES Unofficial pipeline for Components E2E tests by @​wtgodbe in [release/8.0] Add 1ES Unofficial pipeline for Components E2E tests dotnet/aspnetcore#66989
• Merging internal commits for release/8.0 by @​vseanreesermsft in Merging internal commits for release/8.0 dotnet/aspnetcore#67105
• [release/8.0] Update npm dependencies by @​wtgodbe in [release/8.0] Update npm dependencies dotnet/aspnetcore#67144
• [release/8.0] Update Microsoft Identity Web package versions to 3.15.1 by @​wtgodbe in [release/8.0] Update Microsoft Identity Web package versions to 3.15.1 dotnet/aspnetcore#67164
• [release/8.0] (deps): Bump src/submodules/googletest from a721f1b to 7140cd4 by @​dependabot[bot] in [release/8.0] (deps): Bump src/submodules/googletest from a721f1b to 7140cd4 dotnet/aspnetcore#67222
• [release/8.0] Backport docker image fix by @​wtgodbe in [release/8.0] Backport docker image fix dotnet/aspnetcore#67279
• [release/8.0] Reject ASCII control characters in cookie auth return URLs by @​github-actions[bot] in [release/8.0] Reject ASCII control characters in cookie auth return URLs dotnet/aspnetcore#67157

Full Changelog: dotnet/aspnetcore@v8.0.28...v8.0.29

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 6.1.5 to 6.1.7.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

6.1.7

This update brings the following changes since the 6.1.6 release:

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#​4520, #​4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4664)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.7.md

6.1.6

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#​4288, #​4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#​4340, #​4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:
... (truncated)

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.9 to 10.0.12.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions