Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1 - #222

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1
Closed

Bump Microsoft.Identity.Web from 3.6.2 to 3.13.1#222
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 18, 2025

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 3.6.2 to 3.13.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

3.13.1

3.13.1

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.14.0.

3.13.0

3.13.0

Dependencies updates

  • Microsoft.IdentityModel updated to version 8.13.1.
  • Microsoft.Abstractions updated to version 9.3.0 and using IAuthenticationSchemeInformationProvider from that library, deprecating the interface of the same name in Microsoft.Identity.Web (introduced in 3.12.0).

Bug fixes

  • Fixed an issue with instantiation of TokenAcquirerFactory when AppContext.BaseDirectory is root path. See PR #​3443 for details.

Fundamentals

3.12.0

3.12.0

Dependencies updates

  • Updated MSAL to version 4.74.1 part of #​3398.

Bug fix

Reload certificates for all client credential based issues to solve the issue that when a bad certificate was installed on the machine and picked up, and subsequently rotated, a service restart was needed for the new certificate to be used. See issue #​3429 and PR #​3430

New features

  • Include the thrown exception in CertificateChangeEventArg. See PR #​3428 for better supportabiliby.
  • Support for Agent User identities. See PR #​3435

3.11.0

3.11.0

Dependencies updates

  • Updated global.json to the latest .NET 9 runtime framework 9.0.108. See PR #​3422 for details.

Bug fixes

  • Fix IDW10405 error when using managed identity with common tenant. See PR #​3415 for details.
  • Fix OidcIdpSignedAssertionLoader to remove hard dependency on IConfiguration registration. See PR #​3414 for details.

New feature

  • Add support for ExtraHeaderParameters and ExtraQueryParameters properties on DownstreamApiOptions to simplify adding custom headers and query parameters to downstream API requests. See PR #​3413 for details.
  • Add better support for Azure SDK. For details see Readme-Azure and PR #​3416

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.10.0...3.11.0

3.10.0

3.10.0

Dependencies updates

  • Updated MSAL to version 4.73.1 (#​3398).
  • Updated global.json to the latest .NET 9 runtime framework 9.0.107 (#​3385).

New feature

  • Added support for Agent Identities (#​3396, #​3402).
    introducing the Microsoft.Identity.Web.AgentIdentities package .

Bug fixes

  • Processed codeQL issues

Fundamentals

  • improved unit tests for OidcFic with the new SignedAssertionFmiPath

3.9.4

3.9.4

Package updates

  • Microsoft.IdentityModel updated to version 8.12.1.

Bug fix

  • Updates the DefaultAuthorizationHeaderProvider to update the AcquireTokenOptions.LongRunningWebApiSessionKey after the token is acquired so that the key can be used in the next OBO call. See PR #​3381 for details.

Fundamentals

  • Update .NET SDK version to 9.0.107 used when building or running the code. See #​3385 for details.
  • Improved test coverage for managed identity flows. See #​3350 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.3...3.9.4

3.9.3

3.9.3

Package updates

  • Microsoft.IdentityModel updated to version 8.12.0.

Fundamentals

  • Add .clinerules to help with AI tooling.
  • Update PublicApiAnalyzers and BannedApiAnalyzers to 4.14.0 Upgraded analyzer packages for improved diagnostics and code consistency (in particular delegates are added). For details see #​3379

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.2...3.9.3

3.9.2

3.9.2

Package updates

Fundamentals:

  • Fix invalid comparisons in prop and csproj files. For details see #​3297.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.1...3.9.2

3.9.1

3.9.1

Package updates

  • Microsoft.Identity.Abstractions updated to version 9.1.0.

Fundamentals

  • Fix AoT warnings. For details see #​3366.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.9.0...3.9.1

3.9.0

3.9.0

Package updates

Bug fixes

  • Fixed issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
  • Resolved IL warnings from AddDownstreamApis in NativeAOT projects. See #​3355.
  • Ensured AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.
  • Prevented null reference when accessing MergedOptions instance. See #​3337.

New feature

  • Added optional login_hint and domain_hint support to AccountController.SignIn endpoint. See #​3244 and #​3348.

Fundamentals

  • Introduced Long-Term Support (LTS) policy. See #​3357.
  • Added tests to validate xms_cc (client capability) forwarding in CCA flows. See #​3349.

External contributions

Thank you @​evan-buss for your contribution and fixing the issue where RequiredScopeOrAppPermission extension method didn’t work with Minimal APIs. See #​3323.
Thank you @​neha-bhargava for your contribution and ensuring AcquireTokenForConfidentialClient correctly passes MSAL exceptions. See #​3345.

3.8.4

3.8.4

Package updates

Bug fixes

  • Fixed the issue where FmiPath was not persisted when copying/reinitializing AcquireTokenOptions. See #​3336.

New feature

Fundamentals

  • Removed System.Text.Json as an explicit dependency for .NET Core targets. See #​3331.

3.8.3

3.8.3

Package updates

New feature

  • TokenAcquistion.cs adds its service provider to the acquisition options. See issue #​3315 for details.

3.8.2

3.8.2

  • Updated to Microsoft.Identity.Abstractions 9.0.0

New feature

  • An exception is now thrown if MSAL TokenCacheNotificationArgs indicates that distributed cache is configured when it should not have been. See #​3304.
  • Added support for federated identity credentials with AT_POP. See #​3299.

3.8.1

New features

  • Updated to Microsoft.IdentityModel.* 8.7.0

Bug fixes

  • Pins Microsoft.Extensions.Http dependency version to 3.1.3 for .NET Framework and .NET Standard and uses inbox version for .NET Core. See #​3145.

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.8.0...3.8.1

3.8.0

3.8.0

New feature

  • Updated to Microsoft.IdentityModel.* 8.6.1
  • Updated to MSAL.NET 4.69.1
  • Updated the Json Schema to include extensiblity for signed assertion providers. See #​3235
  • Added support for Federation Identity Credential on any OIDC Idp (FIC+OIDC credential provider). See #​3255
  • Support for acquiring token for Federation Managed Identity (FMI). Supports the FmiPath property of AcquireTokenOptions. See #​3247
  • Downstream APIs now support Authorization headers with a custom SAML bearer syntax. See #​3273

Bug fixes

  • TokenAcquirerFactory is now thread safe. See #​3274
  • Fix a bug in the parsing of the token in the authority. See #​3261

Fundamentals

  • Removed old Blazorwasm sample, wasm-tools and added new blazor web API: #​3259, #​3257, #​3254
  • Modified the build so that, in CI/CD internal builds, the NuGet.olg NuGet source is replaced by a managed Nuget source. More verbose information added. See #​3263
  • Fixed CS8602 Warnings in Weather.razor (BlazorApp) – Handle Nullable forecasts and user.Identity. See #​3266,

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-identity-web@3.7.1...3.8.0

3.7.1

3.7.1

  • Updated to Microsoft.IdentityModel.* 8.5.0

3.7.0

3.7.0

  • Updated to Microsoft.Identity.Abstractions 8.1.0
  • Updated to Microsoft.IdentityModel.* 8.4.0

New Feature

  • IdentityWeb now provides extensibility to DefaultCredentialsLoader so that partner teams, or an SDK on top of IdWeb, can bring their own credential providers. See #​3220 for details.

Bug fixes

  • The merged options are now being passed to MSAL for the CCA ROPC scenario. See #​3207 for details.

What's Changed

Full Changelog: AzureAD/microsoft-identity-web@3.6.2...3.7.0

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
dependency-version: 3.13.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 18, 2025
@dependabot@github

dependabotBot commented on behalf of githubAug 26, 2025

Copy link
Copy Markdown
ContributorAuthor

Superseded by #224.

@dependabotdependabotBot closed this Aug 26, 2025
auto-merge was automatically disabled August 26, 2025 03:07

Pull request was closed

@dependabot
dependabotBot deleted the dependabot/nuget/GraphTutorial/Microsoft.Identity.Web-3.13.1 branch August 26, 2025 03:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependenciesPull requests that update a dependency file.NETPull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants