[4.x] Update Azure.Identity and related dependencies by Avery-Dunn · Pull Request #3787 · AzureAD/microsoft-identity-web

Avery-Dunn · 2026-04-23T21:40:55Z

Summary

This PR updates dependency versions on older TFMs (net462/net472/netstandard2.0) to establish a consistent Microsoft.Extensions.* 8.0.x minimum across all non-framework-coupled packages. It also updates Azure.Identity and System.Text.Json for security fixes. See #3795 for ID Web 3.x version

Background

Azure.Identity 1.17.2 (sovereign cloud fixes), pulls in Azure.Core 1.50.0, which introduces a transitive cascade on older TFMs:

Azure.Identity 1.17.2
  → Azure.Core 1.50.0
    → System.ClientModel 1.8.0 (was 1.0.0)
      → Logging.Abstractions ≥ 8.0.3
        → DI.Abstractions ≥ 8.0.2

DI.Abstractions 8.0.2 defines ServiceCollection, causing a CS0433 type collision with the full DI package (previously pinned at 2.1.0 via Extensions.Http 3.1.3). Resolving this requires DI ≥ 8.0.0 on older TFMs regardless of approach.

Rather than patch individual packages, this PR bumps the entire M.E.* stack to 8.0.x together, establishing a clean baseline that eliminates several 5-year version gaps and aligns with the net8.0 TFM versions.

Dependency changes

Security/behavioral updates (all TFMs):

Azure.Identity 1.11.4 → 1.17.2
System.Text.Json 8.0.5 → 8.0.6 (CVE-2024-43485, Azure.Core 1.50.0 minimum)

M.E.* baseline bump (net462/net472/netstandard2.0):

Package	Previous	New	Reason
Extensions.Caching.Memory	2.1.0 / 6.0.2	8.0.1	CVE in 8.0.0 (GHSA-qj66-m88j-hmgj)
Extensions.Hosting	2.1.1 / 6.0.0	8.0.0	Align with baseline
Extensions.Http	3.1.3	8.0.0	DI collision fix
Extensions.Logging	2.1.0 / 6.0.0	8.0.0	Align with baseline
Extensions.DI	2.1.0	8.0.0	Align with DI.Abstractions 8.0.2
Extensions.Configuration.Binder	2.1.0–6.0.0	8.0.0	Required by Options.ConfigurationExtensions 8.0.0
Extensions.Configuration / .Json	3.1.0–3.1.24	8.0.0	Required by Http 8.0.0 chain

Extensions.Logging.Abstractions was already at 8.0.3 (forced by Azure.Core cascade); DataProtection and System.Security.Cryptography.* are unchanged.

Version management improvements

Directory.Build.props restructured to use centralized variables, modeled after MISE:

New CommonMicrosoftExtensionsVersion = 8.0.0 base variable
New Microsoft.Extensions base versions PropertyGroup sets defaults for CachingMemory, ConfigBinder, Configuration, Configuration.Json, DI, Hosting, Http, and Logging using the base variable
net8.0 block reduced to only overrides that differ from base (CachingMemory 8.0.1, DataProtection 8.0.1, Crypto versions)
net462 and net472/netstandard2.0 blocks reduced to only non-M.E.* overrides (DataProtection, Crypto versions)
net9.0/net10.0 blocks fully override to match their runtime versions (unchanged)

Hardcoded versions replaced with variables in csproj files:

Microsoft.Identity.Web.OWIN.csproj: Configuration, Configuration.Json → variables
Microsoft.Identity.Web.TokenAcquisition.csproj: Configuration.Json → variable
Microsoft.Identity.Web.Test.csproj: Hosting 3.1 → $(MicrosoftExtensionsHostingVersion)

Source code changes

To accommodate the updated dependency versions:

KeyVaultCertificateLoader.cs: Removed obsolete ExcludeSharedTokenCacheCredential = true (excluded by default in Azure.Identity 1.17.2)
ManagedIdentityClientAssertion.cs: Added null guard for _logger (Logging.Abstractions 8.0.3 tightens ILogger to non-nullable)
OptionsMergers (3 files): Removed #if NET7_0_OR_GREATER — all remaining TFMs use DI 8.0.0+ which has string? name
OWIN files: Disambiguated ConfigurationManager (Configuration 8.0.0 adds a conflicting type), fixed nullable annotations
DownstreamApi.cs: Null-forgiving operator for IHttpClientFactory.CreateClient (Http 8.0.0 tightens nullable types)
CacheEncryptionTests.cs: Updated MemoryCache reflection paths for 8.0.x internal structure on net462/net472 (internal field names changed from _entries to _coherentState/_stringEntries)

No public API or meaningful behavioral changes were made. The only internal API change (PostConfigure string! → string?) is tracked in InternalAPI.Unshipped.txt.

…D/microsoft-identity-web into avdunn/dependency-updates

Avery-Dunn · 2026-04-30T14:11:21Z

@copilot resolve the merge conflicts in this pull request

…onfigurationJsonVersion Co-authored-by: Avery-Dunn <62066438+Avery-Dunn@users.noreply.github.com>

Copilot · 2026-04-30T14:21:29Z

@copilot resolve the merge conflicts in this pull request

Merged master (commit e13b5032) into the branch in commit f77d380e. The only conflicts were modify/delete conflicts in the old per-TFM InternalAPI.Unshipped.txt files — resolved by accepting master's deletion, since the API File Cleanup (#3798) removed per-TFM internal API tracking in favor of the new NetCore/NetFramework consolidated structure.

Updated [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) from 4.8.0 to 4.9.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.9.0 ### New features - **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides` configuration section provides explicit, per-route control over whether `optionsOverride.*` query-string parameters are honored. Authenticated routes default to allowing overrides (preserving existing behavior); unauthenticated routes default to rejecting them. `optionsOverride.BaseUrl` is unconditionally rejected on all routes as a hardening measure. See [#3794](AzureAD/microsoft-identity-web#3794). ### Bug fixes - Fix `AccountController.Challenge` redirect URI validation to reject percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.) that could be decoded by misconfigured reverse proxies. See [#3792](AzureAD/microsoft-identity-web#3792). ### Behavior changes - **DownstreamApi: reserved header filtering.** Headers supplied via `DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved HTTP headers (`Authorization`, `Host`, `Content-Length`, `Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header the library already set are now silently skipped. A warning-level log entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so operators can spot misconfigurations. No exception is thrown. See [#3793](AzureAD/microsoft-identity-web#3793). ### Dependencies updates - **Update Azure.Identity 1.11.4 → 1.17.2 and establish Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity 1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which introduces a transitive dependency on `Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused a `CS0433` type collision with the previously-pinned `Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch individual packages, the entire `Microsoft.Extensions.*` stack on these older TFMs has been bumped to 8.0.x, closing several 5-year version gaps and aligning with the net8.0 baseline. **If your application targets net462, net472, or netstandard2.0**, your resolved `Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http` 3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0, `Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already targeting net8.0+ are unaffected. See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on net10.0. See [#3796](AzureAD/microsoft-identity-web#3796). - Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3. See [#3788](AzureAD/microsoft-identity-web#3788). **Full Changelog**: AzureAD/microsoft-identity-web@4.8.0...4.9.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.8.0...4.9.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.8.0&new-version=4.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eelco Los <5102501+EelcoLos@users.noreply.github.com>

#3354) Updated [Microsoft.Identity.Web.GraphServiceClientBeta](https://github.com/AzureAD/microsoft-identity-web) from 4.8.0 to 4.9.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web.GraphServiceClientBeta's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.9.0 ### New features - **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides` configuration section provides explicit, per-route control over whether `optionsOverride.*` query-string parameters are honored. Authenticated routes default to allowing overrides (preserving existing behavior); unauthenticated routes default to rejecting them. `optionsOverride.BaseUrl` is unconditionally rejected on all routes as a hardening measure. See [#3794](AzureAD/microsoft-identity-web#3794). ### Bug fixes - Fix `AccountController.Challenge` redirect URI validation to reject percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.) that could be decoded by misconfigured reverse proxies. See [#3792](AzureAD/microsoft-identity-web#3792). ### Behavior changes - **DownstreamApi: reserved header filtering.** Headers supplied via `DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved HTTP headers (`Authorization`, `Host`, `Content-Length`, `Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header the library already set are now silently skipped. A warning-level log entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so operators can spot misconfigurations. No exception is thrown. See [#3793](AzureAD/microsoft-identity-web#3793). ### Dependencies updates - **Update Azure.Identity 1.11.4 → 1.17.2 and establish Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity 1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which introduces a transitive dependency on `Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused a `CS0433` type collision with the previously-pinned `Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch individual packages, the entire `Microsoft.Extensions.*` stack on these older TFMs has been bumped to 8.0.x, closing several 5-year version gaps and aligning with the net8.0 baseline. **If your application targets net462, net472, or netstandard2.0**, your resolved `Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http` 3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0, `Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already targeting net8.0+ are unaffected. See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on net10.0. See [#3796](AzureAD/microsoft-identity-web#3796). - Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3. See [#3788](AzureAD/microsoft-identity-web#3788). **Full Changelog**: AzureAD/microsoft-identity-web@4.8.0...4.9.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.8.0...4.9.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web.GraphServiceClientBeta&package-manager=nuget&previous-version=4.8.0&new-version=4.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Gunn <james@gunn.io>

Avery-Dunn added 3 commits April 23, 2026 14:34

Update Azure.Identity and Extensions.Http

c41838c

InternalApi file updates

a44402a

Fix InternalAPI files

5744c6f

cmenzi mentioned this pull request Apr 24, 2026

[Feature Request] Drop Azure.Identity dependency in Microsoft.Identity.Web.Certificate in favor of Azure.Core 1.53.0+ #3791

Open

bgavrilMS reviewed Apr 24, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.Certificate/KeyVaultCertificateLoader.cs

bgavrilMS reviewed Apr 24, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj Outdated

bgavrilMS reviewed Apr 24, 2026

View reviewed changes

Comment thread ...crosoft.Identity.Web.TokenAcquisition/OptionsMergers/MicrosoftAuthenticationOptionsMerger.cs

Avery-Dunn marked this pull request as ready for review April 24, 2026 14:40

Avery-Dunn requested a review from a team as a code owner April 24, 2026 14:40

bgavrilMS approved these changes Apr 24, 2026

View reviewed changes

pmaytak reviewed Apr 24, 2026

View reviewed changes

Comment thread Directory.Build.props Outdated

Avery-Dunn changed the title ~~Update Azure.Identity and related dependencies~~ [4.x] Update Azure.Identity and related dependencies Apr 26, 2026

Avery-Dunn mentioned this pull request Apr 26, 2026

[3.x] Update Azure.Identity and related dependencies #3795

Closed

Avery-Dunn added 3 commits April 27, 2026 12:00

Update Azure.Identity and Extensions.Http

aaf41c9

InternalApi file updates

689341e

Fix InternalAPI files

d575152

bgavrilMS force-pushed the avdunn/dependency-updates branch from 5744c6f to d575152 Compare April 27, 2026 11:00

Avery-Dunn and others added 2 commits April 27, 2026 08:27

Merge branch 'master' into avdunn/dependency-updates

91701be

Merge branch 'avdunn/dependency-updates' of https://github.com/AzureA…

1f65948

…D/microsoft-identity-web into avdunn/dependency-updates