From 7ea4c5bf885c808cb6e929859934b42183895556 Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Mon, 29 Jun 2026 10:42:13 -0700
Subject: [PATCH 01/10] Update WsFederation package to version 5.7.0

Upgraded Microsoft.IdentityModel.Protocols.WsFederation NuGet package in Microsoft.Identity.Web.OWIN.csproj from version 5.5.0 to 5.7.0 to ensure compatibility and receive the latest fixes and features.
---
 .../Microsoft.Identity.Web.OWIN.csproj                          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index a7c2d2a2b..6a8d08118 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -33,7 +33,7 @@
     <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.5.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />

From 09ceaff0181097d75edff5596015475ee688963e Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Mon, 29 Jun 2026 11:31:55 -0700
Subject: [PATCH 02/10] Update WsFederation package to version 8.2.0

Upgraded Microsoft.IdentityModel.Protocols.WsFederation in Microsoft.Identity.Web.OWIN.csproj from version 5.7.0 to 8.2.0 to ensure compatibility with the latest features and security updates.
---
 .../Microsoft.Identity.Web.OWIN.csproj                          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 6a8d08118..24053cd35 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -33,7 +33,7 @@
     <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="8.2.0" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />

From e5cf87199a8679ece24fbacae215eee47e96af95 Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Mon, 29 Jun 2026 13:09:38 -0700
Subject: [PATCH 03/10] Revert "Update WsFederation package to version 8.2.0"

This reverts commit 3f1febd258c761e8a8f1dad22ed5fdfe33a6c2e5.
---
 .../Microsoft.Identity.Web.OWIN.csproj                          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 24053cd35..6a8d08118 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -33,7 +33,7 @@
     <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="8.2.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />

From e774156d89ac6cedbcad90eb236ddb3b65437092 Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Mon, 29 Jun 2026 15:03:44 -0700
Subject: [PATCH 04/10] Pin Microsoft.IdentityModel.Tokens.Saml to version
 5.7.1

---
 .../Microsoft.Identity.Web.OWIN.csproj                           | 1 +
 tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj            | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 6a8d08118..6e0222db7 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -34,6 +34,7 @@
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="5.7.1" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />
diff --git a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
index 12f3f23ad..8b2395cf6 100644
--- a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
+++ b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
@@ -116,6 +116,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Abstractions" Version="2.2.0" />
     <PackageReference Include="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" Version="2.0.1" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.5.0" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="5.7.1" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Modernizr" Version="2.8.3" />

From 59df0e8e393965211bd8d3a36a3b56d779a0466d Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Mon, 29 Jun 2026 21:18:20 -0700
Subject: [PATCH 05/10] Update SamlPackageVersion handling for conditional
 package versioning

---
 .../Microsoft.Identity.Web.OWIN.csproj              | 13 ++++++++++++-
 .../DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj | 13 ++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 6e0222db7..663888f6e 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -16,6 +16,17 @@
     <DocumentationFile>Microsoft.Identity.Web.OWIN.xml</DocumentationFile>
   </PropertyGroup>
 
+  <!-- Microsoft.IdentityModel.Tokens.Saml is pulled in transitively by WsFederation. The patched
+       5.7.1 (fixes the unauthenticated SAML token parsing DoS advisory,
+       https://aka.ms/mise/advisories/UnauthenticatedSAMLTokenParsing) is only published on the
+       internal IDDP feed used by the OneBranch / Azure DevOps pipelines, which set TF_BUILD. On
+       the public nuget.org feed (GitHub Actions / local restore) only 5.7.0 is available, so fall
+       back to it there. Can be overridden explicitly with -p:SamlPackageVersion=x.y.z. -->
+  <PropertyGroup>
+    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</SamlPackageVersion>
+    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.0</SamlPackageVersion>
+  </PropertyGroup>
+
   <ItemGroup>
     <None Include="..\..\README.md">
       <Pack>True</Pack>
@@ -34,7 +45,7 @@
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="5.7.1" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="$(SamlPackageVersion)" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />
diff --git a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
index 8b2395cf6..38583ea59 100644
--- a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
+++ b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
@@ -105,6 +105,17 @@
   <ItemGroup>
     <Folder Include="App_Data\" />
   </ItemGroup>
+  <!-- Microsoft.IdentityModel.Tokens.Saml is pulled in transitively by WsFederation 5.5.0
+       (intentionally kept at 5.5.0, see .github/dependabot.yml). The patched 5.7.1 (fixes the
+       unauthenticated SAML token parsing DoS advisory,
+       https://aka.ms/mise/advisories/UnauthenticatedSAMLTokenParsing) is only published on the
+       internal IDDP feed used by the OneBranch / Azure DevOps pipelines, which set TF_BUILD. On
+       the public nuget.org feed (GitHub Actions / local restore) only 5.7.0 is available, so fall
+       back to it there. Can be overridden explicitly with -p:SamlPackageVersion=x.y.z. -->
+  <PropertyGroup>
+    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</SamlPackageVersion>
+    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.0</SamlPackageVersion>
+  </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Antlr" Version="3.5.0.2" />
     <PackageReference Include="bootstrap" Version="5.3.3" />
@@ -116,7 +127,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Abstractions" Version="2.2.0" />
     <PackageReference Include="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" Version="2.0.1" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.5.0" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="5.7.1" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="$(SamlPackageVersion)" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Modernizr" Version="2.8.3" />

From 73a157e7eae5fcc166f71b02d467f5b94ebab2f6 Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Tue, 30 Jun 2026 01:53:14 -0700
Subject: [PATCH 06/10] Refactor package version handling for IdentityModel to
 ensure consistent versioning across dependencies

---
 .../Microsoft.Identity.Web.OWIN.csproj            | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 663888f6e..91af04d64 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -16,15 +16,16 @@
     <DocumentationFile>Microsoft.Identity.Web.OWIN.xml</DocumentationFile>
   </PropertyGroup>
 
-  <!-- Microsoft.IdentityModel.Tokens.Saml is pulled in transitively by WsFederation. The patched
-       5.7.1 (fixes the unauthenticated SAML token parsing DoS advisory,
+  <!-- WsFederation and the Microsoft.IdentityModel.Tokens.Saml it pulls in are kept on a single
+       version so the shared Microsoft.IdentityModel.Xml assembly does not conflict (MSB3277). The
+       patched 5.7.1 (fixes the unauthenticated SAML token parsing DoS advisory,
        https://aka.ms/mise/advisories/UnauthenticatedSAMLTokenParsing) is only published on the
        internal IDDP feed used by the OneBranch / Azure DevOps pipelines, which set TF_BUILD. On
        the public nuget.org feed (GitHub Actions / local restore) only 5.7.0 is available, so fall
-       back to it there. Can be overridden explicitly with -p:SamlPackageVersion=x.y.z. -->
+       back to it there. Can be overridden explicitly with -p:IdentityModelV5Version=x.y.z. -->
   <PropertyGroup>
-    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</SamlPackageVersion>
-    <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.0</SamlPackageVersion>
+    <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</IdentityModelV5Version>
+    <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == ''">5.7.0</IdentityModelV5Version>
   </PropertyGroup>
 
   <ItemGroup>
@@ -44,8 +45,8 @@
     <PackageReference Include="Microsoft.AspNet.Mvc" Version="5.2.7" />
     <PackageReference Include="Microsoft.AspNet.Web.Optimization" Version="1.1.3" />
     <PackageReference Include="Microsoft.AspNet.WebApi" Version="5.2.7" />
-    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="5.7.0" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="$(SamlPackageVersion)" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.WsFederation" Version="$(IdentityModelV5Version)" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens.Saml" Version="$(IdentityModelV5Version)" />
     <PackageReference Include="Microsoft.Owin.Host.SystemWeb" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.ActiveDirectory" Version="4.2.2" />
     <PackageReference Include="Microsoft.Owin.Security.OpenIdConnect" Version="4.2.2" />

From 39964c0927acf40cc3ca22bd94c386be14bb50c9 Mon Sep 17 00:00:00 2001
From: trwalke <trwalke@microsoft.com>
Date: Tue, 30 Jun 2026 11:53:50 -0700
Subject: [PATCH 07/10] Demote MSB3277 warning to message for internal
 IdentityModel 5.7.1 build to avoid build issues

---
 .../Microsoft.Identity.Web.OWIN.csproj                 | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 91af04d64..82d55b6f5 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -28,6 +28,16 @@
     <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == ''">5.7.0</IdentityModelV5Version>
   </PropertyGroup>
 
+  <!-- The internal patched 5.7.1 IdentityModel assemblies carry assembly version 0.0.1.0, which is
+       lower than the 5.3.0.0 reference that the (fixed-version) Microsoft.Owin.Security.ActiveDirectory
+       4.2.2 was compiled against, so MSBuild cannot unify them and emits MSB3277 on net472. This is
+       harmless (consumers apply binding redirects) and only occurs with the internal 5.7.1 build, so
+       demote MSB3277 to a message there. Public builds (5.7.0, assembly version 5.7.0.0) unify cleanly
+       and keep full MSB3277 detection. -->
+  <PropertyGroup Condition="'$(IdentityModelV5Version)' == '5.7.1'">
+    <MSBuildWarningsAsMessages>$(MSBuildWarningsAsMessages);MSB3277</MSBuildWarningsAsMessages>
+  </PropertyGroup>
+
   <ItemGroup>
     <None Include="..\..\README.md">
       <Pack>True</Pack>

From d7fe6e6a91f72fa3e82022e0e8c9524770abe727 Mon Sep 17 00:00:00 2001
From: Travis Walker <travis.walker@microsoft.com>
Date: Tue, 30 Jun 2026 15:07:15 -0700
Subject: [PATCH 08/10] Update Microsoft.Identity.Web.OWIN.csproj

---
 .../Microsoft.Identity.Web.OWIN.csproj              | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
index 82d55b6f5..20e1658da 100644
--- a/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
+++ b/src/Microsoft.Identity.Web.OWIN/Microsoft.Identity.Web.OWIN.csproj
@@ -16,24 +16,11 @@
     <DocumentationFile>Microsoft.Identity.Web.OWIN.xml</DocumentationFile>
   </PropertyGroup>
 
-  <!-- WsFederation and the Microsoft.IdentityModel.Tokens.Saml it pulls in are kept on a single
-       version so the shared Microsoft.IdentityModel.Xml assembly does not conflict (MSB3277). The
-       patched 5.7.1 (fixes the unauthenticated SAML token parsing DoS advisory,
-       https://aka.ms/mise/advisories/UnauthenticatedSAMLTokenParsing) is only published on the
-       internal IDDP feed used by the OneBranch / Azure DevOps pipelines, which set TF_BUILD. On
-       the public nuget.org feed (GitHub Actions / local restore) only 5.7.0 is available, so fall
-       back to it there. Can be overridden explicitly with -p:IdentityModelV5Version=x.y.z. -->
   <PropertyGroup>
     <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</IdentityModelV5Version>
     <IdentityModelV5Version Condition="'$(IdentityModelV5Version)' == ''">5.7.0</IdentityModelV5Version>
   </PropertyGroup>
 
-  <!-- The internal patched 5.7.1 IdentityModel assemblies carry assembly version 0.0.1.0, which is
-       lower than the 5.3.0.0 reference that the (fixed-version) Microsoft.Owin.Security.ActiveDirectory
-       4.2.2 was compiled against, so MSBuild cannot unify them and emits MSB3277 on net472. This is
-       harmless (consumers apply binding redirects) and only occurs with the internal 5.7.1 build, so
-       demote MSB3277 to a message there. Public builds (5.7.0, assembly version 5.7.0.0) unify cleanly
-       and keep full MSB3277 detection. -->
   <PropertyGroup Condition="'$(IdentityModelV5Version)' == '5.7.1'">
     <MSBuildWarningsAsMessages>$(MSBuildWarningsAsMessages);MSB3277</MSBuildWarningsAsMessages>
   </PropertyGroup>

From f85a7f8c48e73f29f53015c1cec4c5c1eb5ec923 Mon Sep 17 00:00:00 2001
From: Travis Walker <travis.walker@microsoft.com>
Date: Tue, 30 Jun 2026 15:07:37 -0700
Subject: [PATCH 09/10] Update OwinWebApi.csproj

---
 tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
index 38583ea59..30251ab56 100644
--- a/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
+++ b/tests/DevApps/aspnet-mvc/OwinWebApi/OwinWebApi.csproj
@@ -105,13 +105,7 @@
   <ItemGroup>
     <Folder Include="App_Data\" />
   </ItemGroup>
-  <!-- Microsoft.IdentityModel.Tokens.Saml is pulled in transitively by WsFederation 5.5.0
-       (intentionally kept at 5.5.0, see .github/dependabot.yml). The patched 5.7.1 (fixes the
-       unauthenticated SAML token parsing DoS advisory,
-       https://aka.ms/mise/advisories/UnauthenticatedSAMLTokenParsing) is only published on the
-       internal IDDP feed used by the OneBranch / Azure DevOps pipelines, which set TF_BUILD. On
-       the public nuget.org feed (GitHub Actions / local restore) only 5.7.0 is available, so fall
-       back to it there. Can be overridden explicitly with -p:SamlPackageVersion=x.y.z. -->
+
   <PropertyGroup>
     <SamlPackageVersion Condition="'$(SamlPackageVersion)' == '' and '$(TF_BUILD)' == 'true'">5.7.1</SamlPackageVersion>
     <SamlPackageVersion Condition="'$(SamlPackageVersion)' == ''">5.7.0</SamlPackageVersion>
@@ -202,4 +196,4 @@
   </Target>
   <Target Name="AfterBuild">
   </Target> -->
-</Project>
\ No newline at end of file
+</Project>

From d4a302dec9cdec6c6703392e19e96f20bc39d8d9 Mon Sep 17 00:00:00 2001
From: Iarek Kovtunenko <16271112+iarekk@users.noreply.github.com>
Date: Wed, 1 Jul 2026 11:45:24 +0100
Subject: [PATCH 10/10] Sidecar: bump OpenAPI package versions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/Microsoft.Identity.Web.Sidecar/Directory.Build.props       | 3 ++-
 .../Microsoft.Identity.Web.Sidecar.csproj                      | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/Microsoft.Identity.Web.Sidecar/Directory.Build.props b/src/Microsoft.Identity.Web.Sidecar/Directory.Build.props
index 4e960bd44..a36a67829 100644
--- a/src/Microsoft.Identity.Web.Sidecar/Directory.Build.props
+++ b/src/Microsoft.Identity.Web.Sidecar/Directory.Build.props
@@ -4,8 +4,9 @@
     <TargetFrameworks>net10.0</TargetFrameworks>
   </PropertyGroup>
   <PropertyGroup>
-    <SidecarAspDependencyVersion>10.0.0</SidecarAspDependencyVersion>
+    <SidecarAspDependencyVersion>10.0.9</SidecarAspDependencyVersion>
     <MicrosoftAspNetCoreOpenApiVersion>$(SidecarAspDependencyVersion)</MicrosoftAspNetCoreOpenApiVersion>
+    <MicrosoftOpenApiVersion>2.9.0</MicrosoftOpenApiVersion>
     <MicrosoftExtensionsApiDescriptionServerVersion>$(SidecarAspDependencyVersion)</MicrosoftExtensionsApiDescriptionServerVersion>
     <MicrosoftVisualStudioAzureContainersToolsTargetsVersion>1.22.1</MicrosoftVisualStudioAzureContainersToolsTargetsVersion>
   </PropertyGroup>
diff --git a/src/Microsoft.Identity.Web.Sidecar/Microsoft.Identity.Web.Sidecar.csproj b/src/Microsoft.Identity.Web.Sidecar/Microsoft.Identity.Web.Sidecar.csproj
index 506bfefef..bc5b2ef2f 100644
--- a/src/Microsoft.Identity.Web.Sidecar/Microsoft.Identity.Web.Sidecar.csproj
+++ b/src/Microsoft.Identity.Web.Sidecar/Microsoft.Identity.Web.Sidecar.csproj
@@ -32,6 +32,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="$(MicrosoftAspNetCoreAuthenticationJwtBearerVersion)" NoWarn="$(NoWarn);NU1605" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="$(MicrosoftAspNetCoreOpenApiVersion)" />
+    <PackageReference Include="Microsoft.OpenApi" Version="$(MicrosoftOpenApiVersion)" />
     <PackageReference Include="Microsoft.Extensions.ApiDescription.Server" Version="$(MicrosoftExtensionsApiDescriptionServerVersion)">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>