From d852a36a10bad5853eebabe8d7667794a3f31702 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 20:30:32 +0000
Subject: [PATCH 1/2] Initial plan


From eae07fc79aaf8b10a6083d751be4149ad8bf930a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 20:31:57 +0000
Subject: [PATCH 2/2] Add 4.14.2 changelog section with dependency updates for
 Wilson 8.22.0 and net8.0 crypto floor fix

---
 changelog.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/changelog.md b/changelog.md
index f64c9a71e..6e95833eb 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,3 +1,9 @@
+## 4.14.2
+
+### Dependencies updates
+- Bump the `Microsoft.IdentityModel.*` (Wilson) version to 8.22.0. See [#3986](https://github.com/AzureAD/microsoft-identity-web/pull/3986).
+- Fix the net8.0 crypto floor to use the patched `System.Security.Cryptography.Xml` 8.0.4 (and its `System.Security.Cryptography.Pkcs` 8.0.1 dependency) instead of over-bumping to the 9.0.18 servicing line (CVE-2026-47302, -47304, -50525, -50648). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged. See [#3989](https://github.com/AzureAD/microsoft-identity-web/pull/3989).
+
 ## 4.14.1
 
 ### Dependencies updates