Bump the dotnet-minor-patch group with 5 updates

[dependabot]

Updated Microsoft.Identity.Web from 4.10.0 to 4.11.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.11.0

What's Changed

• Bump vitest from 3.2.4 to 4.1.0 in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump vitest from 3.2.4 to 4.1.0 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3836
• Bump MSAL.NET to 4.84.2 and align OWIN binding redirects by @​gladjohn with @​Copilot in Bump MSAL.NET to 4.84.2 and align OWIN binding redirects AzureAD/microsoft-identity-web#3844
• docs(design): devex proposal for mTLS PoP on Managed Identity and FIC by @​gladjohn in docs(design): devex proposal for mTLS PoP on Managed Identity and FIC AzureAD/microsoft-identity-web#3832
• Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values by @​iarekk in Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values AzureAD/microsoft-identity-web#3850
• Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #​3832) by @​gladjohn in Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #3832) AzureAD/microsoft-identity-web#3839
• docs(design): devex proposal for Bearer tokens with bound credentials by @​gladjohn in docs(design): devex proposal for Bearer tokens with bound credentials AzureAD/microsoft-identity-web#3833
• Add bound-credential support for Bearer tokens (cert + mTLS) by @​gladjohn in Add bound-credential support for Bearer tokens (cert + mTLS) AzureAD/microsoft-identity-web#3835
• Upgrade IdWeb Sidecar to .NET 10 (LTS) by @​soodt in Upgrade IdWeb Sidecar to .NET 10 (LTS) AzureAD/microsoft-identity-web#3841
• MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support by @​tlupes in MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support AzureAD/microsoft-identity-web#3815
• fix: include isTokenBinding in CCA cache key to prevent bearer/PoP collision by @​gladjohn in fix: include isTokenBinding in CCA cache key to prevent bearer/PoP collision AzureAD/microsoft-identity-web#3867
• Test + doc: x-ms-tokenboundauth header for AKV mTLS PoP via ExtraHeaderParameters by @​gladjohn in Test + doc: x-ms-tokenboundauth header for AKV mTLS PoP via ExtraHeaderParameters AzureAD/microsoft-identity-web#3864
• Add mTLS PoP Copilot skill (certificate, MSI, FIC) by @​gladjohn in Add mTLS PoP Copilot skill (certificate, MSI, FIC) AzureAD/microsoft-identity-web#3872
• Fix CVE-2026-48109: Pin MessagePack to patched version 2.5.301 by @​soodt in Fix CVE-2026-48109: Pin MessagePack to patched version 2.5.301 AzureAD/microsoft-identity-web#3865
• Sidecar: gate agent identity parameters behind AllowOverrides by @​iNinja in Sidecar: gate agent identity parameters behind AllowOverrides AzureAD/microsoft-identity-web#3871
• Bump System.Formats.Asn1 base version to 10.0.2 by @​iarekk in Bump System.Formats.Asn1 base version to 10.0.2 AzureAD/microsoft-identity-web#3875
• Bump Microsoft.IdentityModel.* from 8.18.0 to 8.19.1 by @​iarekk in Bump Microsoft.IdentityModel.* from 8.18.0 to 8.19.1 AzureAD/microsoft-identity-web#3879
• Use IIdentityLogger for MSAL logging in TokenAcquisition and ManagedIdentityClientAssertion (#​3820) by @​neha-bhargava in Use IIdentityLogger for MSAL logging in TokenAcquisition and ManagedIdentityClientAssertion (#3820) AzureAD/microsoft-identity-web#3880
• Update Microsoft.Identity.Abstractions to 12.2.0 and MSAL to 4.85.0 by @​neha-bhargava in Update Microsoft.Identity.Abstractions to 12.2.0 and MSAL to 4.85.0 AzureAD/microsoft-identity-web#3881
• Surface MSAL AuthenticationResultMetadata + exception details on AcquireTokenResult by @​neha-bhargava in Surface MSAL AuthenticationResultMetadata + exception details on AcquireTokenResult AzureAD/microsoft-identity-web#3856
• Flow outgoing request to header providers via AcquireTokenOptions by @​neha-bhargava in Flow outgoing request to header providers via AcquireTokenOptions AzureAD/microsoft-identity-web#3876
• Throw on Authority vs Instance/TenantId conflict (OIDC + MSAL parity) by @​iarekk in Throw on Authority vs Instance/TenantId conflict (OIDC + MSAL parity) AzureAD/microsoft-identity-web#3873
• Delete .github/workflows/evergreen.yml by @​bgavrilMS in Delete .github/workflows/evergreen.yml AzureAD/microsoft-identity-web#3803
• Add comprehensive authority configuration and precedence documentation by @​jmprieur with @​Copilot in Add comprehensive authority configuration and precedence documentation AzureAD/microsoft-identity-web#3617
• Bump js-yaml from 4.1.1 to 4.2.0 in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump js-yaml from 4.1.1 to 4.2.0 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3862
• Move authority docs into docs/authority-configuration/ subfolder by @​iarekk in Move authority docs into docs/authority-configuration/ subfolder AzureAD/microsoft-identity-web#3885
• Revert "Throw on Authority vs Instance/TenantId conflict (#​3873)" by @​iarekk in Revert "Throw on Authority vs Instance/TenantId conflict (#3873)" AzureAD/microsoft-identity-web#3888
• Update Microsoft.Identity.Client to 4.85.1 by @​neha-bhargava in Update Microsoft.Identity.Client to 4.85.1 AzureAD/microsoft-identity-web#3889
• Enable E2E test coverage on internal Azure DevOps pipelines by @​gladjohn in Enable E2E test coverage on internal Azure DevOps pipelines AzureAD/microsoft-identity-web#3883
• Bump esbuild and tsx in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump esbuild and tsx in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3859
• Skip AcquireTokenWithMtlsPop test: AAD westus3 test slice returns Bearer by @​neha-bhargava in Skip AcquireTokenWithMtlsPop test: AAD westus3 test slice returns Bearer AzureAD/microsoft-identity-web#3892

New Contributors

• @​iarekk made their first contribution in Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values AzureAD/microsoft-identity-web#3850
• @​soodt made their first contribution in Upgrade IdWeb Sidecar to .NET 10 (LTS) AzureAD/microsoft-identity-web#3841

Full Changelog: AzureAD/microsoft-identity-web@4.10.0...4.11.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 microsoft/vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages microsoft/vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.15.2 to 1.16.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.16.0

• NuGet: OpenTelemetry.Extensions.AWS v1.16.0

  • Fix sampling behaviour to be compatible with .NET 11.
    (#​4396)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWS v1.16.0

  • Add instrumentation scope version and schema URL to metrics and traces.
    (#​4063)

  • Pass AWS attribute values to created meters as tags.
    (#​4063)

  • Capture SNS TopicArn as the aws.sns.topic.arn span attribute.
    (#​4043)

  • Add cloud.region attribute to all AWS SDK client spans.
    (#​4043)

  • Add messaging attributes for AWS SNS and SQS.
    (#​4043)

  • BREAKING: Update latest AWS Semantic Conventions to 1.40.0.
    (#​4043)

  • Fix suppression scope leakage when SuppressDownstreamInstrumentation is
    enabled.
    (#​4304)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWSLambda v1.16.0

  • Update System.Text.Json for netstandard2.0 to 8.0.5.
    (#​4154)

  • Add instrumentation scope version and schema URL to traces.
    (#​4063)

  See CHANGELOG for details.

1.16.0-beta.1

• NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.16.0-beta.1

  • Raised the minimum required version of Microsoft.ServiceFabric.Actors and
    Microsoft.ServiceFabric.Services.Remoting from 7.1.2448 to 8.4.268, as the
    7.1 Service Fabric runtime is going out of support.
    (#​4510)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

1.16.0-alpha.1

• NuGet: OpenTelemetry.Instrumentation.EventCounters v1.16.0-alpha.1

  • Fixed OnEventWritten processing events from EventSources that were not
    configured via AddEventSources.
    (#​4031)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Http from 1.15.1 to 1.16.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.16.0

• NuGet: OpenTelemetry.Extensions.AWS v1.16.0

  • Fix sampling behaviour to be compatible with .NET 11.
    (#​4396)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWS v1.16.0

  • Add instrumentation scope version and schema URL to metrics and traces.
    (#​4063)

  • Pass AWS attribute values to created meters as tags.
    (#​4063)

  • Capture SNS TopicArn as the aws.sns.topic.arn span attribute.
    (#​4043)

  • Add cloud.region attribute to all AWS SDK client spans.
    (#​4043)

  • Add messaging attributes for AWS SNS and SQS.
    (#​4043)

  • BREAKING: Update latest AWS Semantic Conventions to 1.40.0.
    (#​4043)

  • Fix suppression scope leakage when SuppressDownstreamInstrumentation is
    enabled.
    (#​4304)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWSLambda v1.16.0

  • Update System.Text.Json for netstandard2.0 to 8.0.5.
    (#​4154)

  • Add instrumentation scope version and schema URL to traces.
    (#​4063)

  See CHANGELOG for details.

1.16.0-beta.1

• NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.16.0-beta.1

  • Raised the minimum required version of Microsoft.ServiceFabric.Actors and
    Microsoft.ServiceFabric.Services.Remoting from 7.1.2448 to 8.4.268, as the
    7.1 Service Fabric runtime is going out of support.
    (#​4510)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

1.16.0-alpha.1

• NuGet: OpenTelemetry.Instrumentation.EventCounters v1.16.0-alpha.1

  • Fixed OnEventWritten processing events from EventSources that were not
    configured via AddEventSources.
    (#​4031)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

1.15.2

• NuGet: OpenTelemetry.Exporter.Geneva v1.15.2

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  See CHANGELOG for details.

Commits viewable in compare view.

Updated Scalar.AspNetCore from 2.16.4 to 2.16.6.

Release notes

Sourced from Scalar.AspNetCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!