Duende.Documentation.Mcp 0.6.0

This release addresses security vulnerabilities disclosed in the .NET August 2026 servicing update, including CVE-2026-62900 in the .NET SDK's SourceLink components. Because the MCP docs package is published self-contained, it embeds the .NET runtime, so republishing with the patched SDK is also required to pick up this month's runtime fixes (e.g. CVE-2026-62901).

What's Changed

• The .NET SDK version has been bumped from 10.0.302 to 10.0.303 (bundles runtime 10.0.11).

Duende IdentityServer 8.0.5

What's changed

This is a patch release of IdentityServer that fixes the following issue:

• Fixed an InvalidCastException that could occur during server-side session cleanup. When a concurrent deletion caused a DbUpdateConcurrencyException in PersistedGrantStore.RemoveAllAsync, the affected entries were not detached from the EF Core change tracker. Those stale entries could then cause type mismatches in subsequent save operations. The fix ensures entries are properly detached after a concurrency exception.

Duende IdentityServer 7.4.10

What's changed

This is a patch release of IdentityServer that fixes the following issue:

• Fixed an InvalidCastException that could occur during server-side session cleanup. When a concurrent deletion caused a DbUpdateConcurrencyException in PersistedGrantStore.RemoveAllAsync, the affected entries were not detached from the EF Core change tracker. Those stale entries could then cause type mismatches in subsequent save operations. The fix ensures entries are properly detached after a concurrency exception.

Duende IdentityServer 7.4.9

What's changed

This is a patch release of identity server that fixes the following issue:

• Added a direct Microsoft.Bcl.Memory dependency for net8.0 to resolve .NET 8 runtime failures at discovery and related endpoints.

Duende IdentityServer 8.0.4

What's changed

This is a patch release of IdentityServer that adds support for IDP-initiated SSO when IdentityServer acts as a SAML Service Provider.

New features

• IDP-initiated SSO for SAML SP: When IdentityServer acts as a SAML Service Provider (via AddSamlServiceProvider() or dynamic SAML providers), it can now receive unsolicited authentication responses from upstream identity providers. Configure AllowUnsolicitedAuthnResponse = true and set IdpInitiatedCallbackUrl to your external login callback endpoint.
• RelayState surfacing: The SAML RelayState value from IDP-initiated responses is now available in AuthenticationProperties.Items["relayState"], allowing your callback to use it for routing, tenant resolution, or other application logic.
• Configurable RelayState size limit: MaxRelayStateLength (default 1024 bytes) controls the maximum size of RelayState that will be persisted in authentication properties, preventing cookie bloat from oversized values.

Breaking changes

• SAML SP claim namespace changed: The internal claim type namespace used for SAML SP session correlation claims (SessionIndex, LogoutNameIdentifier) changed to https://duendesoftware.com/Saml2. Users with active SAML SP sessions at the time of upgrade may experience failed single logout correlation until they re-authenticate. This only affects deployments using the SAML Service Provider feature (AddSamlServiceProvider() or dynamic SAML providers).

Bug fixes

• Fixed misleading error messages in SAML SP unsolicited response handling.
• The SAML SP handler now correctly populates the scheme property in AuthenticationProperties during IDP-initiated sign-in, ensuring compatibility with IdentityServer's external login callback pattern.

Duende IdentityServer 8.0.3

What's changed

This is a patch release of identity server that fixes the following issues:

• Fixed nullable annotation on ITokenValidator.ValidateIdentityTokenAsync — the clientId parameter is now correctly annotated as nullable to match its intended usage.
• Fixed Dynamic Client Registration to allow absolute_refresh_token_lifetime of 0, which represents no expiration.

Duende IdentityServer 7.4.8

What's changed

This is a patch release of identity server that fixes the following issue:

• Fixed Dynamic Client Registration to allow absolute_refresh_token_lifetime of 0, which represents no expiration.

Duende IdentityServer 8.0.2

What's changed

• Fixed a license validation exception when using AddConfigurationStore without a license that includes the Dynamic Identity Providers feature. The EF configuration store registers an IIdentityProviderStore implementation, which incorrectly triggered a license check for Dynamic Identity Providers even when the feature was not in use.

Duende Storage 1.1.0

What's changed

• Fixed SQL Server identifier truncation that could silently truncate identifiers to 128 chars, causing potential collisions at the database level.
• Added a breadth limit to the FilterExpressionParser to prevent excessive query conditions from generating unbounded SQL subqueries.
• Fixed missing bracket-quoting ([]) in SQL Server queries generated by IUserProfileAdmin.QueryAsync.

Duende IdentityServer 8.0.1

What's changed

• Fixed session duplication issue in IdentityServer 8.0 where concurrent requests could create duplicate server-side sessions.
• Fixed nullable annotation on ITokenValidator.ValidateAccessTokenAsync — the expectedScope parameter is now correctly annotated as string? to match its intended usage.