deps(nuget): Bump the microsoft-packages group with 2 updates

[dependabot]

Updated Microsoft.Identity.Web from 4.11.0 to 4.13.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.13.0

What's Changed

• Categorize managed-identity E2E tests and exclude them from the PR build by @​iarekk in Categorize managed-identity E2E tests and exclude them from the PR build AzureAD/microsoft-identity-web#3923
• Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult by @​neha-bhargava in Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult AzureAD/microsoft-identity-web#3904
• Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI by @​RyAuld in Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI AzureAD/microsoft-identity-web#3926
• docs: Credential architecture internals documentation by @​gladjohn in docs: Credential architecture internals documentation AzureAD/microsoft-identity-web#3886
• Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation by @​gladjohn in Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation AzureAD/microsoft-identity-web#3929
• Register IAuthorizationHeaderProvider2 in DI by @​neha-bhargava in Register IAuthorizationHeaderProvider2 in DI AzureAD/microsoft-identity-web#3927
• Bump Microsoft.Identity.Client to 4.86.0 by @​neha-bhargava in Bump Microsoft.Identity.Client to 4.86.0 AzureAD/microsoft-identity-web#3931
• Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 by @​iarekk in Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 AzureAD/microsoft-identity-web#3933
• Run missing unit test projects in the ADO PR build by @​iarekk in Run missing unit test projects in the ADO PR build AzureAD/microsoft-identity-web#3934
• Revert PRs #​3933 and #​3934: restore single-job PR pipeline by @​gladjohn with @​Copilot in Revert PRs #3933 and #3934: restore single-job PR pipeline AzureAD/microsoft-identity-web#3936

Full Changelog: AzureAD/microsoft-identity-web@4.12.2...4.13.0

4.12.2

Bug fixes

• Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

• Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

• Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
• Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

• Build the solution in the PR pipeline before running tests. See #​3911.
• Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
• Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

• Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
• Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

• Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

• Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
• Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
• Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

Commits viewable in compare view.

Updated Microsoft.ML.OnnxRuntime from 1.27.0 to 1.27.1.

Release notes

Sourced from Microsoft.ML.OnnxRuntime's releases.

1.27.1

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#​28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#​29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#​29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#​29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#​29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#​29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#​29450)
• Upgraded to Xcode 26 (#​29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#​29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#​29609)

Contributors

Thanks to our 8 contributors for this release!

@​tianleiwu, @​chilo-ms, @​edgchen1, @​adrastogi, @​damdoo01-arm, @​JonathanC-ARM, @​martin-klacer-arm, @​sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions