deps(nuget): Bump the microsoft-packages group with 5 updates

[dependabot]

Updated Microsoft.Identity.Web from 4.14.2 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.22.0 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.23.0

What's Changed

• Backport configurable SHR p claim path comparison to 8.x by @​debchoudhury-id4s in Backport configurable SHR p claim path comparison to 8.x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3577
• Backport SHR p-claim percent-encoding hex case handling to dev8x by @​debchoudhury-id4s in Backport SHR p-claim percent-encoding hex case handling to dev8x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3579
• Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package by @​iNinja in Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3547
• Include WS-Trust in build pipelines by @​iNinja in Include WS-Trust in build pipelines AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3604
• Log IDX10650 decryption-tag failures below Error during multi-key decryption by @​RojaEnnam in Log IDX10650 decryption-tag failures below Error during multi-key decryption AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3582
• Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in Support ML-DSA AKP keys in JsonWebKeySet AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3597
• Add Composite ML-DSA support (internal, gated) by @​iNinja in Add Composite ML-DSA support (internal, gated) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3596

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 8.22.0 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.23.0

What's Changed

• Backport configurable SHR p claim path comparison to 8.x by @​debchoudhury-id4s in Backport configurable SHR p claim path comparison to 8.x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3577
• Backport SHR p-claim percent-encoding hex case handling to dev8x by @​debchoudhury-id4s in Backport SHR p-claim percent-encoding hex case handling to dev8x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3579
• Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package by @​iNinja in Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3547
• Include WS-Trust in build pipelines by @​iNinja in Include WS-Trust in build pipelines AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3604
• Log IDX10650 decryption-tag failures below Error during multi-key decryption by @​RojaEnnam in Log IDX10650 decryption-tag failures below Error during multi-key decryption AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3582
• Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in Support ML-DSA AKP keys in JsonWebKeySet AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3597
• Add Composite ML-DSA support (internal, gated) by @​iNinja in Add Composite ML-DSA support (internal, gated) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3596

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.10.1

What's Changed

• Isolate code coverage files in published output by @​azat-msft in [rel/18.10] Isolate code coverage files in published output microsoft/vstest#16476

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 8.22.0 to 8.23.0.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

8.23.0

What's Changed

• Backport configurable SHR p claim path comparison to 8.x by @​debchoudhury-id4s in Backport configurable SHR p claim path comparison to 8.x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3577
• Backport SHR p-claim percent-encoding hex case handling to dev8x by @​debchoudhury-id4s in Backport SHR p-claim percent-encoding hex case handling to dev8x AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3579
• Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package by @​iNinja in Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3547
• Include WS-Trust in build pipelines by @​iNinja in Include WS-Trust in build pipelines AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3604
• Log IDX10650 decryption-tag failures below Error during multi-key decryption by @​RojaEnnam in Log IDX10650 decryption-tag failures below Error during multi-key decryption AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3582
• Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in Support ML-DSA AKP keys in JsonWebKeySet AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3597
• Add Composite ML-DSA support (internal, gated) by @​iNinja in Add Composite ML-DSA support (internal, gated) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3596

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 093c3279-6b83-4923-bf5c-ad5274b229b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}