Skip to content

Bump the all-updates group with 3 updates#74

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/MX.TravelItinerary.Web/all-updates-fc3cb21a87
Closed

Bump the all-updates group with 3 updates#74
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/MX.TravelItinerary.Web/all-updates-fc3cb21a87

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web from 4.11.0 to 4.12.2.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.12.2

Bug fixes

  • Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

  • Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

  • Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
  • Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

  • Build the solution in the PR pipeline before running tests. See #​3911.
  • Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
  • Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

  • Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
  • Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

  • Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

  • Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
  • Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
  • Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

Commits viewable in compare view.

Updated Microsoft.Identity.Web.UI from 4.11.0 to 4.12.2.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.12.2

Bug fixes

  • Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

  • Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

  • Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
  • Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

  • Build the solution in the PR pipeline before running tests. See #​3911.
  • Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
  • Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

  • Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
  • Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

  • Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

  • Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
  • Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
  • Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

Commits viewable in compare view.

Updated MX.Observability.ApplicationInsights.AspNetCore from 1.1.16 to 1.1.24.

Release notes

Sourced from MX.Observability.ApplicationInsights.AspNetCore's releases.

1.1.24

What's Changed

Full Changelog: frasermolyneux/observability-appinsights@v1.1.22...v1.1.24

1.1.22

Full Changelog: frasermolyneux/observability-appinsights@v1.1.16...v1.1.22

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all-updates group with 3 updates
39384fd 
Bumps Microsoft.Identity.Web from 4.11.0 to 4.12.2
Bumps Microsoft.Identity.Web.UI from 4.11.0 to 4.12.2
Bumps MX.Observability.ApplicationInsights.AspNetCore from 1.1.16 to 1.1.24

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
  dependency-version: 4.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: Microsoft.Identity.Web.UI
  dependency-version: 4.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-updates
- dependency-name: MX.Observability.ApplicationInsights.AspNetCore
  dependency-version: 1.1.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 5, 2026
@dependabot dependabot Bot mentioned this pull request Jul 5, 2026
Closed
@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 3 package(s) with unknown licenses.
See the Details below.

License Issues

src/MX.TravelItinerary.Web/MX.TravelItinerary.Web.csproj

PackageVersionLicenseIssue Type
MX.Observability.ApplicationInsights.AspNetCore1.1.24NullUnknown License
Microsoft.Identity.Web4.12.2NullUnknown License
Microsoft.Identity.Web.UI4.12.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
nuget/MX.Observability.ApplicationInsights.AspNetCore 1.1.24 UnknownUnknown
nuget/Microsoft.Identity.Web 4.12.2 UnknownUnknown
nuget/Microsoft.Identity.Web.UI 4.12.2 UnknownUnknown

Scanned Files

  • src/MX.TravelItinerary.Web/MX.TravelItinerary.Web.csproj

@github-actions
github-actions Bot enabled auto-merge (squash) July 5, 2026 03:49
@dependabot
dependabot Bot temporarily deployed to Development July 5, 2026 03:50 Inactive
@github-actions

github-actions Bot commented Jul 5, 2026

Copy link
Copy Markdown

🏗️ Terraform Plan

🌍 Environment: dev

✅ Validate — Passed

✅ Plan

Count
➕ Add 29
📋 Resource Details
Action Resource
➕ Create azuread_application.web
➕ Create azuread_application_password.web
➕ Create azuread_service_principal.web
➕ Create azurerm_app_service_certificate_binding.primary
➕ Create azurerm_app_service_custom_hostname_binding.primary
➕ Create azurerm_app_service_managed_certificate.primary
➕ Create azurerm_application_insights.ai
➕ Create azurerm_dns_cname_record.web_app
➕ Create azurerm_dns_txt_record.app_service_verification
➕ Create azurerm_key_vault.kv
➕ Create azurerm_key_vault_secret.google_maps_api_key
➕ Create azurerm_linux_web_app.app
➕ Create azurerm_role_assignment.deploy_kv_secrets_officer
➕ Create azurerm_role_assignment.web_app_kv_secrets_user
➕ Create azurerm_role_assignment.web_table_data_contributor
➕ Create azurerm_storage_account.data
➕ Create azurerm_storage_table.tables["bookings"]
➕ Create azurerm_storage_table.tables["itinerary_entries"]
➕ Create azurerm_storage_table.tables["saved_share_links"]
➕ Create azurerm_storage_table.tables["share_links"]
➕ Create azurerm_storage_table.tables["trip_access"]
➕ Create azurerm_storage_table.tables["trips"]
➕ Create google_apikeys_key.maps
➕ Create google_project_service.maps_backend
➕ Create google_project_service.places_api
➕ Create random_id.environment_id
➕ Create random_id.storage
➕ Create time_rotating.thirty_days
➕ Create time_sleep.wait_for_hostname_binding

@sonarqubecloud

sonarqubecloud Bot commented Jul 5, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot @github

dependabot Bot commented on behalf of github Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #75.

@dependabot dependabot Bot closed this Jul 12, 2026
auto-merge was automatically disabled July 12, 2026 03:49

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/nuget/src/MX.TravelItinerary.Web/all-updates-fc3cb21a87 branch July 12, 2026 03:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@frasermolyneux frasermolyneux

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@frasermolyneux