deps: Bump Microsoft.Identity.Client from 4.86.0 to 4.90.1

[dependabot]

Updated Microsoft.Identity.Client from 4.86.0 to 4.90.1.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.90.1

New Features

• Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #​6165

Bug Fixes

• Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #​6165
• Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #​6155
• Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #​6200

Changes

• Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #​6202

4.90.0

Changes

• Updated the KeyGuardAttestation package version to 1.1.7. #​6189

4.89.0

What's Changed

• Add repository guidance for AI agents by @​bgavrilMS in Add repository guidance for AI agents AzureAD/microsoft-authentication-library-for-dotnet#6158
• Add Linux Attested Managed Identity Flow documentation by @​gladjohn in Add Linux Attested Managed Identity Flow documentation AzureAD/microsoft-authentication-library-for-dotnet#6149
• Remove internal authority example from API docs by @​bgavrilMS in Remove internal authority example from API docs AzureAD/microsoft-authentication-library-for-dotnet#6170
• Update SNI MTLS PoP Token Design documentation by @​bgavrilMS in Update SNI MTLS PoP Token Design documentation AzureAD/microsoft-authentication-library-for-dotnet#6171
• Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate by @​gladjohn in Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate AzureAD/microsoft-authentication-library-for-dotnet#6167
• Revise mTLS PoP acceptance-test matrix structure by @​gladjohn in Revise mTLS PoP acceptance-test matrix structure AzureAD/microsoft-authentication-library-for-dotnet#6161
• Add ICloudConfiguration for cross-cloud metadata resolution by @​Avery-Dunn in Add ICloudConfiguration for cross-cloud metadata resolution AzureAD/microsoft-authentication-library-for-dotnet#6104
• Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by @​Robbie-Microsoft in Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry AzureAD/microsoft-authentication-library-for-dotnet#6173
• Always record RawStsErrorCode on MsalFailure metric by @​ssmelov in Always record RawStsErrorCode on MsalFailure metric AzureAD/microsoft-authentication-library-for-dotnet#6175
• Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by @​Robbie-Microsoft in Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity AzureAD/microsoft-authentication-library-for-dotnet#6178
• Add timeout for managed identity capability discovery by @​Robbie-Microsoft in Add timeout for managed identity capability discovery AzureAD/microsoft-authentication-library-for-dotnet#6181
• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

New Contributors

• @​danfiedler-msft made their first contribution in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.89.0

4.88.0

New Features

• Added user-assigned managed identity support for Azure Arc, including selecting the identity by client ID and validating the identity returned in the token response. #​6128
• Added WithRequestOverMtls() to managed identity token requests, enabling attested bearer-token acquisition over the IMDSv2 mTLS transport. #​6086

Bug Fixes

• Fixed token-cache key collisions by length-prefixing additional cache-key components before hashing. #​6137
• Populated authentication-result telemetry metadata on proactive background-refresh results. #​6157
• Fixed mTLS PoP authority validation incorrectly rejecting sovereign-cloud aliases such as login.chinacloudapi.cn and login.usgovcloudapi.net. #​6153

4.87.0

What's Changed

• Expose MsalServiceException.ErrorCodesForLogging for diagnostics in #​6138
• Expose WithOtelTagsEnricher for managed identity requests in #​6144
• Forward OpenTelemetry tags enricher to the client-assertion callback in #​6142
• Add client-side opaque-token log scrubber in #​6119
• Populate ExecutionResult.Exception for non-MSAL failures in #​6139
• Use PSS padding in KeyGuard liveness probe (CodeQL SM03799) in #​6141
• Remove managed identity support from WithClaimsFromClient (confidential-client only) in #​6113
• Remove experimental features from client setup in #​6143
• Update Azure Arc managed identity API version from 2019-11-01 to 2020-06-01 in #​6130

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.86.1...4.87.0

4.86.1

Bug Fixes

• Fixed the mTLS Proof-of-Possession token cache to key on the certificate's full DER (x5t#S256) instead of only the public key, preventing a stale token (and AADSTS500181) after a same-key certificate renewal. #​6123
• Fell back to RS256 when a certificate's PSS signing operation is rejected by RSACryptoServiceProvider, rebuilding the client assertion so authentication can proceed. #​6126
• Detect and reject symbolic links in the Unix cache-file write path (lstat pre-check plus O_NOFOLLOW), closing a TOCTOU window. #​6115
• Corrected misleading "region required" error messages and doc comments in the mTLS PoP flow. #​6127

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: joshsmithxrm/power-platform-developer-suite/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6f53ad34-ca40-4685-81df-8f4c5c022fd0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #1440.