Skip to content

deps: Bump Microsoft.Identity.Web from 4.0.1 to 4.3.0#138

Merged
leetimj merged 1 commit intomainfrom
dependabot/nuget/samples/DragonCopilot/Workflow/SampleExtension.Web/Microsoft.Identity.Web-4.3.0
Jan 14, 2026
Merged

deps: Bump Microsoft.Identity.Web from 4.0.1 to 4.3.0#138
leetimj merged 1 commit intomainfrom
dependabot/nuget/samples/DragonCopilot/Workflow/SampleExtension.Web/Microsoft.Identity.Web-4.3.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 12, 2026

Updated Microsoft.Identity.Web from 4.0.1 to 4.3.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.3.0

New features

  • Added token binding (mTLS PoP) scenario for confidential client (app-only) token acquisition and downstream API calls. See #​3622.

Dependencies updates

  • Bumped qs from 6.14.0 to 6.14.1 in /tests/DevApps/SidecarAdapter/typescript. See #​3660.

Documentation

  • Modernized Identity Web documentation, which is now can be found in docs. See #​3566.
  • Added token binding (mTLS PoP) documentation. See #​3661.

4.2.0

What's Changed

New features

  • Added CAE claims support for FIC + Managed Identity. See #​3647 for details.
  • Added AddMicrosoftIdentityMessageHandler extension methods for IHttpClientBuilder. See #​3649 for details.

Bug fixes

  • Fixed tenant not being propagated in credential FIC acquisition. See #​3633 for details.
  • Fixed ForAgentIdentity hardcoded 'AzureAd' ConfigurationSection to respect AuthenticationOptionsName. See #​3635 for details.
  • Fixed GetTokenAcquirer to propagate MicrosoftEntraApplicationOptions properties. See #​3651 for details.
  • Added meaningful error message when identity configuration is missing. See #​3637 for details.

Dependencies updates

  • Update Microsoft.Identity.Abstractions to version 10.0.0.
  • Bump express from 5.1.0 to 5.2.0 in /tests/DevApps/SidecarAdapter/typescript. #​3636
  • Bump jws from 3.2.2 to 3.2.3 in /tests/DevApps/SidecarAdapter/typescript. #​3641

Fundamentals

  • Update support policy. #​3656
  • Update agent identity coordinates in E2E tests after deauth. #​3640
  • Update E2E agent identity configuration to new tenant. #​3646

Full Changelog: AzureAD/microsoft-identity-web@4.1.1...4.2.0

4.1.1

Bug fixes

  • Authority-only configuration parsing improvements: Early parsing of Authority into Instance/TenantId and defensive fallback in PrepareAuthorityInstanceForMsal. Behavior is backward compatible; Authority is still ignored when Instance/TenantId explicitly provided—now surfaced via a warning. See #​3612.

New features

  • Added warning diagnostics for conflicting Authority vs Instance/TenantId: Emitting a single structured warning when both styles are provided. See #​3611.

Fundamentals

  • Expanded authority test matrix: Coverage for AAD (v1/v2), B2C (/tfp/ normalization, policy path), CIAM (PreserveAuthority), query parameters, scheme-less forms, and conflict scenarios. See #​3610.

4.1.0

New features

Dependencies updates

  • Bump MSAL.NET to version 4.79.2 and handle changes to deprecated WithExtraQueryParameters APIs. #​3583
  • Update Microsoft.IdentityModel and Abstractions versions. #​3604
  • Update coverlet.collector to 6.0.4. #​3587
  • Update package validation baseline version to 4.0.0. #​3589
  • Bump js-yaml from 4.1.0 to 4.1.1 in /tests/DevApps/SidecarAdapter/typescript. #​3595

Entra ID SDK sidecar

  • Restrict hosts to localhost for sidecar. #​3579
  • Update http file to match endpoints. #​3555
  • Revise sidecar issue template for Entra ID. #​3577

Documentation

  • Update README to include Entra SDK container info. #​3578

Fundamentals

  • Include NET 9.0 in template-install-dependencies. #​3593
  • Fix CodeQL alerts. #​3591
  • Suppression file is needed. #​3592

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 12, 2026

Labels

The following labels could not be found: dependencies, dotnet, sample-extension. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot force-pushed the dependabot/nuget/samples/DragonCopilot/Workflow/SampleExtension.Web/Microsoft.Identity.Web-4.3.0 branch 2 times, most recently from 00505ee to f3aba88 Compare January 13, 2026 21:28
@leetimj
Copy link
Contributor

leetimj commented Jan 14, 2026

@dependabot rebase

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/nuget/samples/DragonCopilot/Workflow/SampleExtension.Web/Microsoft.Identity.Web-4.3.0 branch from f3aba88 to fc117c8 Compare January 14, 2026 18:55
Copy link
Contributor

@leetimj leetimj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update from 4.0.1 to 4.3.0 should be fine, will need to test to ensure though.

@leetimj leetimj merged commit b5efea2 into main Jan 14, 2026
6 checks passed
@leetimj leetimj deleted the dependabot/nuget/samples/DragonCopilot/Workflow/SampleExtension.Web/Microsoft.Identity.Web-4.3.0 branch January 14, 2026 19:01
leetimj added a commit that referenced this pull request Mar 13, 2026
* added a python sample

* deps(deps): bump @inquirer/prompts in /tools/dragon-extension-cli (#117)

Bumps [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) from 7.9.0 to 7.10.0.
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@7.9.0...@inquirer/prompts@7.10.0)

---
updated-dependencies:
- dependency-name: "@inquirer/prompts"
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* updated copilot review

* Adaptive card sample updates (#121)

* Updates to the adaptive card that's generated.

* Update AdaptiveCardPayload.cs

* added audio recordings to samples (#88)

* added audio recordings to samples

* added reference to sample audio-recordings

* added reference to sample audio-recordings

* deps(deps-dev): bump @types/archiver in /tools/dragon-extension-cli (#113)

Bumps [@types/archiver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/archiver) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/archiver)

---
updated-dependencies:
- dependency-name: "@types/archiver"
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps(deps): bump glob in /tools/dragon-extension-cli (#122)

Bumps  and [glob](https://github.com/isaacs/node-glob). These dependencies needed to be updated together.

Updates `glob` from 10.4.5 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.5...v10.5.0)

Updates `glob` from 11.0.3 to 11.1.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.5...v10.5.0)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
- dependency-name: glob
  dependency-version: 11.1.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* 2473160 document update to QuickStart.md  (#134)

* 2473160 - Refreshed documentation based on creating an initial extension.

* Fix link to QUICKSTART.md in README

* Refine QUICKSTART.md for improved clarity

Updated instructions for clarity and corrected numbering.

* Adding missing images for Quickstart.md

* Adding a link and description to the quickstart guide.

* Update README.md

Updated based on copilot suggestion.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Moved quickstart link to Quickstart section.

Added a link to the QUICKSTART guide in the README.

* Added images that were missing.

* Revise Quick Start Guide for Dragon Extension Developer

Updated the Quick Start Guide to improve structure and clarity, including a new Table of Contents and revised sections for running locally and testing the extension.

* Reorganize Quick Start Guide for clarity

* Enhance Table of Contents with section descriptions

Updated the Table of Contents with additional descriptions for sections.

* Revise Quick Start Guide for Dragon Extension Developer

Updated the title and added links to Microsoft Learn documentation for better guidance.

* Revise sample script and add audio recordings reference

Updated sample script and added reference to audio recordings.

* Clarify Process API and packaging instructions

Updated links and clarified instructions for Process API and packaging.

* Moved quickstart link to Quickstart section.

Moved quick start guide reference in README.

* registering service principal images

Add files for registering service principal section to better display how to register the Microsoft.HealthPlatform SP.

* Add subscription image

Adding subscription image to use in service principal section.

* Update QUICKSTART.md with Azure registration steps

Added instructions for registering the Microsoft.HealthPlatform resource provider and creating an application in Azure.

* Clarify Service Principal registration process

Clarify the registration of the Microsoft.HealthPlatform resource provider and note that it only needs to be done once.

* Update QUICKSTART.md to utilize a block quote

Using a block quote for better emphasis for the reader to notice the comments.

Co-authored-by: Brandon Pollett <brandon.pollett@gmail.com>

---------

Co-authored-by: Timothy Lee <timothy_lee@nuance.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brandon Pollett <brandon.pollett@gmail.com>

* deps(deps): bump actions/checkout from 5 to 6 (#124)

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps: Bump Microsoft.AspNetCore.Authentication.JwtBearer from 9.0.10 to 9.0.11 (#125)

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 9.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps: Bump Microsoft.AspNetCore.OpenApi from 9.0.10 to 9.0.11 (#126)

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 9.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps(deps-dev): bump rimraf in /tools/dragon-extension-cli (#130)

Bumps [rimraf](https://github.com/isaacs/rimraf) from 6.1.0 to 6.1.2.
- [Changelog](https://github.com/isaacs/rimraf/blob/main/CHANGELOG.md)
- [Commits](isaacs/rimraf@v6.1.0...v6.1.2)

---
updated-dependencies:
- dependency-name: rimraf
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps: Bump Microsoft.Identity.Web from 4.0.1 to 4.3.0 (#138)

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* deps(deps): bump js-yaml in /tools/dragon-extension-cli (#139)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependency . These dependencies need to be updated together.


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* rewrite the README.md for the python workflow extension

* clean up md files

* updated README.md with cmds to create .venv and start python samlple server

* clean up files

* Added content table to README.md, updated output structure to accommondate the new adaptive card output version 1.6

* update the adaptive card output

* update the reason for choose python 3.12 to avoid integration issues with AIML libs

* make format consistent

* Updated code based on code review comments.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: yingding <yingdingwang@yahoo.de>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brandon Pollett <brpoll@microsoft.com>
Co-authored-by: Jim McDole <2876054+mcdolejt@users.noreply.github.com>
Co-authored-by: leetimj <250227887+leetimj@users.noreply.github.com>
Co-authored-by: Timothy Lee <timothy_lee@nuance.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brandon Pollett <brandon.pollett@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant