Bump Microsoft.Identity.Web from 4.3.0 to 4.5.0

[dependabot]

Updated Microsoft.Identity.Web from 4.3.0 to 4.5.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.4.0

New features

• Add AOT-compatible web API authentication for .NET 10+. See #​3705 and #​3664.
• Propagate long-running web API session key back to callers in user token acquisition. See #​3728.
• Add OBO event initialization for OBO APIs. See #​3724.
• Add support for calling WithClientClaims flow for token acquisition. See #​3623.
• Add OnBeforeTokenAcquisitionForOnBehalfOf event. See #​3680.

Bug fixes

• Throw InvalidOperationException with actionable message when a custom credential is not registered. See #​3626.
• Fix event firing for InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync. See #​3717.
• Update OnBeforeTokenAcquisitionForOnBehalfOf to construct ClaimsPrincipal from token. See #​3714.
• Add a retry counter for acquire token and updated tests with a fake secret. See #​3682.
• Fix OBO user error handling. See #​3712.
• Fix override merging for app token (and others). See #​3644.
• Fix certificate reload logic to only trigger on certificate-specific errors. See #​3653.
• Update ROPC flow CCA to pass SendX5C to MSAL. See #​3671.

Dependencies updates

• Bump qs in /tests/DevApps/SidecarAdapter/typescript. See #​3725.
• Downgrade Microsoft.Extensions.Configuration.Binder to 2.1.0 on .NET Framework. See #​3730.
• Update .NET SDK to 10.0.103 to address DOTNET-Security-10.0 vulnerability. See #​3726.
• Upgrade to Microsoft.Identity.Abstractions 11 for AoT compatibility. See #​3699.
• Update to MSAL 4.81.0. See #​3665.

Documentation

• Add documentation for auto-generated session key for long-running OBO session. See #​3729.
• Improve the Aspire doc article and skills. See #​3695.
• Add an article and agent skill to add Entra ID to an Aspire app. See #​3689.
• Fix misleading comment in CertificatelessOptions.ManagedIdentityClientId. See #​3667.
• Add Copilot explore tool functionality. See #​3694.

Fundamentals

• Remove unnecessary warning suppression. See #​3715.
• Migrate labs to Lab.API 2.x (first pass). See #​3710.
• Update Sidecar E2E test constants. See #​3693.
• Fix intermittent failures in CertificatesObserverTests. See #​3687.
• Add validation baseline exclusions. See #​3684.
• Add dSTS integration tests. See #​3677.
• Fix FIC test. See #​3663.
• Update IdentityWeb version, build logic, and validation. See #​3659.

New Contributors

• @​XiaoxinMS2 made their first contribution in Add dSTS integration tests AzureAD/microsoft-identity-web#3677
• @​RyAuld made their first contribution in Fix intermittent failures in CertificatesObserverTests AzureAD/microsoft-identity-web#3687
• @​agocke made their first contribution in Update AOT annotations AzureAD/microsoft-identity-web#3664
• @​MZOLN made their first contribution in Remove unnecessary flag switch that causes official build to break. AzureAD/microsoft-identity-web#3700
• @​christian-posta made their first contribution in Fix override merging for app token (and others) AzureAD/microsoft-identity-web#3644
• @​4gust made their first contribution in Added retry counter for acquire token and modified added a test with … AzureAD/microsoft-identity-web#3682
• @​rayluo made their first contribution in Update OnBeforeTokenAcquisitionForOnBehalfOf event to construct ClaimsPricipal from token AzureAD/microsoft-identity-web#3714

4.4.0-preview.1

New features

• Add AOT-compatible web API authentication for .NET 10+. See #​3705 and #​3664.
• Propagate long-running web API session key back to callers in user token acquisition. See #​3728.
• Add OBO event initialization for OBO APIs. See #​3724.
• Add support for calling WithClientClaims flow for token acquisition. See #​3623.
• Add OnBeforeTokenAcquisitionForOnBehalfOf event. See #​3680.

Bug fixes

• Throw InvalidOperationException with actionable message when a custom credential is not registered. See #​3626.
• Fix event firing for InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync. See #​3717.
• Update OnBeforeTokenAcquisitionForOnBehalfOf to construct ClaimsPrincipal from token. See #​3714.
• Add a retry counter for acquire token and updated tests with a fake secret. See #​3682.
• Fix OBO user error handling. See #​3712.
• Fix override merging for app token (and others). See #​3644.
• Fix certificate reload logic to only trigger on certificate-specific errors. See #​3653.
• Update ROPC flow CCA to pass SendX5C to MSAL. See #​3671.

Dependencies updates

• Bump qs in /tests/DevApps/SidecarAdapter/typescript. See #​3725.
• Downgrade Microsoft.Extensions.Configuration.Binder to 2.1.0 on .NET Framework. See #​3730.
• Update .NET SDK to 10.0.103 to address DOTNET-Security-10.0 vulnerability. See #​3726.
• Upgrade to Microsoft.Identity.Abstractions 11 for AoT compatibility. See #​3699.
• Update to MSAL 4.81.0. See #​3665.

Documentation

• Add documentation for auto-generated session key for long-running OBO session. See #​3729.
• Improve the Aspire doc article and skills. See #​3695.
• Add an article and agent skill to add Entra ID to an Aspire app. See #​3689.
• Fix misleading comment in CertificatelessOptions.ManagedIdentityClientId. See #​3667.
• Add Copilot explore tool functionality. See #​3694.

Fundamentals

• Remove unnecessary warning suppression. See #​3715.
• Migrate labs to Lab.API 2.x (first pass). See #​3710.
• Update Sidecar E2E test constants. See #​3693.
• Fix intermittent failures in CertificatesObserverTests. See #​3687.
• Add validation baseline exclusions. See #​3684.
• Add dSTS integration tests. See #​3677.
• Fix FIC test. See #​3663.
• Update IdentityWeb version, build logic, and validation. See #​3659.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)