Bump the azure-identity group with 3 updates

[dependabot]

Updated Microsoft.AspNetCore.Authentication.OpenIdConnect from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.OpenIdConnect's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.14.2 to 4.16.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.16.0

What's Changed

• Add 4.15.0 release notes by @​iarekk in Add 4.15.0 release notes AzureAD/microsoft-identity-web#4050
• Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in Post-release 4.15.0: mark APIs shipped and bump version AzureAD/microsoft-identity-web#4060
• Add Sidecar 1.1.2 changelog by @​soodt in Add Sidecar 1.1.2 changelog AzureAD/microsoft-identity-web#4070
• Fix FIC telemetry enrichment during credential warm-up and assertion cache hits by @​neha-bhargava in Fix FIC telemetry enrichment during credential warm-up and assertion cache hits AzureAD/microsoft-identity-web#4072
• Update agentic docs to cover current behavior by @​Avery-Dunn in Update agentic docs to cover current behavior AzureAD/microsoft-identity-web#4077
• Bump the notsecurity group with 4 updates by @​dependabot[bot] in Bump the notsecurity group with 4 updates AzureAD/microsoft-identity-web#4074

Full Changelog: AzureAD/microsoft-identity-web@4.15.0...4.16.0

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.Identity.Web.UI from 4.14.2 to 4.16.0.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.16.0

What's Changed

• Add 4.15.0 release notes by @​iarekk in Add 4.15.0 release notes AzureAD/microsoft-identity-web#4050
• Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in Post-release 4.15.0: mark APIs shipped and bump version AzureAD/microsoft-identity-web#4060
• Add Sidecar 1.1.2 changelog by @​soodt in Add Sidecar 1.1.2 changelog AzureAD/microsoft-identity-web#4070
• Fix FIC telemetry enrichment during credential warm-up and assertion cache hits by @​neha-bhargava in Fix FIC telemetry enrichment during credential warm-up and assertion cache hits AzureAD/microsoft-identity-web#4072
• Update agentic docs to cover current behavior by @​Avery-Dunn in Update agentic docs to cover current behavior AzureAD/microsoft-identity-web#4077
• Bump the notsecurity group with 4 updates by @​dependabot[bot] in Bump the notsecurity group with 4 updates AzureAD/microsoft-identity-web#4074

Full Changelog: AzureAD/microsoft-identity-web@4.15.0...4.16.0

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.