Skip to content

chore: Bump the minor-and-patch group with 5 updates - #576

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/minor-and-patch-6a50511793
Closed

chore: Bump the minor-and-patch group with 5 updates#576
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/minor-and-patch-6a50511793

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.IdentityModel.Tokens from 8.19.2 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.23.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

Commits viewable in compare view.

Updated Microsoft.SourceLink.GitHub from 10.0.303 to 10.0.403.

Release notes

Sourced from Microsoft.SourceLink.GitHub's releases.

10.0.403

You can build .NET 10.0 from the repository by cloning the release tag v10.0.403 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.402

You can build .NET 10.0 from the repository by cloning the release tag v10.0.402 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.401

Release

What's Changed

... (truncated)

10.0.400

You can build .NET 10.0 from the repository by cloning the release tag v10.0.400 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 7.5.1 to 7.7.3.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

7.7.3

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@7.7.2...7.7.3

7.7.2

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.
  • Improve validation of jku claim. See PR #​3480.

Dependency Updates

  • Update System.Text.Json to 8.0.5 on all target frameworks except .NET 461. See PR #​3499.

7.7.1

7.7.1

Bug Fix

  • Re-add JsonSerializerPrimitives.TryAllStringClaimsAsDateTime which was removed as it is in an internal class, but due to InternalsVisibleTo can lead to a MissingMethodException if IdentityModel versions are not aligned. See PR #​2734 for details.

7.7.0

7.7.0

CVE package updates

CVE-2024-30105

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2715 for details.

Performance improvement

7.6.2

7.6.2

Bug Fix:

  • Revert reduced allocations in AadIssuerValidator by not using string.Replace where appropriate due to an index out-of-range error.

7.6.1

7.6.1

New Features:

  • Add missing metadata parameters to OpenIdConnectConfiguration. See issue #​2498 for details.

Bug Fixes:

  • Fix over-reporting of IDX14100. See issue #​2058 and PR #​2618 for details.
  • JwtRegisteredClaimNames now contains previously missing Standard OpenIdConnect claims. See issue #​1598 for details.

Performance Improvements:

  • Reduced allocations in AadIssuerValidator by not using string.Replace where appropriate. See issue #​2595 and PR #​2597 for more details.
  • No longer for every string claim, calling DateTime.TryParse on each value, whether it is expected to be a DateTime or not. See issue #​2615 for details.

7.6.0

7.6.0

New Features:

  • Update JsonWebToken - extract and expose the method that reads the header/payload property values from the reader so it can be overridden in children classes to add any extra own logic. See issues #​2581, #​2583, and #​2495 for details.

Bug Fixes:

  • JWE header algorithm is now compliant to IANA document. See issue #​2089 for details.

Performance Improvements:

  • Reduce the number of internal array allocations that need to happen for each claim set, see PR #​2596.

Fundamentals:

  • Add an AOT compatibility check on each PR to ensure only AOT compatible code is checked-in. See PR #​2598.
  • Update perl scrip for OneBranch build. See PR #​2602.
  • Add langversion 12 to benchmark tests. See PR #​2601.
  • Removed unused build.cmd file. See PR #​2605.
  • Create CodeQL exclusions file. See PR #​2609.
  • Fix variable usage in AOT script. See PR #​2610.
  • Move Microsoft.IdentityModel.Tokens delegates to a new file. See PR #​2606

7.5.2

7.5.2

Bug Fixes:

  • Validate authentication tag length so a JWE with appended characters will not be considered a valid token. See issues #​2201, #​1641, PR #​2569, and IDX10625 Wiki for details. By @​kellyyangsong

Fundamentals:

  • App Context Switches in Identity Model 7x are now documented here. By @​kellyyangsong

Performance Improvements:

  • In .NET 6 or greater, use a temporary buffer to reduce intermediate allocation in VerifyRsa/VerifyECDsa. See PR #​2589 for more details. By @​eerhardt
  • Reduce allocations in ValidateSignature by using a collection expression instead of new List<SecurityKey> { key }, to optimize for the single element case. See PR #​2586 for more details. By @​eerhardt
  • Remove Task allocation in AadIssuerValidator. See PR #​2584 for more details. By @​eerhardt

Commits viewable in compare view.

Updated System.Text.Json from 8.0.5 to 8.0.6.

Release notes

Sourced from System.Text.Json's releases.

8.0.6

Release

Commits viewable in compare view.

Updated Websocket.Client from 5.5.0 to 5.5.1.

Release notes

Sourced from Websocket.Client's releases.

5.5.1

What's Changed

  • Fixed missing DisconnectionHappened notifications when ClientWebSocket rejects an invalid close frame, such as close status 1100. The client now emits exactly one DisconnectionType.Lost notification with the original WebSocketException, whether automatic reconnection is enabled or disabled. Fixes #​160 via #​161.
  • Preserved CancelReconnection, normal server-initiated closing, and CancelClosing behavior without duplicate disconnection notifications.
  • Added seven regression cases using real WebSocket connections and raw close frames.
  • Stabilized existing tests: wait for the server greeting before injecting fake messages, and verify the final connection after rapid reconnects without depending on greetings from sockets that were immediately closed.
  • Switched NuGet publishing to Trusted Publishing with short-lived OIDC credentials.

Compatibility and Validation

  • No public API changes or changes to supported target frameworks: .NET Standard 2.0/2.1 and .NET 6/7/8/9/10.
  • All 58 tests passed in GitHub Actions, alongside the .NET Framework 4.7.2 sample and benchmark builds on Windows.
  • Local Release solution build completed with zero warnings or errors. The corrected rapid-reconnect test also passed ten consecutive runs.
  • Websocket.Client 5.5.1 is available on NuGet. The downloaded package's NuGet.org repository signature was verified with dotnet nuget verify --all.

Full changelog: Marfusios/websocket-client@v5.5...v5.5.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: Bump the minor-and-patch group with 5 updates
be4cad6 
Bumps Microsoft.IdentityModel.Tokens from 8.19.2 to 8.23.0
Bumps Microsoft.SourceLink.GitHub from 10.0.303 to 10.0.403
Bumps System.IdentityModel.Tokens.Jwt from 7.5.1 to 7.7.3
Bumps System.Text.Json from 8.0.5 to 8.0.6
Bumps Websocket.Client from 5.5.0 to 5.5.1

---
updated-dependencies:
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.403
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 7.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.Text.Json
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Websocket.Client
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #577.

@dependabot dependabot Bot closed this Oct 27, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/minor-and-patch-6a50511793 branch October 27, 2026 10:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants