Skip to content

chore: Bump Microsoft.IdentityModel.Tokens and 4 others - #577

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/minor-and-patch-ae5f69c944
Closed

chore: Bump Microsoft.IdentityModel.Tokens and 4 others#577
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/minor-and-patch-ae5f69c944

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pinned Microsoft.IdentityModel.Tokens at 6.36.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

6.36.0

6.36.0

CVE package updates

CVE-2024-30105

New feature

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2710 for details.

Fundamentals

  • Update signing info for NuGet packages. See PR #​2696 for details.

6.35.0

Bug Fix

  • fix AadIssuerValidator's handling of trailing forward slashes. See issue [#​2415] for more details.

Feature

  • Adds an AppContext switch to control HMAC key size verification. See #​2421 for more details.

Commits viewable in compare view.

Pinned Microsoft.IdentityModel.Tokens at 7.7.3.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

7.7.3

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@7.7.2...7.7.3

7.7.2

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.
  • Improve validation of jku claim. See PR #​3480.

Dependency Updates

  • Update System.Text.Json to 8.0.5 on all target frameworks except .NET 461. See PR #​3499.

7.7.1

7.7.1

Bug Fix

  • Re-add JsonSerializerPrimitives.TryAllStringClaimsAsDateTime which was removed as it is in an internal class, but due to InternalsVisibleTo can lead to a MissingMethodException if IdentityModel versions are not aligned. See PR #​2734 for details.

7.7.0

7.7.0

CVE package updates

CVE-2024-30105

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2715 for details.

Performance improvement

7.6.2

7.6.2

Bug Fix:

  • Revert reduced allocations in AadIssuerValidator by not using string.Replace where appropriate due to an index out-of-range error.

7.6.1

7.6.1

New Features:

  • Add missing metadata parameters to OpenIdConnectConfiguration. See issue #​2498 for details.

Bug Fixes:

  • Fix over-reporting of IDX14100. See issue #​2058 and PR #​2618 for details.
  • JwtRegisteredClaimNames now contains previously missing Standard OpenIdConnect claims. See issue #​1598 for details.

Performance Improvements:

  • Reduced allocations in AadIssuerValidator by not using string.Replace where appropriate. See issue #​2595 and PR #​2597 for more details.
  • No longer for every string claim, calling DateTime.TryParse on each value, whether it is expected to be a DateTime or not. See issue #​2615 for details.

7.6.0

7.6.0

New Features:

  • Update JsonWebToken - extract and expose the method that reads the header/payload property values from the reader so it can be overridden in children classes to add any extra own logic. See issues #​2581, #​2583, and #​2495 for details.

Bug Fixes:

  • JWE header algorithm is now compliant to IANA document. See issue #​2089 for details.

Performance Improvements:

  • Reduce the number of internal array allocations that need to happen for each claim set, see PR #​2596.

Fundamentals:

  • Add an AOT compatibility check on each PR to ensure only AOT compatible code is checked-in. See PR #​2598.
  • Update perl scrip for OneBranch build. See PR #​2602.
  • Add langversion 12 to benchmark tests. See PR #​2601.
  • Removed unused build.cmd file. See PR #​2605.
  • Create CodeQL exclusions file. See PR #​2609.
  • Fix variable usage in AOT script. See PR #​2610.
  • Move Microsoft.IdentityModel.Tokens delegates to a new file. See PR #​2606

7.5.2

7.5.2

Bug Fixes:

  • Validate authentication tag length so a JWE with appended characters will not be considered a valid token. See issues #​2201, #​1641, PR #​2569, and IDX10625 Wiki for details. By @​kellyyangsong

Fundamentals:

  • App Context Switches in Identity Model 7x are now documented here. By @​kellyyangsong

Performance Improvements:

  • In .NET 6 or greater, use a temporary buffer to reduce intermediate allocation in VerifyRsa/VerifyECDsa. See PR #​2589 for more details. By @​eerhardt
  • Reduce allocations in ValidateSignature by using a collection expression instead of new List<SecurityKey> { key }, to optimize for the single element case. See PR #​2586 for more details. By @​eerhardt
  • Remove Task allocation in AadIssuerValidator. See PR #​2584 for more details. By @​eerhardt

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens from 8.19.2 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.23.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

Commits viewable in compare view.

Updated Microsoft.SourceLink.GitHub from 10.0.303 to 10.0.403.

Release notes

Sourced from Microsoft.SourceLink.GitHub's releases.

10.0.403

You can build .NET 10.0 from the repository by cloning the release tag v10.0.403 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.402

You can build .NET 10.0 from the repository by cloning the release tag v10.0.402 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.401

Release

What's Changed

... (truncated)

10.0.400

You can build .NET 10.0 from the repository by cloning the release tag v10.0.400 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Pinned System.IdentityModel.Tokens.Jwt at 6.36.0.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

6.36.0

6.36.0

CVE package updates

CVE-2024-30105

New feature

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2710 for details.

Fundamentals

  • Update signing info for NuGet packages. See PR #​2696 for details.

6.35.0

Bug Fix

  • fix AadIssuerValidator's handling of trailing forward slashes. See issue [#​2415] for more details.

Feature

  • Adds an AppContext switch to control HMAC key size verification. See #​2421 for more details.

Commits viewable in compare view.

Pinned System.IdentityModel.Tokens.Jwt at 7.7.3.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

7.7.3

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@7.7.2...7.7.3

7.7.2

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.
  • Improve validation of jku claim. See PR #​3480.

Dependency Updates

  • Update System.Text.Json to 8.0.5 on all target frameworks except .NET 461. See PR #​3499.

7.7.1

7.7.1

Bug Fix

  • Re-add JsonSerializerPrimitives.TryAllStringClaimsAsDateTime which was removed as it is in an internal class, but due to InternalsVisibleTo can lead to a MissingMethodException if IdentityModel versions are not aligned. See PR #​2734 for details.

7.7.0

7.7.0

CVE package updates

CVE-2024-30105

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Opt in to the new behavior via an AppContext switch. See PR #​2715 for details.

Performance improvement

7.6.2

7.6.2

Bug Fix:

  • Revert reduced allocations in AadIssuerValidator by not using string.Replace where appropriate due to an index out-of-range error.

7.6.1

7.6.1

New Features:

  • Add missing metadata parameters to OpenIdConnectConfiguration. See issue #​2498 for details.

Bug Fixes:

  • Fix over-reporting of IDX14100. See issue #​2058 and PR #​2618 for details.
  • JwtRegisteredClaimNames now contains previously missing Standard OpenIdConnect claims. See issue #​1598 for details.

Performance Improvements:

  • Reduced allocations in AadIssuerValidator by not using string.Replace where appropriate. See issue #​2595 and PR #​2597 for more details.
  • No longer for every string claim, calling DateTime.TryParse on each value, whether it is expected to be a DateTime or not. See issue #​2615 for details.

7.6.0

7.6.0

New Features:

  • Update JsonWebToken - extract and expose the method that reads the header/payload property values from the reader so it can be overridden in children classes to add any extra own logic. See issues #​2581, #​2583, and #​2495 for details.

Bug Fixes:

  • JWE header algorithm is now compliant to IANA document. See issue #​2089 for details.

Performance Improvements:

  • Reduce the number of internal array allocations that need to happen for each claim set, see PR #​2596.

Fundamentals:

  • Add an AOT compatibility check on each PR to ensure only AOT compatible code is checked-in. See PR #​2598.
  • Update perl scrip for OneBranch build. See PR #​2602.
  • Add langversion 12 to benchmark tests. See PR #​2601.
  • Removed unused build.cmd file. See PR #​2605.
  • Create CodeQL exclusions file. See PR #​2609.
  • Fix variable usage in AOT script. See PR #​2610.
  • Move Microsoft.IdentityModel.Tokens delegates to a new file. See PR #​2606

7.5.2

7.5.2

Bug Fixes:

  • Validate authentication tag length so a JWE with appended characters will not be considered a valid token. See issues #​2201, #​1641, PR #​2569, and IDX10625 Wiki for details. By @​kellyyangsong

Fundamentals:

  • App Context Switches in Identity Model 7x are now documented here. By @​kellyyangsong

Performance Improvements:

  • In .NET 6 or greater, use a temporary buffer to reduce intermediate allocation in VerifyRsa/VerifyECDsa. See PR #​2589 for more details. By @​eerhardt
  • Reduce allocations in ValidateSignature by using a collection expression instead of new List<SecurityKey> { key }, to optimize for the single element case. See PR #​2586 for more details. By @​eerhardt
  • Remove Task allocation in AadIssuerValidator. See PR #​2584 for more details. By @​eerhardt

Commits viewable in compare view.

Updated System.Text.Json from 8.0.5 to 8.0.6.

Release notes

Sourced from System.Text.Json's releases.

8.0.6

Release

Commits viewable in compare view.

Pinned Websocket.Client at 5.5.1.

Release notes

Sourced from Websocket.Client's releases.

5.5.1

What's Changed

  • Fixed missing DisconnectionHappened notifications when ClientWebSocket rejects an invalid close frame, such as close status 1100. The client now emits exactly one DisconnectionType.Lost notification with the original WebSocketException, whether automatic reconnection is enabled or disabled. Fixes #​160 via #​161.
  • Preserved CancelReconnection, normal server-initiated closing, and CancelClosing behavior without duplicate disconnection notifications.
  • Added seven regression cases using real WebSocket connections and raw close frames.
  • Stabilized existing tests: wait for the server greeting before injecting fake messages, and verify the final connection after rapid reconnects without depending on greetings from sockets that were immediately closed.
  • Switched NuGet publishing to Trusted Publishing with short-lived OIDC credentials.

Compatibility and Validation

  • No public API changes or changes to supported target frameworks: .NET Standard 2.0/2.1 and .NET 6/7/8/9/10.
  • All 58 tests passed in GitHub Actions, alongside the .NET Framework 4.7.2 sample and benchmark builds on Windows.
  • Local Release solution build completed with zero warnings or errors. The corrected rapid-reconnect test also passed ten consecutive runs.
  • Websocket.Client 5.5.1 is available on NuGet. The downloaded package's NuGet.org repository signature was verified with dotnet nuget verify --all.

Full changelog: Marfusios/websocket-client@v5.5...v5.5.1

Commits viewable in compare view.

@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Oct 27, 2026
Closed
@dependabot
chore: Bump Microsoft.IdentityModel.Tokens and 4 others
278073e 
Bumps Microsoft.IdentityModel.Tokens to 6.36.0, 7.7.3, 8.23.0
Bumps Microsoft.SourceLink.GitHub from 10.0.303 to 10.0.403
Bumps System.IdentityModel.Tokens.Jwt to 6.36.0, 7.7.3
Bumps System.Text.Json from 8.0.5 to 8.0.6
Bumps Websocket.Client from 5.5.0 to 5.5.1

---
updated-dependencies:
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 6.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 6.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 7.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.403
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 6.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 6.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 7.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.Text.Json
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Websocket.Client
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/minor-and-patch-ae5f69c944 branch from c4751fa to 278073e Compare October 27, 2026 10:49
@Tr00d Tr00d closed this Oct 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/nuget/minor-and-patch-ae5f69c944 branch October 27, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Tr00d