Commit d72778c
Bump Microsoft.Identity.Web.GraphServiceClientBeta from 4.8.0 to 4.9.0 (#3354)
Updated
[Microsoft.Identity.Web.GraphServiceClientBeta](https://github.com/AzureAD/microsoft-identity-web)
from 4.8.0 to 4.9.0.
<details>
<summary>Release notes</summary>
_Sourced from [Microsoft.Identity.Web.GraphServiceClientBeta's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._
## 4.9.0
### New features
- **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides`
configuration section provides explicit, per-route control over whether
`optionsOverride.*` query-string parameters are honored. Authenticated
routes default to allowing overrides (preserving existing behavior);
unauthenticated routes default to rejecting them.
`optionsOverride.BaseUrl` is unconditionally rejected on all routes as a
hardening measure. See
[#3794](AzureAD/microsoft-identity-web#3794).
### Bug fixes
- Fix `AccountController.Challenge` redirect URI validation to reject
percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.)
that could be decoded by misconfigured reverse proxies. See
[#3792](AzureAD/microsoft-identity-web#3792).
### Behavior changes
- **DownstreamApi: reserved header filtering.** Headers supplied via
`DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved
HTTP headers (`Authorization`, `Host`, `Content-Length`,
`Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header
the library already set are now silently skipped. A warning-level log
entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so
operators can spot misconfigurations. No exception is thrown. See
[#3793](AzureAD/microsoft-identity-web#3793).
### Dependencies updates
- **Update Azure.Identity 1.11.4 → 1.17.2 and establish
Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity
1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which
introduces a transitive dependency on
`Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on
non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused
a `CS0433` type collision with the previously-pinned
`Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch
individual packages, the entire `Microsoft.Extensions.*` stack on these
older TFMs has been bumped to 8.0.x, closing several 5-year version gaps
and aligning with the net8.0 baseline. **If your application targets
net462, net472, or netstandard2.0**, your resolved
`Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http`
3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0,
`Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already
targeting net8.0+ are unaffected. See
[#3787](AzureAD/microsoft-identity-web#3787).
- Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See
[#3787](AzureAD/microsoft-identity-web#3787).
- Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on
net10.0. See
[#3796](AzureAD/microsoft-identity-web#3796).
- Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3.
See
[#3788](AzureAD/microsoft-identity-web#3788).
**Full Changelog**:
AzureAD/microsoft-identity-web@4.8.0...4.9.0
Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.8.0...4.9.0).
</details>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Gunn <james@gunn.io>1 parent d068c3f commit d72778c
5 files changed
Lines changed: 137 additions & 137 deletions
File tree
- TeachingRecordSystem
- src/TeachingRecordSystem.SupportUi
- tests
- TeachingRecordSystem.EndToEndTests
- TeachingRecordSystem.SupportUi.EndToEndTests
- TeachingRecordSystem.SupportUi.Tests
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
64 | 64 | | |
65 | 65 | | |
66 | 66 | | |
67 | | - | |
| 67 | + | |
68 | 68 | | |
69 | 69 | | |
70 | 70 | | |
| |||
Lines changed: 33 additions & 33 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
70 | 70 | | |
71 | 71 | | |
72 | 72 | | |
73 | | - | |
74 | | - | |
75 | | - | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
76 | 76 | | |
77 | 77 | | |
78 | | - | |
79 | | - | |
| 78 | + | |
| 79 | + | |
80 | 80 | | |
81 | 81 | | |
82 | 82 | | |
| |||
115 | 115 | | |
116 | 116 | | |
117 | 117 | | |
118 | | - | |
119 | | - | |
| 118 | + | |
| 119 | + | |
120 | 120 | | |
121 | | - | |
122 | | - | |
123 | | - | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
124 | 124 | | |
125 | 125 | | |
126 | 126 | | |
| |||
448 | 448 | | |
449 | 449 | | |
450 | 450 | | |
451 | | - | |
452 | | - | |
| 451 | + | |
| 452 | + | |
453 | 453 | | |
454 | | - | |
| 454 | + | |
455 | 455 | | |
456 | 456 | | |
457 | 457 | | |
458 | | - | |
459 | | - | |
| 458 | + | |
| 459 | + | |
460 | 460 | | |
461 | 461 | | |
462 | 462 | | |
463 | 463 | | |
464 | | - | |
465 | | - | |
| 464 | + | |
| 465 | + | |
466 | 466 | | |
467 | 467 | | |
468 | 468 | | |
469 | 469 | | |
470 | 470 | | |
471 | 471 | | |
472 | 472 | | |
473 | | - | |
474 | | - | |
| 473 | + | |
| 474 | + | |
475 | 475 | | |
476 | 476 | | |
477 | 477 | | |
478 | | - | |
479 | | - | |
| 478 | + | |
| 479 | + | |
480 | 480 | | |
481 | 481 | | |
482 | | - | |
| 482 | + | |
483 | 483 | | |
484 | 484 | | |
485 | 485 | | |
486 | 486 | | |
487 | | - | |
488 | | - | |
| 487 | + | |
| 488 | + | |
489 | 489 | | |
490 | 490 | | |
491 | 491 | | |
492 | 492 | | |
493 | | - | |
494 | | - | |
495 | | - | |
| 493 | + | |
| 494 | + | |
| 495 | + | |
496 | 496 | | |
497 | 497 | | |
498 | 498 | | |
| |||
501 | 501 | | |
502 | 502 | | |
503 | 503 | | |
504 | | - | |
505 | | - | |
| 504 | + | |
| 505 | + | |
506 | 506 | | |
507 | 507 | | |
508 | | - | |
509 | | - | |
| 508 | + | |
| 509 | + | |
510 | 510 | | |
511 | 511 | | |
512 | 512 | | |
| |||
856 | 856 | | |
857 | 857 | | |
858 | 858 | | |
859 | | - | |
860 | | - | |
| 859 | + | |
| 860 | + | |
861 | 861 | | |
862 | 862 | | |
863 | 863 | | |
| |||
Lines changed: 35 additions & 35 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
70 | 70 | | |
71 | 71 | | |
72 | 72 | | |
73 | | - | |
74 | | - | |
| 73 | + | |
| 74 | + | |
75 | 75 | | |
76 | | - | |
77 | | - | |
78 | | - | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
79 | 79 | | |
80 | 80 | | |
81 | 81 | | |
| |||
828 | 828 | | |
829 | 829 | | |
830 | 830 | | |
831 | | - | |
832 | | - | |
| 831 | + | |
| 832 | + | |
833 | 833 | | |
834 | | - | |
| 834 | + | |
835 | 835 | | |
836 | 836 | | |
837 | 837 | | |
838 | 838 | | |
839 | | - | |
840 | | - | |
| 839 | + | |
| 840 | + | |
841 | 841 | | |
842 | 842 | | |
843 | 843 | | |
844 | 844 | | |
845 | | - | |
846 | | - | |
| 845 | + | |
| 846 | + | |
847 | 847 | | |
848 | | - | |
| 848 | + | |
849 | 849 | | |
850 | 850 | | |
851 | 851 | | |
852 | 852 | | |
853 | 853 | | |
854 | 854 | | |
855 | | - | |
856 | | - | |
| 855 | + | |
| 856 | + | |
857 | 857 | | |
858 | 858 | | |
859 | 859 | | |
860 | | - | |
861 | | - | |
| 860 | + | |
| 861 | + | |
862 | 862 | | |
863 | 863 | | |
864 | | - | |
| 864 | + | |
865 | 865 | | |
866 | 866 | | |
867 | 867 | | |
868 | 868 | | |
869 | | - | |
870 | | - | |
| 869 | + | |
| 870 | + | |
871 | 871 | | |
872 | 872 | | |
873 | 873 | | |
874 | 874 | | |
875 | 875 | | |
876 | | - | |
877 | | - | |
878 | | - | |
| 876 | + | |
| 877 | + | |
| 878 | + | |
879 | 879 | | |
880 | 880 | | |
881 | 881 | | |
| |||
884 | 884 | | |
885 | 885 | | |
886 | 886 | | |
887 | | - | |
888 | | - | |
| 887 | + | |
| 888 | + | |
889 | 889 | | |
890 | | - | |
| 890 | + | |
891 | 891 | | |
892 | 892 | | |
893 | 893 | | |
894 | | - | |
895 | | - | |
896 | | - | |
| 894 | + | |
| 895 | + | |
| 896 | + | |
897 | 897 | | |
898 | 898 | | |
899 | 899 | | |
| |||
1753 | 1753 | | |
1754 | 1754 | | |
1755 | 1755 | | |
1756 | | - | |
| 1756 | + | |
1757 | 1757 | | |
1758 | 1758 | | |
1759 | 1759 | | |
| |||
2347 | 2347 | | |
2348 | 2348 | | |
2349 | 2349 | | |
2350 | | - | |
2351 | | - | |
2352 | | - | |
| 2350 | + | |
| 2351 | + | |
| 2352 | + | |
2353 | 2353 | | |
2354 | 2354 | | |
2355 | | - | |
2356 | | - | |
| 2355 | + | |
| 2356 | + | |
2357 | 2357 | | |
2358 | 2358 | | |
2359 | 2359 | | |
| |||
0 commit comments