Bump Azure.Identity and 26 others

[dependabot]

Pinned Azure.Identity at 1.21.0.

Release notes

Sourced from Azure.Identity's releases.

1.21.0

1.21.0 (2026-04-10)

Other Changes

• All Azure.Identity types have been moved to Azure.Core and are now available through TypeForwardedTo attributes. This is a non-breaking change — existing code continues to work transparently. The library's version number now aligns with that of Azure.Core. See the Migration Guide for details.

1.17.2

1.17.2 (2026-04-15)

Other Changes

• Updated Microsoft.Identity.Client and Microsoft.Identity.Client.Extensions.Msal dependencies to version 4.83.1.

Commits viewable in compare view.

Pinned Azure.Security.KeyVault.Secrets at 4.10.0.

Release notes

Sourced from Azure.Security.KeyVault.Secrets's releases.

4.10.0

4.10.0 (2026-04-13)

Features Added

• Added AddSecretClient and AddKeyedSecretClient extension methods on IHostApplicationBuilder for registering SecretClient via dependency injection using configuration-based setup.
• Added a JSON schema segment to the NuGet package that provides IntelliSense and validation for SecretClientSettings configuration in appsettings.json.

4.9.0-beta.1

4.9.0-beta.1 (2026-04-01)

Features Added

• Added UniformResourceIdentifiers and IpAddresses collection properties in SubjectAlternativeNames.
• Added the OutContentType option to DownloadCertificateOptions and as a parameter for CertificateClient.DownloadCertificate and CertificateClient.DownloadCertificateAsync methods to specify the format in which the certificate will be returned.

Bugs Fixed

• Fixed challenge-based authentication to correctly parse tenant ID from DSTSv2 authority URIs.

Other Changes

• The default service version is now 2025-07-01.

Commits viewable in compare view.

Updated coverlet.collector from 8.0.0 to 10.0.0.

Release notes

Sourced from coverlet.collector's releases.

10.0.0

Improvements

• Unique Report Filenames (coverlet.MTP and AzDO) #​1866
• Add --coverlet-file-prefix option for unique report files #​1869
• Introduce .NET 10 support #​1823

Fixed

• Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
• Fix [BUG] Missing Coverage after moving to MTP #​1843
• Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
• Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
• Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
• Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
• Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

• Add comprehensive async method tests and documentation for issue #​1864
• Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
• Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

8.0.1

Fixed

• Fix [BUG] TypeInitializationException when targeting .NET Framework #​1818
• Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true #​1827

Improvements

• Additional improvements needed for .NET Framework instrumentation type import #​1825

Diff between 8.0.0 and 8.0.1

Commits viewable in compare view.

Updated dotnet-outdated-tool from 4.7.0 to 4.7.1.

Release notes

Sourced from dotnet-outdated-tool's releases.

4.7.1

What's Changed

• Fix --no-restore corrupting .csproj in CPM projects by @​slang25 in Fix --no-restore corrupting .csproj in CPM projects dotnet-outdated/dotnet-outdated#713
• Add Claude Code GitHub Workflow by @​slang25 in Add Claude Code GitHub Workflow dotnet-outdated/dotnet-outdated#716
• Preserve MSBuild variable references when upgrading packages by @​hwoodiwiss in Preserve MSBuild variable references when upgrading packages dotnet-outdated/dotnet-outdated#714

New Contributors

• @​hwoodiwiss made their first contribution in Preserve MSBuild variable references when upgrading packages dotnet-outdated/dotnet-outdated#714

Full Changelog: dotnet-outdated/dotnet-outdated@v4.7.0...v4.7.1

Commits viewable in compare view.

Pinned Microsoft.ApplicationInsights.AspNetCore at 3.1.0.

Release notes

Sourced from Microsoft.ApplicationInsights.AspNetCore's releases.

3.1.0

Version 3.1.0

• Make TelemetryContext properties public and propagate them via TelemetryClient.
• Add fallback to APPLICATIONINSIGHTS_CONNECTION_STRING environment variable for Base, Web, and NLog packages when connection string is not set via code.
• Update Azure.Monitor.OpenTelemetry.Exporter to 1.7.0. This includes updated mappings for telemetry context.
• Fix OTEL_SDK_DISABLED not being honored when TelemetryConfiguration.DisableTelemetry is set in DI scenarios., #​3157
• Fix TrackAvailability ignoring user-specified Timestamp on AvailabilityTelemetry. The timestamp is now emitted as microsoft.availability.testTimestamp so downstream exporters can use the correct event time.
• Added netstandard2.0 target framework to Microsoft.ApplicationInsights package to support customers with shared libraries targeting netstandard2.0.
• Fix TelemetryClient.Context.Cloud.RoleName set after construction now applies to all telemetry.
• Fix bug where Debug/Trace level logs from TrackTrace API were not emitted to Application Insights
• Fix Track API calls to not mutate the passed in dictionary if it is readonly
• Fix NullReferenceException in TelemetryClient.Flush() and FlushAsync() when called from DI scenarios
• Fix ApplicationVersion ignored: ApplicationInsightsServiceOptions.ApplicationVersion is now applied as service.version on the OpenTelemetry Resource for both AspNetCore and WorkerService packages
• Fix HttpRequestExtensions.UnvalidatedGetHeader always returning empty string instead of the actual header value. Restored max-length enforcement to guard against oversized header values.

3.0.0

• Replaced netstandard2.0 with net8.0 target framework in Microsoft.ApplicationInsights.NLogTarget package.

3.0.0-rc1

• Removed netstandard2.0 target framework from Microsoft.ApplicationInsights, Microsoft.ApplicationInsights.AspNetCore, and Microsoft.ApplicationInsights.WorkerService packages.
• The JavaScript in Microsoft.ApplicationInsights.AspNetCore has been updated to version 10.
• Centralized package version management
• Update OpenTelemetry dependencies, #​3092
  • OpenTelemetry 1.15.0
  • OpenTelemetry.Instrumentation.AspNetCore 1.15.0
  • OpenTelemetry.Instrumentation.AspNet 1.15.1
  • OpenTelemetry.Instrumentation.Http 1.15.0
  • OpenTelemetry.Instrumentation.SqlClient 1.15.0
• Vendored OpenTelemetry.Resources.Azure resource detectors to NETCORE shared folder, replaced package with vendored implementation, #​3093
• Added support to disable telemetry via TelemetryConfiguration.DisableTelemetry
• Removed EnabledAdaptiveSampling and replaced with TracesPerSecond and SamplingRatio
• Added EnableTraceBasedLogsSampler property to ApplicationInsightsServiceOptions for ASP.NET Core and WorkerService packages
• Added support for StorageDirectory and DisableOfflineStorage from TelemetryConfiguration in DI scenarios
• Update Azure.Monitor.OpenTelemetry.Exporter dependency to 1.6.0

3.0.0-beta2

Added

• Automatic configuration binding from "ApplicationInsights" section in appsettings.json for both AspNetCore and WorkerService packages with configuration precedence: environment variables > explicit configuration > appsettings.json
• Added support for Entra ID (Azure Active Directory) authentication using Azure.Core.TokenCredential
• Added Self Diagnostics feature
• Updated the default sampler from Fixed Rate to Rate-Limited Sampling.
• Update Azure Monitor Exporter to 1.6.0-beta.2
• Add comprehensive applicationinsights.config support
• Add properties in TelemetryConfiguration to configure underlying exporter

Bug fix

• Fix TrackMetric(MetricTelemetry) unsupported telemetry type error

3.0.0-beta1

• The following Application Insights packages in this repo now use OpenTelemetry internally. OpenTelemetry is the industry standard for telemetry collection and provides better interoperability with other observability tools.
  • Microsoft.ApplicationInsights
  • Microsoft.ApplicationInsights.AspNetCore
  • Microsoft.ApplicationInsights.WorkerService
  • Microsoft.ApplicationInsights.Web
  • Microsoft.ApplicationInsights.NLogTarget
• Classic APIs of the above packages are preserved; calls are translated to OpenTelemetry telemetry.
• Other packages not listed above (such as certain auto-collectors and logging adapters that were published from this repo previously) will not have future versions published. See BreakingChanges.md for details.

Commits viewable in compare view.

Pinned Microsoft.ApplicationInsights.Profiler.AspNetCore at 3.0.2.

Pinned Microsoft.AspNetCore.Mvc.NewtonsoftJson at 9.0.15.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.NewtonsoftJson's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/aspnetcore#65634
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65439
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65438
• [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea dotnet/aspnetcore#65587
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65706
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65731

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/aspnetcore#65294
• [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 dotnet/aspnetcore#65290
• [release/9.0] Remove package baseline by @​Copilot in [release/9.0] Remove package baseline dotnet/aspnetcore#65208
• [release/9.0] Set network isolation policy for aspnetcore-ci by @​github-actions[bot] in [release/9.0] Set network isolation policy for aspnetcore-ci dotnet/aspnetcore#65172
• [release/9.0] Package dotnet-getdocument from current TFM into top-level by @​wtgodbe in [release/9.0] Package dotnet-getdocument from current TFM into top-level dotnet/aspnetcore#65164
• [release/9.0] Fix URL format for JDK download on linux by @​github-actions[bot] in [release/9.0] Fix URL format for JDK download on linux dotnet/aspnetcore#65075
• [release/9.0] Disable parallel restore for Grpc JsonTranscoding by @​github-actions[bot] in [release/9.0] Disable parallel restore for Grpc JsonTranscoding dotnet/aspnetcore#65072
• [release/9.0] Update Ubuntu queue to 22.04 by @​wtgodbe in [release/9.0] Update Ubuntu queue to 22.04 dotnet/aspnetcore#65298
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65117
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65089
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65365
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65364
• [release/9.0] Disable parallel restore for linker tests by @​github-actions[bot] in [release/9.0] Disable parallel restore for linker tests dotnet/aspnetcore#65374
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65381
• [release/9.0] Switch to non-preview 2022 queue by @​github-actions[bot] in [release/9.0] Switch to non-preview 2022 queue dotnet/aspnetcore#65412

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 9.0.13 to 9.0.15.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/aspnetcore#65634
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65439
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65438
• [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea dotnet/aspnetcore#65587
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65706
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65731

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/aspnetcore#65294
• [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 dotnet/aspnetcore#65290
• [release/9.0] Remove package baseline by @​Copilot in [release/9.0] Remove package baseline dotnet/aspnetcore#65208
• [release/9.0] Set network isolation policy for aspnetcore-ci by @​github-actions[bot] in [release/9.0] Set network isolation policy for aspnetcore-ci dotnet/aspnetcore#65172
• [release/9.0] Package dotnet-getdocument from current TFM into top-level by @​wtgodbe in [release/9.0] Package dotnet-getdocument from current TFM into top-level dotnet/aspnetcore#65164
• [release/9.0] Fix URL format for JDK download on linux by @​github-actions[bot] in [release/9.0] Fix URL format for JDK download on linux dotnet/aspnetcore#65075
• [release/9.0] Disable parallel restore for Grpc JsonTranscoding by @​github-actions[bot] in [release/9.0] Disable parallel restore for Grpc JsonTranscoding dotnet/aspnetcore#65072
• [release/9.0] Update Ubuntu queue to 22.04 by @​wtgodbe in [release/9.0] Update Ubuntu queue to 22.04 dotnet/aspnetcore#65298
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65117
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65089
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65365
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65364
• [release/9.0] Disable parallel restore for linker tests by @​github-actions[bot] in [release/9.0] Disable parallel restore for linker tests dotnet/aspnetcore#65374
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65381
• [release/9.0] Switch to non-preview 2022 queue by @​github-actions[bot] in [release/9.0] Switch to non-preview 2022 queue dotnet/aspnetcore#65412

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Pinned Microsoft.AspNetCore.OpenApi at 9.0.15.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/aspnetcore#65634
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65439
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65438
• [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 56efe39 to 73a63ea dotnet/aspnetcore#65587
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65706
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65731

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/aspnetcore#65294
• [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 by @​dependabot[bot] in [release/9.0] (deps): Bump src/submodules/googletest from 9156d4c to 56efe39 dotnet/aspnetcore#65290
• [release/9.0] Remove package baseline by @​Copilot in [release/9.0] Remove package baseline dotnet/aspnetcore#65208
• [release/9.0] Set network isolation policy for aspnetcore-ci by @​github-actions[bot] in [release/9.0] Set network isolation policy for aspnetcore-ci dotnet/aspnetcore#65172
• [release/9.0] Package dotnet-getdocument from current TFM into top-level by @​wtgodbe in [release/9.0] Package dotnet-getdocument from current TFM into top-level dotnet/aspnetcore#65164
• [release/9.0] Fix URL format for JDK download on linux by @​github-actions[bot] in [release/9.0] Fix URL format for JDK download on linux dotnet/aspnetcore#65075
• [release/9.0] Disable parallel restore for Grpc JsonTranscoding by @​github-actions[bot] in [release/9.0] Disable parallel restore for Grpc JsonTranscoding dotnet/aspnetcore#65072
• [release/9.0] Update Ubuntu queue to 22.04 by @​wtgodbe in [release/9.0] Update Ubuntu queue to 22.04 dotnet/aspnetcore#65298
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65117
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65089
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/aspnetcore#65365
• [release/9.0] Update dependencies from dotnet/extensions by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/extensions dotnet/aspnetcore#65364
• [release/9.0] Disable parallel restore for linker tests by @​github-actions[bot] in [release/9.0] Disable parallel restore for linker tests dotnet/aspnetcore#65374
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/aspnetcore#65381
• [release/9.0] Switch to non-preview 2022 queue by @​github-actions[bot] in [release/9.0] Switch to non-preview 2022 queue dotnet/aspnetcore#65412

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Pinned Microsoft.Data.SqlClient at 7.0.1.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

7.0.1

This update brings the following changes since the 7.0.0 release:

Fixed

• Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' error. The column metadata query now uses dynamic SQL so that references to the graph_type column (introduced in SQL Server 2017) are not compiled on older versions that lack the column. (#​3714, #​4092, #​4147)

• Fixed SqlBulkCopy failing on Azure Synapse Analytics dedicated SQL pools. The column-list query previously used a variable-assignment pattern that Synapse does not support; it now uses STRING_AGG when targeting Synapse (engine edition 6) and falls back to the variable-assignment approach for SQL Server 2016 compatibility. (#​4149, #​4176, #​4182)

• Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() returning typeof(byte[]) instead of typeof(SqlVector<float>) for vector float32 columns. The methods now follow the same type-determination logic as GetValue(). (#​4104, #​4105, #​4152)

• Added missing System.Data.Common (v4.3.0) NuGet package dependency for .NET Framework consumers. The inbox System.Data.Common assembly on .NET Framework predates APIs such as IDbColumnSchemaGenerator; without the explicit NuGet dependency, consumers encountered CS0012 compilation errors when using these types through Microsoft.Data.SqlClient. (#​4063, #​4074)

Changed

• Enabled the User Agent TDS feature extension unconditionally. The Switch.Microsoft.Data.SqlClient.EnableUserAgent AppContext switch has been removed; the driver now always sends User Agent information during login. (#​4124, #​4154)

• Added type forwards from the core Microsoft.Data.SqlClient assembly to public types that were moved to the Microsoft.Data.SqlClient.Extensions.Abstractions package: SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. This ensures binary compatibility for assemblies compiled against earlier versions of Microsoft.Data.SqlClient where these types lived in the core assembly. (#​4067, #​4117)

• Fixed API documentation include paths and duplicate doc snippets. (#​4084, #​4086, #​4107, #​4161)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
  ... (truncated)

7.0.0

This is the general availability release of Microsoft.Data.SqlClient 7.0, a major milestone for the .NET data provider for SQL Server. This release addresses the most upvoted issue in the repository's history — extracting Azure dependencies from the core package — introduces pluggable SSPI authentication, adds enhanced routing for Azure SQL Hyperscale, and delivers async read performance improvements.

Also released as part of this milestone:

• Released Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Extensions.Azure 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Internal.Logging 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.0. See release notes.

Changes Since 7.0.0-preview4

Added

• Added actionable error message when Entra ID authentication methods are used without the Microsoft.Data.SqlClient.Extensions.Azure package installed, guiding users to install the correct package. (#​3962, #​4046)
• Added Azure authentication sample application. (#​3988)

Changed

Other changes

• Renamed the Microsoft.Data.SqlClient.Extensions.Logging package to Microsoft.Data.SqlClient.Internal.Logging to indicate it is for internal use only and should not be referenced directly by application code. (#​4038)
• Fixed non-localized exception strings. (#​4022)
• Codebase merge and cleanup: (#​3997, #​4052)
• Various test improvements: (#​3891, #​3996, #​4002, #​4034, #​4041, #​4044)
• Documentation improvements (including Entra ID branding updates): (#​4021, #​4047, #​4049)
• Updated Dependencies (#​4045):
  • Updated Azure.Core to v1.51.1
  • Updated Azure.Identity to v1.18.0
  • Updated Azure.Security.KeyVault.Keys to v4.9.0
  • Updated Microsoft.Extensions.Caching.Memory to v9.0.13 (.NET 9.0)
  • Updated Microsoft.IdentityModel.JsonWebTokens to v8.16.0
  • Updated Microsoft.IdentityModel.Protocols.OpenIdConnect to v8.16.0
  • Updated Microsoft.Bcl.Cryptography to v9.0.13 (.NET 9.0)
  • Updated System.Configuration.ConfigurationManager to v9.0.13 (.NET 9.0)
  • Updated System.Diagnostics.DiagnosticSource to v10.0.3
  • Updated System.Security.Cryptography.Pkcs to v9.0.13 (.NET 9.0)
  • Updated System.Text.Json to v10.0.3
  • Updated System.Threading.Channels to v10.0.3
  • Updated System.ValueTuple to v4.6.2

Cumulative Changes Since 6.1

This section summarizes all changes across the 7.0 preview cycle for users upgrading from the latest 6.1 stable release.

Changed

Azure Dependencies Removed from Core Package

What Changed:

• The core Microsoft.Data.SqlClient package no longer depends on Azure.Core, Azure.Identity, or their transitive dependencies (e.g., Microsoft.Identity.Client, Microsoft.Web.WebView2). Azure Active Directory / Entra ID authentication functionality (ActiveDirectoryAuthenticationProvider and related types) has been extracted into a new Microsoft.Data.SqlClient.Extensions.Azure package. (#​1108, #​3680, #​3902, #​3904, #​3908, #​3917, #​3982, #​3978, #​3986)
  ... (truncated)

7.0.0-preview4

Changed

Azure Dependencies Removed from Core Package

What Changed:

• The core Microsoft.Data.SqlClient package no longer depends on Azure.Core, Azure.Identity, or their transitive dependencies (e.g., Microsoft.Identity.Client, Microsoft.Web.WebView2). Azure Active Directory / Entra authentication functionality (ActiveDirectoryAuthenticationProvider and related types) has been extracted into a new Microsoft.Data.SqlClient.Extensions.Azure package that can be installed separately when needed. (#​1108, #​3680, #​3902, #​3904, #​3908, #​3917, #​3982, #​3978, #​3986)
• To support this separation, two additional packages were introduced: Microsoft.Data.SqlClient.Extensions.Abstractions (shared types between the core driver and extensions) and Microsoft.Data.SqlClient.Extensions.Logging (shared ETW tracing infrastructure). (#​3626, #​3628, #​3967)

Who Benefits:

• All users benefit from a significantly lighter core package. Previously, the Azure dependency chain pulled in numerous assemblies (including Azure.Core, Azure.Identity, Microsoft.Identity.Client, and Microsoft.Web.WebView2) even for applications that only needed basic SQL Server connectivity. This was the most upvoted open issue in the repository (#​1108).
• Users who do not use Azure AD authentication no longer carry Azure-related assemblies in their build output, reducing deployment size and eliminating confusion about unexpected dependencies.
• Users who do use Azure AD authentication can now manage Azure dependency versions independently from the core driver.

Impact:

• Applications using Azure AD authentication (e.g., ActiveDirectoryPassword, ActiveDirectoryInteractive, ActiveDirectoryDefault, etc.) must now install the Microsoft.Data.SqlClient.Extensions.Azure NuGet package separately. No code changes are required beyond adding the package reference.

Added

Expose SSPI Context Provider as Public API

What Changed:

• Added the SspiContextProvider abstract class and a public SspiContextProvider property on SqlConnection, allowing applications to supply a custom SSPI context provider for integrated authentication. This enables custom Kerberos ticket negotiation and NTLM username/password authentication scenarios that the driver does not natively support. (#​2253, #​2494)

Who Benefits:

• Users authenticating across untrusted domains, non-domain-joined machines, or cross-platform environments where configuring integrated authentication on the client is difficult or impossible.
• Users running in containers who need manual Kerberos negotiation without deploying sidecars or external ticket-refresh mechanisms.
• Users who need NTLM username/password authentication to SQL Server, which the driver does not provide natively.

Impact:

• Applications can set a custom SspiContextProvider on SqlConnection before opening the connection. The provider handles the authentication token exchange during integrated authentication. This is an additive API — existing authentication behavior is unchanged when no custom provider is set. See SspiContextProvider_CustomProvider.cs for a sample implementation.
• Note: The SspiContextProvider is a part of the connection pool key. Care should be taken when using this property to ensure the implementation returns a stable identity per resource.

Expose Default Transient Error List

What Changed:

• Exposed the default transient error codes list via the new SqlConfigurableRetryFactory.BaselineTransientErrors static property (returns a ReadOnlyCollection<int>), making it easier to extend the set of transient errors without copy-pasting from the repository source. (#​3903)

Who Benefits:

• Developers implementing custom retry logic who want to extend the built-in transient error list rather than replacing it.

Impact:

... (truncated)

7.0.0-preview3

Preview Release 7.0.0-preview3.25342.7 - December 8, 2025

Added

Support for .NET 10

What Changed:

• Updated pipelines and test suites to compile the driver using the .NET 10 SDK. Cleaned up unnecessary dependency references.
  (#​3686)

Who Benefits:

• Developers targeting .NET 10.

Impact:

• Addressed .NET 10 warnings regarding unused/unnecessary dependencies.

Enable SqlClientDiagnosticListener in SqlCommand on .NET Framework

What Changed:

• Enabled SqlClientDiagnosticListener functionality on SqlCommand for .NET Framework.
  (#​3658)

Who Benefits:

• Developers requiring diagnostic information on .NET Framework.

Impact:

• Improved observability and diagnostics for SqlCommand on .NET Framework.

Enable User Agent Extension

What Changed:

• Enabled User Agent Feature Extension.
  (#​3606)

Who Benefits:

• Telemetry and diagnostics consumers.

Impact:

• When the Switch.Microsoft.Data.SqlClient.EnableUserAgent app context switch is enabled, the driver sends more detailed user agent strings. This switch is disabled by default. This change will assist with troubleshooting and quantifying driver usage by version and operating system.

Fixed

... (truncated)

7.0.0-preview2

This update brings the following changes since the 7.0.0-preview1 release:

Bug Fixes

• Fixed a debug assertion in connection pool (no impact to production code) (#​3587)
• Prevent uninitialized performance counters escaping CreatePerformanceCounters (#​3623)
• Fix SetProvider to return immediately if user-defined authentication provider found (#​3620)
• Allow SqlBulkCopy to operate on hidden columns (#​3590)
• Fix connection pool concurrency issue (#​3632)

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #​3625.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

Other Additions

• Add app context switch for enabling asynchronous multi-packet improvements (#​3605)

Changed

Deprecation of SqlAuthenticationMethod.ActiveDirectoryPassword

What Changed:

• Username/Password authentication for Microsoft Entra (formerly Active Directory) has been deprecated. SqlAuthenticationMethod.ActiveDirectoryPassword is now marked as [Obsolete]. This change occurred in PR #​3671

Who benefits:

• Teams moving toward stronger, passwordless or MFA-compliant auth (in line with changes across MSAL/Azure.Identity and Entra MFA enforcement). This aligns Microsoft.Data.SqlClient with Microsoft's direction to avoid username/password (ROPC) flows. See https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication for more explanation of why this change is being made across Microsoft products/services.

... (truncated)

7.0.0-preview1

Changes Since 6.1.0

This update brings the following changes since the 6.1.0 release:

Breaking Changes

• Removed Constrained Execution Region error handling blocks and associated SqlConnection cleanup which may affect how potentially-broken connections are expunged from the pool. (#​3535)

Bug Fixes

• Packet multiplexing disabled by default, and several bug fixes. (#​3534, #​3537)

Added

• SqlColumnEncryptionCertificateStoreProvider now works on Windows, Linux, and macOS. (#​3014)

Changed

• Updated SqlVector.Null to return a nullable SqlVector instance in the reference API to match the implementation. (#​3521)

• Performance improvements for all built-in SqlColumnEncryptionKeyStoreProvider implementations. (#​3554)

• Various test improvements. (#​3456, #​2968, #​3458, #​3494, #​3559, #​3575)

• Codebase merge project and related cleanup. (#​3436, #​3434, #​3448, #​3454, #​3462, #​3435, #​3492, #​3473, #​3469, #​3394, #​3493, #​3593)

• Documentation improvements. (#​3490)

• Updated Azure.Identity dependency to v1.14.2. (#​3538)

Changes Since 6.0.2

This update brings the following changes since the 6.0.2 release. Changes already noted above are omitted:

Additions

Added dedicated SQL Server vector datatype support

What Changed:

• Optimized vector communications between MDS and SQL Server 2025, employing a custom binary format over the TDS protocol. (#​3433, #​3443)
• Reduced processing load compared to existing JSON-based vector support.
• Initial support for 32-bit single-precision floating point vectors.

Who Benefits:

• Applications moving large vector data sets will see beneficial improvements to processing times and memory requirements.
• Vector-specific APIs are ready to support future numeric representations with a consistent look-and-feel.

Impact:
... (truncated)

Commits viewable in compare view.

Pinned Microsoft.EntityFrameworkCore at 9.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37718
• [release/8.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/efcore#37816
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37820
• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/efcore#37833
• [release/8.0] Update branding to 8.0.26 by @​vseanreesermsft in [release/8.0] Update branding to 8.0.26 dotnet/efcore#37834
• [release/9.0] Update SDK to 9.0.114 by @​AndriySvyryd in [release/9.0] Update SDK to 9.0.114 dotnet/efcore#37779
• [release/8.0] Update SDK to 8.0.124 by @​AndriySvyryd in [release/8.0] Update SDK to 8.0.124 dotnet/efcore#37780
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37836
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37887
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37901

Full Changelog: dotnet/efcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37522
• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/efcore#37614
• Update branding to 8.0.25 by @​vseanreesermsft in Update branding to 8.0.25 dotnet/efcore#37613
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37563
• Merging internal commits for release/8.0 by @​vseanreesermsft in Merging internal commits for release/8.0 dotnet/efcore#37667
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37666
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37669

Full Changelog: dotnet/efcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 9.0.13 to 9.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37718
• [release/8.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/efcore#37816
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37820
• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/efcore#37833
• [release/8.0] Update branding to 8.0.26 by @​vseanreesermsft in [release/8.0] Update branding to 8.0.26 dotnet/efcore#37834
• [release/9.0] Update SDK to 9.0.114 by @​AndriySvyryd in [release/9.0] Update SDK to 9.0.114 dotnet/efcore#37779
• [release/8.0] Update SDK to 8.0.124 by @​AndriySvyryd in [release/8.0] Update SDK to 8.0.124 dotnet/efcore#37780
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37836
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37887
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37901

Full Changelog: dotnet/efcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37522
• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/efcore#37614
• Update branding to 8.0.25 by @​vseanreesermsft in Update branding to 8.0.25 dotnet/efcore#37613
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37563
• Merging internal commits for release/8.0 by @​vseanreesermsft in Merging internal commits for release/8.0 dotnet/efcore#37667
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37666
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37669

Full Changelog: dotnet/efcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Pinned Microsoft.EntityFrameworkCore.SqlServer at 9.0.15.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

9.0.15

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37718
• [release/8.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/8.0] Update dependencies from dotnet/arcade dotnet/efcore#37816
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37820
• [release/9.0] Update branding to 9.0.15 by @​vseanreesermsft in [release/9.0] Update branding to 9.0.15 dotnet/efcore#37833
• [release/8.0] Update branding to 8.0.26 by @​vseanreesermsft in [release/8.0] Update branding to 8.0.26 dotnet/efcore#37834
• [release/9.0] Update SDK to 9.0.114 by @​AndriySvyryd in [release/9.0] Update SDK to 9.0.114 dotnet/efcore#37779
• [release/8.0] Update SDK to 8.0.124 by @​AndriySvyryd in [release/8.0] Update SDK to 8.0.124 dotnet/efcore#37780
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37836
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37887
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37901

Full Changelog: dotnet/efcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37522
• Update branding to 9.0.14 by @​vseanreesermsft in Update branding to 9.0.14 dotnet/efcore#37614
• Update branding to 8.0.25 by @​vseanreesermsft in Update branding to 8.0.25 dotnet/efcore#37613
• [release/9.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in [release/9.0] Update dependencies from dotnet/arcade dotnet/efcore#37563
• Merging internal commits for release/8.0 by @​vseanreesermsft in Merging internal commits for release/8.0 dotnet/efcore#37667
• Merging internal commits for release/9.0 by @​vseanreesermsft in Merging internal commits for release/9.0 dotnet/efcore#37666
• [automated] Merge branch 'release/8.0' => 'release/9.0' by @​github-actions[bot] in [automated] Merge branch 'release/8.0' => 'release/9.0' dotnet/efcore#37669

Full Changelog: dotnet/efcore@v9.0.13...v9.0.14

Commits viewable in compare view.

Pinned Microsoft.Extensions.Caching.Abstractions at 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Caching.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Configuration at 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Configuration's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.DependencyInjection at 10.0.7.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.3 to 10.0.7.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Logging at 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Extensions.Options.ConfigurationExtensions at 10.0.7.

Release notes

Sourced from Microsoft.Extensions.Options.ConfigurationExtensions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Pinned Microsoft.Identity.Web at 4.8.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.8.0

What's Changed

• Bump flatted from 3.3.3 to 3.4.2 in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump flatted from 3.3.3 to 3.4.2 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3753
• Update changelog.md for ID.Web 4.6.0 by @​bgavrilMS in Update changelog.md for ID.Web 4.6.0 AzureAD/microsoft-identity-web#3756
• Add token binding to MicrosoftIdentityMessageHandler by @​cpp11nullptr in Add token binding to MicrosoftIdentityMessageHandler AzureAD/microsoft-identity-web#3743
• Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump picomatch in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3759
• Documentation: Clarify managed identity credential types for containerized vs. VM/App Service deployments by @​Copilot in Documentation: Clarify managed identity credential types for containerized vs. VM/App Service deployments AzureAD/microsoft-identity-web#3585
• Bump path-to-regexp from 8.3.0 to 8.4.0 in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump path-to-regexp from 8.3.0 to 8.4.0 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3762
• Upgrade Microsoft Application Insights packages by @​RojaEnnam in Upgrade Microsoft Application Insights packages AzureAD/microsoft-identity-web#3763
• Use Abstractions 12 by @​pmaytak in Use Abstractions 12 AzureAD/microsoft-identity-web#3761
• Post-4.7.0 by @​pmaytak in Post-4.7.0 AzureAD/microsoft-identity-web#3768
• Fix Comp Gov DOTNET-Security-10.0 by @​reginayap8 in Fix Comp Gov DOTNET-Security-10.0 AzureAD/microsoft-identity-web#3769
• Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by @​reginayap8 in Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors AzureAD/microsoft-identity-web#3770
• fix warnings by @​gladjohn in fix warnings AzureAD/microsoft-identity-web#3771
• adding examples for using postgres as a distributed cache by @​JaredMSFT in adding examples for using postgres as a distributed cache AzureAD/microsoft-identity-web#3766
• Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility test app by @​Copilot in Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility test app AzureAD/microsoft-identity-web#3774
• Bump vite from 7.1.11 to 7.3.2 in /tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in Bump vite from 7.1.11 to 7.3.2 in /tests/DevApps/SidecarAdapter/typescript AzureAD/microsoft-identity-web#3772
• Skip legacy B2C local-account Todo UI test in WebAppUiTests by @​Copilot in Skip legacy B2C local-account Todo UI test in WebAppUiTests AzureAD/microsoft-identity-web#3778
• Fix initialization of ConfidentialClientApplicationOptions in MergedOptions by @​cpp11nullptr in Fix initialization of ConfidentialClientApplicationOptions in MergedOptions AzureAD/microsoft-identity-web#3760
• Bump net8/net9/net10 runtime package baselines to patched crypto servicing versions by @​Copilot in Bump net8/net9/net10 runtime package baselines to patched crypto servicing versions AzureAD/microsoft-identity-web#3779
• Fix flaky certificate test failures on CI by @​gladjohn in Fix flaky certificate test failures on CI AzureAD/microsoft-identity-web#3780
• MTLS Without Tokens Support by @​tlupes in MTLS Without Tokens Support - DownstreamApi AzureAD/microsoft-identity-web#3747
• Fix CredentialsProvider DI lifetime mismatch causing startup crash in Development by @​Avery-Dunn in Fix CredentialsProvider DI lifetime mismatch causing startup crash in Development AzureAD/microsoft-identity-web#3783
• Remove unused DataProtection configuration from Sidecar by @​Copilot in Remove unused DataProtection configuration from Sidecar AzureAD/microsoft-identity-web#3776

New Contributors

• @​RojaEnnam made their first contribution in Upgrade Microsoft Application Insights packages AzureAD/microsoft-identity-web#3763
• @​reginayap8 made their first contribution in Fix Comp Gov DOTNET-Security-10.0 AzureAD/microsoft-identity-web#3769
• @​JaredMSFT made their first contribution in adding examples for using postgres as a distributed cache AzureAD/microsoft-identity-web#3766

Full Changelog: AzureAD/microsoft-identity-web@4.6.0...4.8.0

4.7.0

4.7.0

Bug fixes

• Updates to Microsoft.Identity.Abstractions 12.0.0 to revert breaking changes introduced in Abstractions 11.0.0. (On .NET 10 target, Certificate extension method in CredentialDescription was reverted to normal property.) See #​3767.

4.6.0

What's Changed

• Move boilerplate code skills to IdWeb, and add Aspire DevApp demonstrating Blazor authentication components by @​Copilot in Move boilerplate code skills to IdWeb, and add Aspire DevApp demonstrating Blazor authentication components AzureAD/microsoft-identity-web#3721
• Bump MSAL to 4.83.1 and re-enable Managed Identity CAE tests by @​Copilot in Bump MSAL to 4.83.1 and re-enable Managed Identity CAE tests AzureAD/microsoft-identity-web#3746
• Bump Abstractions to 11.2 by @​bgavrilMS in Bump Abstractions to 11.2 AzureAD/microsoft-identity-web#3749
• Update documentation to reference Blazor helpers from Microsoft.Identity.Web package by @​Copilot in Update documentation to reference Blazor helpers from Microsoft.Identity.Web package AzureAD/microsoft-identity-web#3723

Full Changelog: AzureAD/microsoft-identity-web@4.5.0...4.6.0

4.5.0

New features

• Add support for certificate store lookup by subject name. See #​3742.

Dependencies updates

• Bump minimatch in /tests/DevApps/SidecarAdapter/typescript. See #​3739.
• Bump rollup from 4.52.3 to 4.59.0 in /tests/DevApps/SidecarAdapter/typescript. See #​3740.

4.4.0

New features

• Add AOT-compatible web API authentication for .NET 10+. See #​3705 and #​3664.
• Propagate long-running web API session key back to callers in user token acquisition. See #​3728.
• Add OBO event initialization for OBO APIs. See #​3724.
• Add support for calling WithClientClaims flow for token acquisition. See #​3623.
• Add OnBeforeTokenAcquisitionForOnBehalfOf event. See #​3680.

Bug fixes

• Throw InvalidOperationException with actionable message when a custom credential is not registered. See #​3626.
• Fix event firing for InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync. See #​3717.
• Update OnBeforeTokenAcquisitionForOnBehalfOf to construct ClaimsPrincipal from token. See #​3714.
• Add a retry counter for acquire token and updated tests with a fake secret. See #​3682.
• Fix OBO user error handling. See #​3712.
• Fix override merging for app token (and others). See #​3644.
• Fix certificate reload logic to only trigger on certificate-specific errors. See #​3653.
• Update ROPC flow CCA to pass SendX5C to MSAL. See #​3671.

Dependencies updates

• Bump qs in /tests/DevApps/SidecarAdapter/typescript. See #​3725.
• Downgrade Microsoft.Extensions.Configuration.Binder to 2.1.0 on .NET Framework. See #​3730.
• Update .NET SDK to 10.0.103 to address DOTNET-Security-10.0 vulnerability. See #​3726.
• Upgrade to Microsoft.Identity.Abstractions 11 for AoT compatibility. See #​3699.
• Update to MSAL 4.81.0. See #​3665.

Documentation

• Add documentation for auto-generated session key for long-running OBO session. See #​3729.
• Improve the Aspire doc article and skills. See #​3695.
• Add an article and agent skill to add Entra ID to an Aspire app. See #​3689.
• Fix misleading comment in CertificatelessOptions.ManagedIdentityClientId. See #​3667.
• Add Copilot explore tool functionality. See #​3694.

Fundamentals

• Remove unnecessary warning suppression. See #​3715.
• Migrate labs to Lab.API 2.x (first pass). See #​3710.
• Update Sidecar E2E test constants. See #​3693.
• Fix intermittent failures in CertificatesObserverTests. See #​3687.
• Add validation baseline exclusions. See #​3684.
• Add dSTS integration tests. See #​3677.
  -...

Description has been truncated

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 57 package(s) with unknown licenses.

View full job summary

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Superseded by #799.