Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the all-dependencies group with 7 updates #16549

Merged
merged 1 commit into from
Aug 12, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 12, 2024

Bumps the all-dependencies group with 7 updates:

Package From To
Jint 4.0.0 4.0.1
Azure.Storage.Blobs 12.21.1 12.21.2
AWSSDK.S3 3.7.400.2 3.7.400.4
Microsoft.IdentityModel.Protocols.OpenIdConnect 7.6.2 8.0.1
JsonPath.Net 1.1.3 1.1.4
libphonenumber-csharp 8.13.42 8.13.43
BenchmarkDotNet 0.13.12 0.14.0

Updates Jint from 4.0.0 to 4.0.1

Release notes

Sourced from Jint's releases.

v4.0.1

What's Changed

Full Changelog: sebastienros/jint@v4.0.0...v4.0.1

Commits
  • a37f39c Fix custom reference resolver argument (#1938)
  • 0ffda10 Fix dynamic object member access logic (#1937)
  • e2b5c3b Update test262 test suite and fix TypedArray.set issues (#1934)
  • 38ee8d0 Bump Meziantou.Analyzer in the all-dependencies group (#1933)
  • a08f452 Add .git-blame-ignore-revs (#1932)
  • 9079aef Convert to using file-scoped namespaces (#1931)
  • 2f49299 Bump Meziantou.Analyzer from 2.0.161 to 2.0.162 in the all-dependencies group...
  • 39f7c6f Implement Atomics.pause (#1929)
  • 81babf2 Upgrade NUnit3TestAdapter to version 4.6.0 (#1920)
  • 87ee86b Update benchmarks results and README.md against v4 (#1928)
  • See full diff in compare view

Updates Azure.Storage.Blobs from 12.21.1 to 12.21.2

Release notes

Sourced from Azure.Storage.Blobs's releases.

Azure.Storage.Blobs_12.21.2

12.21.2 (2024-08-08)

Bugs Fixed

  • Fixed [BUG] WrapKeyInternal to correctly call WrapKey in sync flow #42160
Commits

Updates AWSSDK.S3 from 3.7.400.2 to 3.7.400.4

Commits

Updates Microsoft.IdentityModel.Protocols.OpenIdConnect from 7.6.2 to 8.0.1

Release notes

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's releases.

8.0.1

Bug fixes

  • IdentityModel now resolves the public key to EPK. See issue #1951 for details.
  • Fix a race condition where SignatureProvider was disposed but still able to leverage the cache and SignatureProvider now disposes when compacting. See PR #2682 for details.
  • For JWE, JsonWebTokenHandler.ValidateJWEAsync now considers the decrypt keys in the configuration. See issue #2737 for details.

Performance improvement

  • AppContext.TryGetSwitch statically caches internally but takes out a lock. .NET almost always caches these values. They're not expected to change while the process is running unlike normal config. IdentityModel now caches the value. See issue #2722 for details.

8.0.0

CVE package updates

CVE-2024-30105

  • See PR #2707 for details.

Breaking change:

Full list of breaking changes.

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Fallback to previous behavior via an AppContext switch. See PR #2700 for details.
  • Make CollectionUtilities.IsNullOrEmpty internal. See issues Order is not preserved when returning documents from SQL query #2651 and #1722 for details.

Overall improvements to the validation in IdentityModel:

  • See design proposal #2711 for details, all work internal for now. Please comment in the GitHub issue and provide feedback there.

New Features:

  • Allow users to provide a Stream to Write in OIDCConfigurationSerializer. See PR #2698 for details.

Bug fixes:

Fundamentals

  • Remove code that was used in target frameworks that got removed. See PR #2673 for details.
  • Rename local variables for better readability. See PR #2674 for details.
  • Refactor XML comments for improved clarity. See PR #2676, #2677, #2678, #2689 and #2703 for details.
  • Fix flaky test. See issue #2683 for details.
  • Made ConfigurationManager.GetConfigurationAsync a virtual method. See PR #2661

8.0.0-preview1

Breaking changes:

  • IdentityModel 8x no longer supports .net461, which has reached end of life and is no longer supported. See issue #2544 for details.
  • Two IdentityModel extension dlls Microsoft.IdentityModel.KeyVaultExtensions and Microsoft.IdentityModel.ManagedKeyVaultSecurityKey were using ADAL, which is no longer supported . The affected packages have been removed, as the replacement is to use Microsoft.Identity.Web. See issue #2454 for details.
  • AppContext.SetSwitch which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue #2629 and https://aka.ms/IdentityModel8x for details.

... (truncated)

Changelog

Sourced from Microsoft.IdentityModel.Protocols.OpenIdConnect's changelog.

8.0.1

Bug fixes

  • IdentityModel now resolves the public key to EPK. See issue #1951 for details.
  • Fix a race condition where SignatureProvider was disposed but still able to leverage the cache and SignatureProvider now disposes when compacting. See PR #2682 for details.
  • For JWE, JsonWebTokenHandler.ValidateJWEAsync now considers the decrypt keys in the configuration. See issue #2737 for details.

Performance improvement

  • AppContext.TryGetSwitch statically caches internally but takes out a lock. .NET almost always caches these values. They're not expected to change while the process is running unlike normal config. IdentityModel now caches the value. See issue #2722 for details.

8.0.0

CVE package updates

CVE-2024-30105

  • See PR #2707 for details.

Breaking change:

Full list of breaking changes.

  • A derived ClaimsIdentity where claim retrieval is case-sensitive. The current ClaimsIdentity, in .NET, retrieves claims in a case-insensitive manner which is different than querying the underlying SecurityToken. The new CaseSensitiveClaimsIdentity class provides consistent retrieval logic with SecurityToken. Fallback to previous behavior via an AppContext switch. See PR #2700 for details.
  • Make CollectionUtilities.IsNullOrEmpty internal. See issues Order is not preserved when returning documents from SQL query #2651 and #1722 for details.

Overall improvements to the validation in IdentityModel:

  • See design proposal #2711 for details, all work internal for now. Please comment in the GitHub issue and provide feedback there.

New Features:

  • Allow users to provide a Stream to Write in OIDCConfigurationSerializer. See PR #2698 for details.

Bug fixes:

Fundamentals

  • Remove code that was used in target frameworks that got removed. See PR #2673 for details.
  • Rename local variables for better readability. See PR #2674 for details.
  • Refactor XML comments for improved clarity. See PR #2676, #2677, #2678, #2689 and #2703 for details.
  • Fix flaky test. See issue #2683 for details.
  • Made ConfigurationManager.GetConfigurationAsync a virtual method. See PR #2661

8.0.0-preview1

Breaking changes:

  • IdentityModel 8x no longer supports .net461, which has reached end of life and is no longer supported. See issue #2544 for details.
  • Two IdentityModel extension dlls Microsoft.IdentityModel.KeyVaultExtensions and Microsoft.IdentityModel.ManagedKeyVaultSecurityKey were using ADAL, which is no longer supported . The affected packages have been removed, as the replacement is to use Microsoft.Identity.Web. See issue #2454 for details.
  • AppContext.SetSwitch which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue #2629 and https://aka.ms/IdentityModel8x for details.

... (truncated)

Commits

Updates JsonPath.Net from 1.1.3 to 1.1.4

Commits

Updates libphonenumber-csharp from 8.13.42 to 8.13.43

Commits
  • 9ca9181 feat: automatic upgrade to v8.13.43
  • 794224b Merge pull request #262 from twcclegg/dependabot/nuget/csharp/PhoneNumbers.Ex...
  • c98a579 Merge pull request #263 from twcclegg/dependabot/nuget/csharp/PhoneNumbers.Te...
  • fbeee11 build(deps): bump the phonenumbers_test_minor_patch_updates group
  • 074df4b build(deps): bump the phonenumbers_extensions_test_minor_patch_updates group
  • See full diff in compare view

Updates BenchmarkDotNet from 0.13.12 to 0.14.0

Release notes

Sourced from BenchmarkDotNet's releases.

0.14.0

Full changelog: https://benchmarkdotnet.org/changelog/v0.14.0.html

Highlights

  • Introduce BenchmarkDotNet.Diagnostics.dotMemory #2549: memory allocation profile of your benchmarks using dotMemory, see @​BenchmarkDotNet.Samples.IntroDotMemoryDiagnoser
  • Introduce BenchmarkDotNet.Exporters.Plotting #2560: plotting via ScottPlot (initial version)
  • Multiple bugfixes
  • The default build toolchains have been updated to pass IntermediateOutputPath, OutputPath, and OutDir properties to the dotnet build command. This change forces all build outputs to be placed in a new directory generated by BenchmarkDotNet, and fixes many issues that have been reported with builds. You can also access these paths in your own .csproj and .props from those properties if you need to copy custom files to the output.

Bug fixes

  • Fixed multiple build-related bugs including passing MsBuildArguments and .Net 8's UseArtifactsOutput.

Breaking Changes

  • DotNetCliBuilder removed retryFailedBuildWithNoDeps constructor option.
  • DotNetCliCommand removed RetryFailedBuildWithNoDeps property and BuildNoRestoreNoDependencies() and PublishNoBuildAndNoRestore() methods (replaced with PublishNoRestore()).
Commits
  • cf882d3 Add macOS Sequoia in OsBrandStringHelper
  • 17cf3b0 [docs] Prepare v0.14.0 changelog
  • b3fbe7c Set next BenchmarkDotNet version: 0.14.0
  • 23e6c52 Fix InvalidOperationException in DotMemoryDiagnoser
  • 3d34edb Bump JetBrains.Profiler.SelfApi: 2.5.2->2.5.9
  • bf0a49d fix(CI): Deprecation issues (#2605)
  • 0275649 Fixed crash from TaskbarProgress when BuiltInComInteropSupport is disabled. ...
  • 15200d4 [build] Add BenchmarkDotNet.Exporters.Plotting.Tests to unit-tests
  • 834417a Improve logging in ScottPlotExporterTests
  • f8082a2 Fix IntroSummaryStyle compilation
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [Jint](https://github.com/sebastienros/jint) | `4.0.0` | `4.0.1` |
| [Azure.Storage.Blobs](https://github.com/Azure/azure-sdk-for-net) | `12.21.1` | `12.21.2` |
| [AWSSDK.S3](https://github.com/aws/aws-sdk-net) | `3.7.400.2` | `3.7.400.4` |
| [Microsoft.IdentityModel.Protocols.OpenIdConnect](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet) | `7.6.2` | `8.0.1` |
| [JsonPath.Net](https://github.com/json-everything/json-everything) | `1.1.3` | `1.1.4` |
| [libphonenumber-csharp](https://github.com/twcclegg/libphonenumber-csharp) | `8.13.42` | `8.13.43` |
| [BenchmarkDotNet](https://github.com/dotnet/BenchmarkDotNet) | `0.13.12` | `0.14.0` |


Updates `Jint` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/sebastienros/jint/releases)
- [Commits](sebastienros/jint@v4.0.0...v4.0.1)

Updates `Azure.Storage.Blobs` from 12.21.1 to 12.21.2
- [Release notes](https://github.com/Azure/azure-sdk-for-net/releases)
- [Commits](Azure/azure-sdk-for-net@Azure.Storage.Blobs_12.21.1...Azure.Storage.Blobs_12.21.2)

Updates `AWSSDK.S3` from 3.7.400.2 to 3.7.400.4
- [Changelog](https://github.com/aws/aws-sdk-net/blob/main/SDK.CHANGELOG.MD)
- [Commits](https://github.com/aws/aws-sdk-net/commits)

Updates `Microsoft.IdentityModel.Protocols.OpenIdConnect` from 7.6.2 to 8.0.1
- [Release notes](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)
- [Changelog](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md)
- [Commits](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@7.6.2...8.0.1)

Updates `JsonPath.Net` from 1.1.3 to 1.1.4
- [Commits](https://github.com/json-everything/json-everything/commits)

Updates `libphonenumber-csharp` from 8.13.42 to 8.13.43
- [Release notes](https://github.com/twcclegg/libphonenumber-csharp/releases)
- [Commits](twcclegg/libphonenumber-csharp@v8.13.42...v8.13.43)

Updates `BenchmarkDotNet` from 0.13.12 to 0.14.0
- [Release notes](https://github.com/dotnet/BenchmarkDotNet/releases)
- [Commits](dotnet/BenchmarkDotNet@v0.13.12...v0.14.0)

---
updated-dependencies:
- dependency-name: Jint
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: Azure.Storage.Blobs
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: AWSSDK.S3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: Microsoft.IdentityModel.Protocols.OpenIdConnect
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: JsonPath.Net
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: libphonenumber-csharp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: BenchmarkDotNet
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 12, 2024
@Piedone
Copy link
Member

Piedone commented Aug 12, 2024

This all looks good except for Microsoft.IdentityModel.Protocols.OpenIdConnect. I think the breaking changes there don't affect us, and I tested the OpenID module with content and tenants API calls and it works.

However:

Important: the version of the Microsoft.IdentityModel.Protocols.OpenIdConnect package MUST
match the IdentityModel version transitively referenced by OpenIddict to ensure we don't
accidentally end up referencing inconsistent versions (which is not supported by IM).
See #16057 for more information.

Going through the OpenID dependencies (you can start here), it seems that we're good:

image

Can you please also confirm this one time @kevinchalet?

@kevinchalet
Copy link
Member

Can you please also confirm this one time @kevinchalet?

OpenIddict 5.8.0 - not yet released - will target IM 8: I didn't see any particular regression, so that should be good 👍🏻

Copy link
Member

@Piedone Piedone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, though that's not an issue for us, since due to the open dependency declarations in the OpenIddict packages, in the end, we get v8.0.1 from the Microsoft.IdentityModel.* packages too.

We should be OK, then.

@kevinchalet
Copy link
Member

We should be OK, then.

Note: I didn't test the MSFT OIDC handler with IM 8 (only the OpenIddict client): I wouldn't expect it to break but we never know. That said, since you mentioned it worked, I guess it's fine 😄

@Piedone
Copy link
Member

Piedone commented Aug 12, 2024

Yeah, at least there's nothing obviously broken :).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file .NET Pull requests that update .net code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants