Skip to content

Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors#3770

Merged
gladjohn merged 2 commits into
masterfrom
reyap/codeql
Apr 6, 2026
Merged

Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors#3770
gladjohn merged 2 commits into
masterfrom
reyap/codeql

Conversation

@reginayap8

@reginayap8 reginayap8 commented Apr 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Upgrade Pipeline Job Init@V4 to Fix 10 CodeQL Warnings and Errors in CodeQL Analysis

  • You've read the Contributor Guide and Code of Conduct.
  • You've included unit or integration tests for your change, where applicable.
  • You've included inline docs for your change, where applicable.
  • There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Fix 10 CodeQL warnings in the pipeline analysis by setting the Github API permissions.

Solution: Add the following permissions in yaml file since they were missing and causing the pipeline check to fail.

  • Upgrade CodeQL pipeline step from V3 to V4
  • security-events: write — lets the action upload SARIF results and fetch feature flags from GitHub's API, which resolves the fallback warning.
  • actions: read — allows the action to read its own feature flag configuration.
  • contents: read — explicitly grants repo content access (best practice when listing multiple permissions).

Pipeline link to warnings
Link: https://github.com/AzureAD/microsoft-identity-web/actions/runs/23922732183

image

Fixes #{bug number} (in this specific format)

reginayap8 and others added 2 commits April 3, 2026 11:26
@reginayap8
Fix some Code ql errors
b250649
@reginayap8
fix: update CodeQL actions to v4 and fix permissions
c732692 
- Upgrade codeql-action/init and codeql-action/analyze from v3 to v4
  to resolve Node.js 20 deprecation warning
- Update permissions: security-events to write, add actions: read
  and contents: read to resolve feature flags CLI version warning
- Update commented autobuild reference from v2 to v4 for consistency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@reginayap8 reginayap8 requested a review from a team as a code owner April 3, 2026 18:59
@reginayap8 reginayap8 changed the title Fix 10 CodeQL Analysis Warnings and Errors Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors Apr 3, 2026
@gladjohn gladjohn merged commit 83e7934 into master Apr 6, 2026
4 checks passed
@gladjohn gladjohn deleted the reyap/codeql branch April 6, 2026 18:10
@Avery-Dunn Avery-Dunn mentioned this pull request Apr 20, 2026
Merged
This was referenced Apr 20, 2026
Closed
Open
Merged
Closed
Merged
Closed
Merged
Merged
Merged
Merged
Merged
Merged
Closed
Closed
Closed
github-actions Bot pushed a commit to EelcoLos/nx-tinkering that referenced this pull request Apr 21, 2026
@dependabot
Bump Microsoft.Identity.Web from 4.7.0 to 4.8.0 (#1142)
5b6d7ef 
Pinned
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
at 4.8.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.8.0

## What's Changed
* Bump flatted from 3.3.3 to 3.4.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3753
* Update changelog.md for ID.Web 4.6.0 by @​bgavrilMS in
AzureAD/microsoft-identity-web#3756
* Add token binding to MicrosoftIdentityMessageHandler by @​cpp11nullptr
in AzureAD/microsoft-identity-web#3743
* Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by
@​dependabot[bot] in
AzureAD/microsoft-identity-web#3759
* Documentation: Clarify managed identity credential types for
containerized vs. VM/App Service deployments by @​Copilot in
AzureAD/microsoft-identity-web#3585
* Bump path-to-regexp from 8.3.0 to 8.4.0 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3762
* Upgrade Microsoft Application Insights packages by @​RojaEnnam in
AzureAD/microsoft-identity-web#3763
* Use Abstractions 12 by @​pmaytak in
AzureAD/microsoft-identity-web#3761
* Post-4.7.0 by @​pmaytak in
AzureAD/microsoft-identity-web#3768
* Fix Comp Gov DOTNET-Security-10.0 by @​reginayap8 in
AzureAD/microsoft-identity-web#3769
* Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by
@​reginayap8 in
AzureAD/microsoft-identity-web#3770
* fix warnings by @​gladjohn in
AzureAD/microsoft-identity-web#3771
* adding examples for using postgres as a distributed cache by
@​JaredMSFT in
AzureAD/microsoft-identity-web#3766
* Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility
test app by @​Copilot in
AzureAD/microsoft-identity-web#3774
* Bump vite from 7.1.11 to 7.3.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3772
* Skip legacy B2C local-account Todo UI test in WebAppUiTests by
@​Copilot in AzureAD/microsoft-identity-web#3778
* Fix initialization of ConfidentialClientApplicationOptions in
MergedOptions by @​cpp11nullptr in
AzureAD/microsoft-identity-web#3760
* Bump net8/net9/net10 runtime package baselines to patched crypto
servicing versions by @​Copilot in
AzureAD/microsoft-identity-web#3779
* Fix flaky certificate test failures on CI by @​gladjohn in
AzureAD/microsoft-identity-web#3780
* MTLS Without Tokens Support by @​tlupes in
AzureAD/microsoft-identity-web#3747
* Fix CredentialsProvider DI lifetime mismatch causing startup crash in
Development by @​Avery-Dunn in
AzureAD/microsoft-identity-web#3783
* Remove unused DataProtection configuration from Sidecar by @​Copilot
in AzureAD/microsoft-identity-web#3776

## New Contributors
* @​RojaEnnam made their first contribution in
AzureAD/microsoft-identity-web#3763
* @​reginayap8 made their first contribution in
AzureAD/microsoft-identity-web#3769
* @​JaredMSFT made their first contribution in
AzureAD/microsoft-identity-web#3766

**Full Changelog**:
AzureAD/microsoft-identity-web@4.6.0...4.8.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.7.0...4.8.0).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Apr 21, 2026
Merged
Merged
This was referenced May 29, 2026
Merged
Closed
Closed
Merged
Closed
Closed
Closed
Merged
Closed
Closed
Closed
Closed
Open
Open
Merged
gunndabad added a commit to DFE-Digital/teaching-record-system that referenced this pull request Jun 4, 2026
@dependabot @gunndabad
Bump Microsoft.Identity.Web from 4.7.0 to 4.10.0 (#3448)
56d6133 
Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.7.0 to 4.10.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.10.0

### New features
- Add `WithExtraBodyParameters` fluent API for attaching extra body
parameters to token acquisition requests. See
[#​3819](AzureAD/microsoft-identity-web#3819).
- Add `IConfidentialClientApplicationProvider` extensibility interface
and `CachePartitionKey` support for silent token acquisition. See
[#​3822](AzureAD/microsoft-identity-web#3822).

### Bug fixes
- Redirect URI sanitization in authorization scenarios; centralize
redirect URI validation in a shared helper. See
[#​3825](AzureAD/microsoft-identity-web#3825).
- Reject dSTS-shaped `Authority` values with a clearer exception,
steering users to use `Instance` + `TenantId` instead. See
[#​3805](AzureAD/microsoft-identity-web#3805).
- Improve regex handling and adding length/timeout safeguards for
SameSite User Agent. See
[#​3811](AzureAD/microsoft-identity-web#3811).

### Behavior changes
- **B2C OpenID Connect event handler: LRU cache for issuer address.**
Issuer address lookups in the B2C OIDC event handler are now cached with
an LRU cache, improving performance for repeated lookups. See
[#​3821](AzureAD/microsoft-identity-web#3821).

### Dependencies updates
- Update MSAL.NET to 4.84.1. See
[#​3822](AzureAD/microsoft-identity-web#3822).
- Pin `Microsoft.Kiota.Abstractions` to 1.22.0 for GraphServiceClient.
See
[#​3817](AzureAD/microsoft-identity-web#3817).
- Bump `uuid` and `@​azure/msal-node` in SidecarAdapter TypeScript test
app. See
[#​3826](AzureAD/microsoft-identity-web#3826).
- Bump `qs` in SidecarAdapter TypeScript test app. See
[#​3829](AzureAD/microsoft-identity-web#3829).

## 4.9.0

### New features
- **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides`
configuration section provides explicit, per-route control over whether
`optionsOverride.*` query-string parameters are honored. Authenticated
routes default to allowing overrides (preserving existing behavior);
unauthenticated routes default to rejecting them.
`optionsOverride.BaseUrl` is unconditionally rejected on all routes as a
hardening measure. See
[#​3794](AzureAD/microsoft-identity-web#3794).

### Bug fixes
- Fix `AccountController.Challenge` redirect URI validation to reject
percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.)
that could be decoded by misconfigured reverse proxies. See
[#​3792](AzureAD/microsoft-identity-web#3792).

### Behavior changes
- **DownstreamApi: reserved header filtering.** Headers supplied via
`DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved
HTTP headers (`Authorization`, `Host`, `Content-Length`,
`Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header
the library already set are now silently skipped. A warning-level log
entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so
operators can spot misconfigurations. No exception is thrown. See
[#​3793](AzureAD/microsoft-identity-web#3793).

### Dependencies updates
- **Update Azure.Identity 1.11.4 → 1.17.2 and establish
Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity
1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which
introduces a transitive dependency on
`Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on
non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused
a `CS0433` type collision with the previously-pinned
`Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch
individual packages, the entire `Microsoft.Extensions.*` stack on these
older TFMs has been bumped to 8.0.x, closing several 5-year version gaps
and aligning with the net8.0 baseline. **If your application targets
net462, net472, or netstandard2.0**, your resolved
`Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http`
3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0,
`Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already
targeting net8.0+ are unaffected. See
[#​3787](AzureAD/microsoft-identity-web#3787).
- Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See
[#​3787](AzureAD/microsoft-identity-web#3787).
- Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on
net10.0. See
[#​3796](AzureAD/microsoft-identity-web#3796).
- Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3.
See
[#​3788](AzureAD/microsoft-identity-web#3788).

**Full Changelog**:
AzureAD/microsoft-identity-web@4.8.0...4.9.0

## 4.8.0

## What's Changed
* Bump flatted from 3.3.3 to 3.4.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3753
* Update changelog.md for ID.Web 4.6.0 by @​bgavrilMS in
AzureAD/microsoft-identity-web#3756
* Add token binding to MicrosoftIdentityMessageHandler by @​cpp11nullptr
in AzureAD/microsoft-identity-web#3743
* Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by
@​dependabot[bot] in
AzureAD/microsoft-identity-web#3759
* Documentation: Clarify managed identity credential types for
containerized vs. VM/App Service deployments by @​Copilot in
AzureAD/microsoft-identity-web#3585
* Bump path-to-regexp from 8.3.0 to 8.4.0 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3762
* Upgrade Microsoft Application Insights packages by @​RojaEnnam in
AzureAD/microsoft-identity-web#3763
* Use Abstractions 12 by @​pmaytak in
AzureAD/microsoft-identity-web#3761
* Post-4.7.0 by @​pmaytak in
AzureAD/microsoft-identity-web#3768
* Fix Comp Gov DOTNET-Security-10.0 by @​reginayap8 in
AzureAD/microsoft-identity-web#3769
* Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by
@​reginayap8 in
AzureAD/microsoft-identity-web#3770
* fix warnings by @​gladjohn in
AzureAD/microsoft-identity-web#3771
* adding examples for using postgres as a distributed cache by
@​JaredMSFT in
AzureAD/microsoft-identity-web#3766
* Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility
test app by @​Copilot in
AzureAD/microsoft-identity-web#3774
* Bump vite from 7.1.11 to 7.3.2 in
/tests/DevApps/SidecarAdapter/typescript by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3772
* Skip legacy B2C local-account Todo UI test in WebAppUiTests by
@​Copilot in AzureAD/microsoft-identity-web#3778
* Fix initialization of ConfidentialClientApplicationOptions in
MergedOptions by @​cpp11nullptr in
AzureAD/microsoft-identity-web#3760
* Bump net8/net9/net10 runtime package baselines to patched crypto
servicing versions by @​Copilot in
AzureAD/microsoft-identity-web#3779
* Fix flaky certificate test failures on CI by @​gladjohn in
AzureAD/microsoft-identity-web#3780
* MTLS Without Tokens Support by @​tlupes in
AzureAD/microsoft-identity-web#3747
* Fix CredentialsProvider DI lifetime mismatch causing startup crash in
Development by @​Avery-Dunn in
AzureAD/microsoft-identity-web#3783
* Remove unused DataProtection configuration from Sidecar by @​Copilot
in AzureAD/microsoft-identity-web#3776

## New Contributors
* @​RojaEnnam made their first contribution in
AzureAD/microsoft-identity-web#3763
* @​reginayap8 made their first contribution in
AzureAD/microsoft-identity-web#3769
* @​JaredMSFT made their first contribution in
AzureAD/microsoft-identity-web#3766

**Full Changelog**:
AzureAD/microsoft-identity-web@4.6.0...4.8.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.7.0...4.10.0).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.7.0&new-version=4.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Gunn <james@gunn.io>
This was referenced Jun 5, 2026
Closed
Closed
Closed
Closed
Closed
Open
Closed
Merged
Merged
This was referenced Jun 14, 2026
Open
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pmaytak pmaytak pmaytak approved these changes

@neha-bhargava neha-bhargava neha-bhargava approved these changes

@gladjohn gladjohn gladjohn approved these changes

Assignees

@neha-bhargava neha-bhargava

@gladjohn gladjohn

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@reginayap8 @pmaytak @neha-bhargava @gladjohn