Bump the notsecurity group with 4 updates

[dependabot]

Updated Microsoft.Identity.Client from 4.90.0 to 4.90.1.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.90.1

New Features

• Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #​6165

Bug Fixes

• Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #​6165
• Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #​6155
• Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #​6200

Changes

• Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #​6202

Commits viewable in compare view.

Updated Microsoft.Identity.Client.KeyAttestation from 4.90.0 to 4.90.1.

Release notes

Sourced from Microsoft.Identity.Client.KeyAttestation's releases.

4.90.1

New Features

• Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #​6165

Bug Fixes

• Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #​6165
• Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #​6155
• Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #​6200

Changes

• Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #​6202

Commits viewable in compare view.

Updated Microsoft.IdentityModel.JsonWebTokens from 8.22.0 to 8.23.0.

Release notes

Sourced from Microsoft.IdentityModel.JsonWebTokens's releases.

8.23.0

What's Changed

• Backport configurable SHR p claim path comparison to 8.x by @​debchoudhury-id4s in Backport configurable SHR p claim path comparison to 8.x azure-activedirectory-identitymodel-extensions-for-dotnet#3577
• Backport SHR p-claim percent-encoding hex case handling to dev8x by @​debchoudhury-id4s in Backport SHR p-claim percent-encoding hex case handling to dev8x azure-activedirectory-identitymodel-extensions-for-dotnet#3579
• Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package by @​iNinja in Reinstate Microsoft.IdentityModel.Protocols.WsTrust as a supported 8.x package azure-activedirectory-identitymodel-extensions-for-dotnet#3547
• Include WS-Trust in build pipelines by @​iNinja in Include WS-Trust in build pipelines azure-activedirectory-identitymodel-extensions-for-dotnet#3604
• Log IDX10650 decryption-tag failures below Error during multi-key decryption by @​RojaEnnam in Log IDX10650 decryption-tag failures below Error during multi-key decryption azure-activedirectory-identitymodel-extensions-for-dotnet#3582
• Support ML-DSA AKP keys in JsonWebKeySet by @​iNinja in Support ML-DSA AKP keys in JsonWebKeySet azure-activedirectory-identitymodel-extensions-for-dotnet#3597
• Add Composite ML-DSA support (internal, gated) by @​iNinja in Add Composite ML-DSA support (internal, gated) azure-activedirectory-identitymodel-extensions-for-dotnet#3596

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.22.0...8.23.0

Commits viewable in compare view.

Updated Microsoft.IdentityModel.Tokens.Saml from 5.7.1 to 5.7.2.

Release notes

Sourced from Microsoft.IdentityModel.Tokens.Saml's releases.

5.7.2

What's Changed

• Fix dev5x assembly version generation by @​saurabhsathe-ms in Fix dev5x assembly version generation azure-activedirectory-identitymodel-extensions-for-dotnet#3625
• Pin patched REST client runtime on dev5x by @​saurabhsathe-ms in Pin patched REST client runtime on dev5x azure-activedirectory-identitymodel-extensions-for-dotnet#3634

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@5.7.1...5.7.2

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.