Bump Duende.IdentityServer.Storage from 7.3.2 to 8.0.1#32
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Bump Duende.IdentityServer.Storage from 7.3.2 to 8.0.1#32dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: Duende.IdentityServer.Storage dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: duende ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
Contributor
Author
|
Looks like Duende.IdentityServer.Storage is updatable in another way, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Duende.IdentityServer.Storage from 7.3.2 to 8.0.1.
Release notes
Sourced from Duende.IdentityServer.Storage's releases.
8.0.1
What's changed
ITokenValidator.ValidateAccessTokenAsync— theexpectedScopeparameter is now correctly annotated asstring?to match its intended usage.8.0.0
Duende IdentityServer 8.0
Duende IdentityServer 8.0 targets .NET 10 and marks a significant milestone for the product.
SAML 2.0 is now a first-class protocol alongside OpenID Connect and OAuth 2.0, enabling enterprise and legacy applications to authenticate against your server without requiring separate infrastructure.
This release also introduces a FAPI 2.0/OAuth 2.1 conformance report to help you verify high-security deployments, and delivers substantial internal modernization - including adoption of .NET 10's HybridCache,
TimeProvider, nullable reference types, and pervasive cancellation token support - resulting in a cleaner, more maintainable foundation going forward.New Features
SAML 2.0 Identity Provider
IdentityServer can now act as a full SAML 2.0 Identity Provider, allowing enterprise and legacy applications that require SAML to authenticate against your server alongside OpenID Connect clients.
It supports:
Your existing login UI requires only a small update to the cancellation path. See the SAML 2.0 documentation.
SAML 2.0 External Authentication
IdentityServer can now federate with external SAML 2.0 Identity Providers, letting you use a third-party SAML IdP as an upstream identity source - the same way you'd add Google or Microsoft Entra ID as an external provider. Configure SAML external providers statically or dynamically using the existing dynamic providers mechanism. See Configuring a SAML external provider.
Financial-Grade Security & Conformance Report
A new
Duende.IdentityServer.ConformanceReportpackage assesses your IdentityServer deployment against OAuth 2.1 and FAPI 2.0 Security Profile specifications and generates an HTML report at a protected endpoint (/_duende/conformance-report). Use it to verify your server is correctly configured for high-security API scenarios. See the Conformance Report documentation.User Management
IdentityServer 8 integrates with Duende User Management which adds user registration, password management, MFA (TOTP, passkeys), account recovery, and more. See the User Management documentation.
Improvements
Token Cleanup Performance - The token cleanup service now uses a more efficient bulk delete strategy when
IOperationalStoreNotificationis not registered, reducing database load in high-throughput deployments. MySQL EF Core provider compatibility for PAR entry cleanup is also restored.Orphaned Grants Revoked on Session Overwrite - When a server-side session is overwritten (for example, when a user signs in again without signing out first), refresh tokens belonging to the prior session are now automatically revoked. This prevents stale grants from accumulating and remaining valid after re-authentication.
Quieter Secret Validation Logging - Expected-failure log entries in client and API secret validation have been downgraded from Error to Debug. This reduces noise in production logs where failed secret lookups are a normal part of the secret hashing comparison process.
Relaxed Audience Validation - Audience validation for private key JWT authentication in strict mode now accepts single-element JSON arrays in addition to scalar string values, improving compatibility with tokens from issuers that always serialize audiences as arrays.
HTTP 303 Redirects - All redirects from IdentityServer's authorization endpoint now unconditionally use HTTP 303 See Other, aligning with the OAuth 2.0 and OpenID Connect specifications and avoiding issues with intermediaries that treat 302 redirects differently.
Unified Authorization Context - SAML and OpenID Connect flows now share the same
IAuthenticationContextabstraction. Your login page can access protocol-specific context - including SAML-specific details such asRequestedAuthnContext- through a single consistent interface.... (truncated)
7.4.7
7.4.6
This is a patch release that fixes two issues in IdentityServer.
What's Changed
7.4.5
This is bugfix release that fixes an issue where + characters are not treated correctly in URL queries.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.4...is-7.4.5
7.4.4
This is bugfix release that fixes an issue where specific service registration scenarios would fail due to constructor ambiguity.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.3...is-7.4.4
7.4.3
This is bugfix release that fixes an issue where claims in a session would be duplicated.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.2...is-7.4.3
7.4.2
This is a patch release that fixes a bug in license verification.
What's Changed
7.4.1
This is a patch release that fixes a bug related to CSP hashes.
What's Changed
7.4.0
IdentityServer 7.4.0 is a significant release that includes:
Since the 7.4.0 release candidate, there have been a few minor changes, including:
Note that
Duende.IdentityServer.EntityFramework.Storagenow depends on Entity Framework Core 9.x in thenet8.0target framework, which should be fully supported on both .NET 8 and .NET 9. .NET 10 projects will use Entity Framework Core 10.x.Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.... (truncated)
7.4.0-rc.1
This is the first release candidate of IdentityServer 7.4.0. The changes since the last preview release are:
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.... (truncated)
7.4.0-preview.2
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.Bug Fixes
... (truncated)
7.4.0-preview.1
NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.Bug Fixes
... (truncated)
7.3.4
This is bugfix release that fixes an issue where specific service registration scenarios would fail due to constructor ambiguity.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.3.3...is-7.3.4
7.3.3
This is a minor release which changes how a CSP hash is calculated to prevent future issues and updates the version of
Duende.IdentityModelused to 8.0.0.What's Changed
Breaking Changes
The update to
Duende.IdentityModelcan cause breaking changes as it is a major version. Refer to the Duende.IdentityModel 8.0.0 release notes for upgrade instructions.Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions