Bump Duende.IdentityServer.Storage from 7.3.2 to 8.0.2#9
Bump Duende.IdentityServer.Storage from 7.3.2 to 8.0.2#9dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
.NET
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1fd2033. Configure here.
| <PackageVersion Include="Duende.IdentityServer.EntityFramework" Version="7.3.2" /> | ||
| <PackageVersion Include="Duende.IdentityServer.EntityFramework.Storage" Version="7.3.2" /> | ||
| <PackageVersion Include="Duende.IdentityServer.Storage" Version="7.3.2" /> | ||
| <PackageVersion Include="Duende.IdentityServer.Storage" Version="8.0.0" /> |
There was a problem hiding this comment.
Mismatched Duende package majors
High Severity
Updating Duende.IdentityServer.Storage to 8.0.0 while other Duende.IdentityServer packages remain at 7.3.2 creates a split major-version stack. Identity.API references these, risking restore conflicts and runtime failures, as Duende recommends an all-or-nothing upgrade.
Reviewed by Cursor Bugbot for commit 1fd2033. Configure here.
--- updated-dependencies: - dependency-name: Duende.IdentityServer.Storage dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: duende ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/nuget/duende-1e7674736e
branch
from
1fd2033 to
4f55226
Compare
|
Looks like Duende.IdentityServer.Storage is updatable in another way, so this is no longer needed. |
dependabot
Bot
changed the title
Updated Duende.IdentityServer.Storage from 7.3.2 to 8.0.2.
Release notes
Sourced from Duende.IdentityServer.Storage's releases.
8.0.2
What's changed
AddConfigurationStorewithout a license that includes the Dynamic Identity Providers feature. The EF configuration store registers anIIdentityProviderStoreimplementation, which incorrectly triggered a license check for Dynamic Identity Providers even when the feature was not in use.8.0.1
What's changed
ITokenValidator.ValidateAccessTokenAsync— theexpectedScopeparameter is now correctly annotated asstring?to match its intended usage.8.0.0
Duende IdentityServer 8.0
Duende IdentityServer 8.0 targets .NET 10 and marks a significant milestone for the product.
SAML 2.0 is now a first-class protocol alongside OpenID Connect and OAuth 2.0, enabling enterprise and legacy applications to authenticate against your server without requiring separate infrastructure.
This release also introduces a FAPI 2.0/OAuth 2.1 conformance report to help you verify high-security deployments, and delivers substantial internal modernization - including adoption of .NET 10's HybridCache,
TimeProvider, nullable reference types, and pervasive cancellation token support - resulting in a cleaner, more maintainable foundation going forward.New Features
SAML 2.0 Identity Provider
IdentityServer can now act as a full SAML 2.0 Identity Provider, allowing enterprise and legacy applications that require SAML to authenticate against your server alongside OpenID Connect clients.
It supports:
Your existing login UI requires only a small update to the cancellation path. See the SAML 2.0 documentation.
SAML 2.0 External Authentication
IdentityServer can now federate with external SAML 2.0 Identity Providers, letting you use a third-party SAML IdP as an upstream identity source - the same way you'd add Google or Microsoft Entra ID as an external provider. Configure SAML external providers statically or dynamically using the existing dynamic providers mechanism. See Configuring a SAML external provider.
Financial-Grade Security & Conformance Report
A new
Duende.IdentityServer.ConformanceReportpackage assesses your IdentityServer deployment against OAuth 2.1 and FAPI 2.0 Security Profile specifications and generates an HTML report at a protected endpoint (/_duende/conformance-report). Use it to verify your server is correctly configured for high-security API scenarios. See the Conformance Report documentation.User Management
IdentityServer 8 integrates with Duende User Management which adds user registration, password management, MFA (TOTP, passkeys), account recovery, and more. See the User Management documentation.
Improvements
Token Cleanup Performance - The token cleanup service now uses a more efficient bulk delete strategy when
IOperationalStoreNotificationis not registered, reducing database load in high-throughput deployments. MySQL EF Core provider compatibility for PAR entry cleanup is also restored.Orphaned Grants Revoked on Session Overwrite - When a server-side session is overwritten (for example, when a user signs in again without signing out first), refresh tokens belonging to the prior session are now automatically revoked. This prevents stale grants from accumulating and remaining valid after re-authentication.
Quieter Secret Validation Logging - Expected-failure log entries in client and API secret validation have been downgraded from Error to Debug. This reduces noise in production logs where failed secret lookups are a normal part of the secret hashing comparison process.
Relaxed Audience Validation - Audience validation for private key JWT authentication in strict mode now accepts single-element JSON arrays in addition to scalar string values, improving compatibility with tokens from issuers that always serialize audiences as arrays.
HTTP 303 Redirects - All redirects from IdentityServer's authorization endpoint now unconditionally use HTTP 303 See Other, aligning with the OAuth 2.0 and OpenID Connect specifications and avoiding issues with intermediaries that treat 302 redirects differently.
Unified Authorization Context - SAML and OpenID Connect flows now share the same
IAuthenticationContextabstraction. Your login page can access protocol-specific context - including SAML-specific details such asRequestedAuthnContext- through a single consistent interface.... (truncated)
7.4.7
7.4.6
This is a patch release that fixes two issues in IdentityServer.
What's Changed
7.4.5
This is bugfix release that fixes an issue where + characters are not treated correctly in URL queries.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.4...is-7.4.5
7.4.4
This is bugfix release that fixes an issue where specific service registration scenarios would fail due to constructor ambiguity.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.3...is-7.4.4
7.4.3
This is bugfix release that fixes an issue where claims in a session would be duplicated.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.4.2...is-7.4.3
7.4.2
This is a patch release that fixes a bug in license verification.
What's Changed
7.4.1
This is a patch release that fixes a bug related to CSP hashes.
What's Changed
7.4.0
IdentityServer 7.4.0 is a significant release that includes:
Since the 7.4.0 release candidate, there have been a few minor changes, including:
Note that
Duende.IdentityServer.EntityFramework.Storagenow depends on Entity Framework Core 9.x in thenet8.0target framework, which should be fully supported on both .NET 8 and .NET 9. .NET 10 projects will use Entity Framework Core 10.x.Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.... (truncated)
7.4.0-rc.1
This is the first release candidate of IdentityServer 7.4.0. The changes since the last preview release are:
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.... (truncated)
7.4.0-preview.2
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was removed. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.Bug Fixes
... (truncated)
7.4.0-preview.1
NOTE: There were minor issues with this release. There is a Preview 2 package available which should be used instead.
IdentityServer 7.4.0 is a significant release that includes:
Breaking Changes
There are no schema changes needed for IdentityServer 7.4.0. Small code changes maybe be required for some users to upgrade.
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicTelemetry.csas readonlyRemoved the unused
Duende.IdentityServer.Models.DiscoveryDocumentclass which was publicIn the process of internal code cleanup, this unused and unreferenced file was used. If code was referencing this file, see the linked PR to create a local copy in the code base needing it.
Marked static properties referring to counters in
Telemetry.csasreadonlyIn the process of internal code cleanup, these properties were updated to be marked as
readonly. Code should not have been updating these properties as it would likely change the behavior of the telemetry emitted by IdentityServer. Any code which was updating these properties should instead create its own counters for its specific scenario.Enhancements
PathMatchingCallbacksetting can be used as an alternative to the previously existingPathPrefixoption.DefaultUiLocalsService.cs, delegates to theCookieRequestCultureProviderif it is present and any of the values passed in theui_locales parametermatch a supported UI culture.IUiLocalesServicecan be implemented and registered with DI.CustomParametersproperty toAuthorizeResponseto support adding custom query parameters to the redirect uri. This will typically be used in conjunction with a customIAuthorizeResponseGenerator.ISessionClaimsFilter.FilterToSessionClaimsAsyncwhich comes with a default implementation.Bug Fixes
... (truncated)
7.3.4
This is bugfix release that fixes an issue where specific service registration scenarios would fail due to constructor ambiguity.
What's Changed
Full Changelog: DuendeSoftware/products@is-7.3.3...is-7.3.4
7.3.3
This is a minor release which changes how a CSP hash is calculated to prevent future issues and updates the version of
Duende.IdentityModelused to 8.0.0.What's Changed
Breaking Changes
The update to
Duende.IdentityModelcan cause breaking changes as it is a major version. Refer to the Duende.IdentityModel 8.0.0 release notes for upgrade instructions.Commits viewable in compare view.