Bump the all-actions group with 3 updates

[dependabot]

Updated Auth0.AspNetCore.Authentication from 1.9.0 to 1.10.0.

Release notes

Sourced from Auth0.AspNetCore.Authentication's releases.

1.10.0

Added

• Upstream IdP session expiry (IPSIE SL1) enforcement #​272 (tanya732) - when Auth0 brokers an upstream identity provider that enforces its own session lifetime, that ceiling now caps the session in the application too, so a user is not kept signed in past the point the upstream IdP considers their session over. Enforcement is automatic and requires no code opt-in; it activates only when the connection emits a session_expiry claim (Unix seconds) on the ID token (connection option id_token_session_expiry_supported).

Security

• Bump dependencies #​274 (dependabot[bot]) - consolidates several Dependabot bumps (supersedes #​267, #​271): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.2 → 8.22.0.
• Dependency updates #​266 (kailash-b) - bundles a set of routine Dependabot updates keeping both the NuGet package references and GitHub Actions workflow versions current.
  • NuGet packages: Microsoft.AspNetCore.Mvc.Testing 10.0.9 → 10.0.10, Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.1 → 8.19.2, Microsoft.NET.Test.Sdk 18.6.0 → 18.8.1, System.Text.Encodings.Web 10.0.9 → 10.0.10.

Commits viewable in compare view.

Updated Auth0.ManagementApi from 9.0.0 to 9.2.0.

Release notes

Sourced from Auth0.ManagementApi's releases.

9.2.0

Added

• Organization-level roles: Roles can now be scoped to an organization instead of the tenant. Role create requests and responses carry a role type (tenant or organization, defaulting to tenant) and an owner_id identifying the owning organization, and role listing can be filtered by both. A new client.Organizations.Roles.Groups.ListAsync(...) sub-client lists the groups assigned to a role within an organization using checkpoint pagination, and four *:organization_clients OAuth scopes were added. Note that the existing role-member and role-user listings return direct assignments only - group-based assignments are retrieved through the new groups listing or the organization effective-roles endpoint #​1088 (fern-api[bot])
• Organization-to-app entitlement: A new client.Organizations.Clients sub-client associates clients with an organization and manages those associations - list (checkpoint paginated), associate one or more clients, remove associations, and get or update a single association, including whether a client is used for member access. Organizations expose an is_app_entitlement_active flag on create, update, and read, and organization listing accepts an include_client_association_for client ID that annotates each returned organization with the matching client association #​1088 (fern-api[bot])
• Google Workspace group synchronization: Directory provisioning gains incremental group-selection management - AddSynchronizedGroupSelectionsAsync(...) and DeleteSynchronizedGroupSelectionsAsync(...) add and remove individual groups without replacing the whole selection set, complementing the existing full-replacement call. Synchronized groups now report their name, email, and direct member count, group listing supports a Lucene prefix-search query, and Self-Service SSO tickets can enable group sync for Google Workspace alongside user sync #​1088 (fern-api[bot])
• Agents client: New top-level client.Agents sub-client for managing agent identities - list (checkpoint paginated), create, read, update, and delete. Agents carry a name, arbitrary metadata, an optional associated client ID, and an optional immutable tenant-unique external identifier. Four *:agents OAuth scopes were added for these operations #​1088 (fern-api[bot])
• Guardian factor settings: MFA factors can now return factor-specific settings (OTP length and OTP expiration time) when requested #​1088 (fern-api[bot])
• Connected accounts without an upstream user ID: Connection connected-accounts configuration accepts allow_missing_user_id, permitting at most one connected account per user per connection with no upstream identity provider user ID. The default preserves the existing strict behaviour #​1088 (fern-api[bot])
• Event stream delivery timing: Delivery attempts now report their duration in milliseconds, and the country_codes ACUL screen context was added #​1088 (fern-api[bot])
• include_totals on more listings: Client grants, client-grant organizations, connections, flow executions, groups, organizations, and organization members listings now accept include_totals to return a result count alongside the results #​1088 (fern-api[bot])

Changed

• Enabling an organization connection can now surface a 409 Conflict, with ConflictSchema and NotFoundSchema added as typed error bodies #​1088 (fern-api[bot])

Fixed

• EventStreams.Deliveries.ListAsync(...) return type changed from WithRawResponseTask<IEnumerable<EventStreamDelivery>> to Task<Pager<EventStreamDelivery>>, bringing deliveries in line with the checkpoint pagination used elsewhere in the SDK. await foreach over the result still works; code that assigned the result to an IEnumerable<...> variable, enumerated it synchronously, or called .WithRawResponse() on it must be updated.
• EventStreamCloudEvent.Data type changed from an encoded string to a dictionary of event properties, so event contents no longer need manual deserialization. Code that read Data as a string - or deserialized it itself - must be updated to read the properties directly.

9.1.0

Added

• Cross-App Access (resource-app side): Added CrossAppAccessResourceApp support to connections via CreateCrossAppAccessResourceApp / UpdateCrossAppAccessResourceApp request types, the ConnectionCrossAppAccessResourceApp response type, and the CrossAppAccessResourceAppStatusEnum / ConnectionCrossAppAccessResourceAppStatusEnum status enums. A CrossAppAccessResourceApp property is added to connection create/update requests and responses (CreateConnectionRequestContent, UpdateConnectionRequestContent, CreateConnectionRequestContentOidc, UpdateConnectionRequestContentOidc, ConnectionResponseContentOidc, ConnectionForList, and the connection response types), letting a connection act as the resource-app side of a Cross App Access relationship #​1072 (fern-api[bot])
• Identity Assertion Authorization Grant (ID-JAG for Cross App Access): Added IdentityAssertionAuthorizationGrant type with CreateIdentityAssertionAuthorizationGrant / UpdateIdentityAssertionAuthorizationGrant request types, exposed as an IdentityAssertionAuthorizationGrant property on CreateClientRequestContent, UpdateClientRequestContent, and the Client response. When active, a client can exchange ID-JAGs for access tokens #​1072 (fern-api[bot])
• Session Actor: Added SessionActorMetadata type and the SessionActorClaimValue union (string/bool/number), exposed as an Actor property on the session response types (GetSessionResponseContent, SessionResponseContent, UpdateSessionResponseContent) — represents the delegating party on delegated sessions (sub plus up to 5 additional primitive claims) #​1072 (fern-api[bot])
• Self-Service Profiles: Added ThirdPartyClientAccessConfig type and a ThirdPartyClientAccessConfig property on CreateSelfServiceProfileSsoTicketRequestContent, controlling whether third-party apps can configure the connection as a domain-level connection during Self-Service Enterprise Configuration #​1072 (fern-api[bot])
• Branding Themes: Added BrandingThemeIdentifiers type with login display, OTP autocomplete, and phone display formatting/masking enums (BrandingThemeIdentifiersLoginDisplayEnum, BrandingThemeIdentifiersPhoneDisplay, BrandingThemeIdentifiersPhoneDisplayFormattingEnum, BrandingThemeIdentifiersPhoneDisplayMaskingEnum), plus an Identifiers property on the theme create/update request and response types (CreateBrandingThemeRequestContent, UpdateBrandingThemeRequestContent, CreateBrandingThemeResponseContent, UpdateBrandingThemeResponseContent, GetBrandingThemeResponseContent, GetBrandingDefaultThemeResponseContent) #​1072 (fern-api[bot])
• Attack Protection: Added SuspiciousIpThrottlingPreCustomTokenExchangeStage, added as a pre-custom-token-exchange stage on SuspiciousIpThrottlingStage #​1072 (fern-api[bot])
• TenantDomain client option: Added ClientOptions.TenantDomain; when set without an explicit BaseUrl, ManagementApiClient derives BaseUrl as https://{TenantDomain}/api/v2. An explicit BaseUrl always takes precedence #​1072 (fern-api[bot])
• Response decompression: Added gzip/deflate response decompression via a new DefaultHttpClientFactory #​1072 (fern-api[bot])

Commits viewable in compare view.

Updated NSubstitute from 6.0.0 to 6.1.0.

Release notes

Sourced from NSubstitute's releases.

6.1.0

NSubstitute v6.1.0

This release reverts nullability support introduced in 6.0. This change caused a number of problems for callers (#​973, #​976), and trying to resolve these (#​976) revealed the need for more fundamental changes to NSubstitute to effectively support this. As a result, nullability is again disabled for public API. Huge thanks to @​jdb0123, @​Romfos, and @​Moha-sami for their PRs addressing this, and thanks for all those who raised issues. We also humbly award @​zvirja with one unlimited "I told you so" pass to use as he sees fit.

What's Changed

• Add new argument matcher for comparing objects by reference by @​Wer-Wolf in Add new argument matcher for comparing objects by reference nsubstitute/NSubstitute#963
• Revert nullability changes in Revert nullability changes nsubstitute/NSubstitute#985

New Contributors

• @​Wer-Wolf made their first contribution in Add new argument matcher for comparing objects by reference nsubstitute/NSubstitute#963

Full Changelog: nsubstitute/NSubstitute@v6.0.0...v6.1.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🤖 Dependency Update PR

This PR was opened by dependabot[bot] and has been automatically labeled for Boromir (DevOps) to review.

Labels applied:

• squad:boromir — Assigned to DevOps for dependency updates
• squad — In triage queue

Dependency and infrastructure updates are owned by the DevOps team.

[github-actions]

Test Results Summary

556 tests  ±0   518 ✅ ±0   15s ⏱️ +2s
  6 suites ±0    38 💤 ±0 
  6 files   ±0     0 ❌ ±0 

Results for commit 74cbd60. ± Comparison against base commit 938e8be.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.78%. Comparing base (938e8be) to head (74cbd60).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #463   +/-   ##
=======================================
  Coverage   76.78%   76.78%           
=======================================
  Files          71       71           
  Lines        1775     1775           
  Branches      214      214           
=======================================
  Hits         1363     1363           
  Misses        336      336           
  Partials       76       76           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.