[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updated Microsoft.ApplicationInsights.WorkerService from 3.1.2 to 3.2.0.

Release notes

Sourced from Microsoft.ApplicationInsights.WorkerService's releases.

3.2.0

• Update OpenTelemetry core packages to 1.19.1, instrumentation packages to 1.19.0, and Azure Monitor OpenTelemetry Exporter to 1.10.0.
• Breaking change: Reduce default HTTP client metric volume in ASP.NET Core and Worker Service on .NET 8+ while retaining request latency, count, and failure dimensions through http.client.request.duration. Other System.Net.Http metrics are now opt-in through OpenTelemetry AddView; dashboards and alerts using them must explicitly enable collection. HTTP dependency tracing and server metrics are unchanged. No new public API is introduced. Addresses the HTTP metric-volume concern in #​3192.
• Fix #​3197: NullReferenceException when using TelemetryClient APIs when no connection string is provided.
• Fix #​3211: TelemetryClient.TrackDependency(DependencyTelemetry) and TelemetryClient.TrackRequest(RequestTelemetry) now default an unset Timestamp to DateTimeOffset.UtcNow (restoring 2.x behavior) instead of emitting 0001-01-01T00:00:00Z, which ingestion rejects.
• Fix #​3223: The WEB package's activity processors now write the tag keys the Azure Monitor exporter maps (enduser.pseudo.id, microsoft.session.id, microsoft.synthetic_source, microsoft.user.account_id), so user_Id, session_Id, operation_SyntheticSource and user_AccountId are populated again instead of the values landing in customDimensions as ai.user.id, session.id, ai.operation.syntheticSource and enduser.account. user_AccountId is also no longer skipped when the authenticated user cookie is present, and the unmapped session.isFirst custom dimension is no longer emitted.
• Fix StartOperation/StopOperation losing or misreporting telemetry fields. Stopping an operation now exports the fields set on its telemetry item using the same keys as TrackDependency/TrackRequest: dependency Type, Data, Target and ResultCode (previously wrong or empty for HTTP, SQL, Queue Message and custom types), request Url, Source and ResponseCode, Success, and custom Properties. The unmapped OperationName and messaging.destination tags no longer appear as custom dimensions.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Design's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.11 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Graph from 6.6.0 to 6.9.0.

Release notes

Sourced from Microsoft.Graph's releases.

6.9.0

6.9.0 (2026-10-22)

Features

• generation: update request builders and models (#​3205) (968484b)

6.8.0

6.8.0 (2026-10-06)

Features

• generation: update request builders and models (2538962)

6.7.0

6.7.0 (2026-09-15)

Features

• generation: update request builders and models (#​3178) (cdab22e)

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.14.2 to 4.16.1.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.16.1

What's Changed

• Security fixes and general reliability improvements.

Full Changelog: AzureAD/microsoft-identity-web@4.16.0...4.16.1

4.16.0

What's Changed

• Add 4.15.0 release notes by @​iarekk in Add 4.15.0 release notes AzureAD/microsoft-identity-web#4050
• Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in Post-release 4.15.0: mark APIs shipped and bump version AzureAD/microsoft-identity-web#4060
• Add Sidecar 1.1.2 changelog by @​soodt in Add Sidecar 1.1.2 changelog AzureAD/microsoft-identity-web#4070
• Fix FIC telemetry enrichment during credential warm-up and assertion cache hits by @​neha-bhargava in Fix FIC telemetry enrichment during credential warm-up and assertion cache hits AzureAD/microsoft-identity-web#4072
• Update agentic docs to cover current behavior by @​Avery-Dunn in Update agentic docs to cover current behavior AzureAD/microsoft-identity-web#4077
• Bump the notsecurity group with 4 updates by @​dependabot[bot] in Bump the notsecurity group with 4 updates AzureAD/microsoft-identity-web#4074

Full Changelog: AzureAD/microsoft-identity-web@4.15.0...4.16.0

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated Microsoft.Identity.Web.UI from 4.14.2 to 4.16.1.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.16.1

What's Changed

• Security fixes and general reliability improvements.

Full Changelog: AzureAD/microsoft-identity-web@4.16.0...4.16.1

4.16.0

What's Changed

• Add 4.15.0 release notes by @​iarekk in Add 4.15.0 release notes AzureAD/microsoft-identity-web#4050
• Post-release 4.15.0: mark APIs shipped and bump version by @​iarekk in Post-release 4.15.0: mark APIs shipped and bump version AzureAD/microsoft-identity-web#4060
• Add Sidecar 1.1.2 changelog by @​soodt in Add Sidecar 1.1.2 changelog AzureAD/microsoft-identity-web#4070
• Fix FIC telemetry enrichment during credential warm-up and assertion cache hits by @​neha-bhargava in Fix FIC telemetry enrichment during credential warm-up and assertion cache hits AzureAD/microsoft-identity-web#4072
• Update agentic docs to cover current behavior by @​Avery-Dunn in Update agentic docs to cover current behavior AzureAD/microsoft-identity-web#4077
• Bump the notsecurity group with 4 updates by @​dependabot[bot] in Bump the notsecurity group with 4 updates AzureAD/microsoft-identity-web#4074

Full Changelog: AzureAD/microsoft-identity-web@4.15.0...4.16.0

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.4 to 3.1.5.

Release notes

Sourced from xunit.runner.visualstudio's releases.

3.1.5

Release notes: https://xunit.net/releases/visualstudio/3.1.5

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[virtitnerd]

@dependabot recreate