Skip to content

deps(fuzz): Bump Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt - #159

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/Jellyfin.Plugin.TwoFactorAuth/multi-4f298b72e2
Open

deps(fuzz): Bump Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt#159
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/Jellyfin.Plugin.TwoFactorAuth/multi-4f298b72e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Microsoft.IdentityModel.Tokens from 8.18.0 to 8.22.0.

Release notes

Sourced from Microsoft.IdentityModel.Tokens's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

8.19.1

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.

8.19.0

New Features

  • Add ML-DSA (FIPS 204) post-quantum signature support. See PR #​3479.
  • Cache custom crypto providers in CryptoProviderFactory. See PR #​3489.

Bug Fixes

  • Disable automatic redirects on default HttpClient for JKU retrieval. See PR #​3494.
  • Adjust rented buffer handling in claim set parsing. See PR #​3493.
  • Tidy null handling in SAML conditions validation. See PR #​3491.
  • Improve validation of jku claim. See PR #​3481.
  • Limit telemetry algorithm dimension cardinality. See PR #​3490.
  • Add defensive copy of collections in ValidationParameters. See PR #​3492.
  • Update TokenValidationParameter copy constructor to make a deep copy. See PR #​3488.
  • Update to fail-closed when replay protection isn't configured and other DPoP hardening. See PR #​3505.
  • Apply RFC 3986 section 6.2.2 normalization to DPoP htu comparison. See PR #​3509.

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 8.18.0 to 8.22.0.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

8.22.0

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

  • Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
  • Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

  • Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

8.19.2

What's Changed

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

8.19.1

Bug Fixes

  • Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.

8.19.0

New Features

  • Add ML-DSA (FIPS 204) post-quantum signature support. See PR #​3479.
  • Cache custom crypto providers in CryptoProviderFactory. See PR #​3489.

Bug Fixes

  • Disable automatic redirects on default HttpClient for JKU retrieval. See PR #​3494.
  • Adjust rented buffer handling in claim set parsing. See PR #​3493.
  • Tidy null handling in SAML conditions validation. See PR #​3491.
  • Improve validation of jku claim. See PR #​3481.
  • Limit telemetry algorithm dimension cardinality. See PR #​3490.
  • Add defensive copy of collections in ValidationParameters. See PR #​3492.
  • Update TokenValidationParameter copy constructor to make a deep copy. See PR #​3488.
  • Update to fail-closed when replay protection isn't configured and other DPoP hardening. See PR #​3505.
  • Apply RFC 3986 section 6.2.2 normalization to DPoP htu comparison. See PR #​3509.

Commits viewable in compare view.

@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, fuzz. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This was referenced Aug 3, 2026
Closed
Closed
@dependabot
dependabot Bot force-pushed the dependabot/nuget/src/Jellyfin.Plugin.TwoFactorAuth/multi-4f298b72e2 branch from 5ac1c7d to eaa6b67 Compare August 4, 2026 17:33
@dependabot
deps(fuzz): Bump Microsoft.IdentityModel.Tokens and System.IdentityMo…
606958e 
…del.Tokens.Jwt

Bumps Microsoft.IdentityModel.Tokens from 8.18.0 to 8.22.0
Bumps System.IdentityModel.Tokens.Jwt from 8.18.0 to 8.22.0

---
updated-dependencies:
- dependency-name: Microsoft.IdentityModel.Tokens
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/src/Jellyfin.Plugin.TwoFactorAuth/multi-4f298b72e2 branch from eaa6b67 to 606958e Compare August 4, 2026 17:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants