Update dependency Microsoft.IdentityModel.Protocols.OpenIdConnect to 8.3.0 and Microsoft.Identity.Web to 3.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Microsoft.IdentityModel.Protocols.OpenIdConnect	8.2.0 -> 8.3.0

---

Release Notes

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet (Microsoft.IdentityModel.Protocols.OpenIdConnect)

v8.3.0

Compare Source

=====

New features

Work related to redesign of IdentityModel's token validation logic #​2711

• SAML and SAML2 new model validation: Token Replay. See #​2994
• Extensibility tests: Token Type - JWT (#​3030), Issuer - SAML and SAML2 (#​3026), Algorithm and Signature - JWT, SAML and SAML2 (#​3034), Token Replay - JWT, SAML and SAML2 (#​3032), Issuer signing key - JWT, SAML and SAML2 (#​3029)
• Avoid code duplication in extensibility testing. See #​3041
• Extensibility Testing: Refactor. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3011
• Remove duplicate code in extensibility tests. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3044

Bug fixes

• Fix bug with AadIssuerValidator. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3042
• Fixed SignedHttpRequest flaky test. See #​3037

Fundamentals

• Install all .NET versions in pipeline to fix run tests task. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3018
• Changelog for 8.2.1. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3009
• Remove unnecessary AoT test project. See in https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3045
• Fix powershell script for nuget update. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3046
• Update to next version. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3010
• Disable Coverage PR comments. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3048
• Updates GitHub Action to support long paths, See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3049
• Stack parameters to improve reading of code. by @​brentschmaltz in https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3031

New Contributors

• @​ssmelov made their first contribution in https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/3042

v8.2.1

Compare Source

=====

New features

• Update to use .NET 9 GA. See 2990.

Bug fixes

• Remove dependency on Microsoft.Bcl.TimeProvider for .NET 8+ targets. See 2935.
• Update cgmanifest to align with the JSON schema. See 2969.

Fundamentals

• Streamline token creation by using SecurityTokenDescriptor. See 2993.
• Prevent inlining to guarantee stack frames in test. See 2999.

Work related to redesign of IdentityModel's token validation logic #​2711

• Simplify stack frame caching. See 2976.
• Implement new model for reading SAML and SAML2 tokens. See 2980.
• Implement new model for validating SAML signature. See 2950.
• Add tests for IssuerExtensibility. See 2987.
• Switch to new validation model for SAML and SAML2 issuer signing key. See 2965.
• Switch to new validation model for SAML and SAML2 algorithm. See 2984.

---

Configuration

📅 Schedule: Branch creation - "before 5am on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Piedone]

Could you please check this and #17174 @kevinchalet and manually fix what we need to do?

[kevinchalet]

Could you please check this and #17174 @kevinchalet and manually fix what we need to do?

The other PR fails because it bumps Microsoft.Identity.Web but not Microsoft.IdentityModel.Protocols.OpenIdConnect, which is updated separately, in this PR.

I'll close the other one and update this one manually to bump both references, but you should consider configuring the bot to group dependencies updates instead of sending a PR per reference, otherwise it will happen again, and again, and again 😄

[github-actions]

This pull request has merge conflicts. Please resolve those before requesting a review.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[Piedone]

Thank you! Grouping is possible and I've also set up a couple of these. OpenIddict packages are all in one group too. I've now put Microsoft.IdentityModel.Protocols.OpenIdConnect and Microsoft.Identity.Web into a group too, please check: #17187

Did you remove the comment here deliberately? If not, I'll re-add it there.

[kevinchalet]

Did you remove the comment here deliberately? If not, I'll re-add it there.

Yeah, it was on purpose: #17018 (comment)

(and since updates are now automated, there's no point having a comment that the bot will never honor anyway 😄)

[Piedone]

OK then :).