Bump the minor-and-patch group with 5 updates

[dependabot]

Updated MessagePack from 3.1.7 to 3.1.8.

Release notes

Sourced from MessagePack's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.11.0 to 4.12.2.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.12.2

Bug fixes

• Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #​3894.

4.12.1

Bug fixes

• Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #​3914.

Behavior changes

• Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #​3906.
• Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #​3919.

Fundamentals

• Build the solution in the PR pipeline before running tests. See #​3911.
• Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #​3912.
• Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #​3913.

4.12.0

New features

• Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #​3899.
• Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #​3905.

Bug fixes

• Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #​3902.

Dependencies updates

• Update Microsoft.Identity.Abstractions to 12.4.0. See #​3899, #​3905.
• Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #​3896.
• Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #​3900.

Commits viewable in compare view.

Updated NBomber from 6.4.1 to 6.5.0.

Release notes

Sourced from NBomber's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated NBomber.Http from 6.2.0 to 6.2.1.

Release notes

Sourced from NBomber.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.Runtime from 1.15.1 to 1.16.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.16.0

• NuGet: OpenTelemetry.Extensions.AWS v1.16.0

  • Fix sampling behaviour to be compatible with .NET 11.
    (#​4396)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWS v1.16.0

  • Add instrumentation scope version and schema URL to metrics and traces.
    (#​4063)

  • Pass AWS attribute values to created meters as tags.
    (#​4063)

  • Capture SNS TopicArn as the aws.sns.topic.arn span attribute.
    (#​4043)

  • Add cloud.region attribute to all AWS SDK client spans.
    (#​4043)

  • Add messaging attributes for AWS SNS and SQS.
    (#​4043)

  • BREAKING: Update latest AWS Semantic Conventions to 1.40.0.
    (#​4043)

  • Fix suppression scope leakage when SuppressDownstreamInstrumentation is
    enabled.
    (#​4304)

  See CHANGELOG for details.

• NuGet: OpenTelemetry.Instrumentation.AWSLambda v1.16.0

  • Update System.Text.Json for netstandard2.0 to 8.0.5.
    (#​4154)

  • Add instrumentation scope version and schema URL to traces.
    (#​4063)

  See CHANGELOG for details.

1.16.0-rc.1

• NuGet: OpenTelemetry.Instrumentation.Process v1.16.0-rc.1

  • Updated semantic conventions to
    v1.42.0.
    (#​4602)

    • Breaking Change: The process.cpu.time metric attribute process.cpu.state
      was renamed to cpu.mode.
    • Added the process.uptime metric.
    • Added the process.windows.handle.count metric (Windows only).
    • Added the process.unix.file_descriptor.count metric (Linux only).

  • Assemblies are now digitally signed using cosign.
    (#​4637)

  • Updated semantic conventions to
    v1.43.0
    and marked package as release candidate.
    (#​4675)

  See CHANGELOG for details.

1.16.0-beta.1

• NuGet: OpenTelemetry.Instrumentation.ServiceFabricRemoting v1.16.0-beta.1

  • Raised the minimum required version of Microsoft.ServiceFabric.Actors and
    Microsoft.ServiceFabric.Services.Remoting from 7.1.2448 to 8.4.268, as the
    7.1 Service Fabric runtime is going out of support.
    (#​4510)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

1.16.0-alpha.1

• NuGet: OpenTelemetry.Instrumentation.EventCounters v1.16.0-alpha.1

  • Fixed OnEventWritten processing events from EventSources that were not
    configured via AddEventSources.
    (#​4031)

  • Updated OpenTelemetry core component version(s) to 1.16.0.
    (#​4487)

  See CHANGELOG for details.

1.15.2

• NuGet: OpenTelemetry.Exporter.Geneva v1.15.2

  • Updated OpenTelemetry core component version(s) to 1.15.3.
    (#​4166)

  See CHANGELOG for details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.