Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
Microsoft.EntityFrameworkCore (source)	9.0.10 → 9.0.18			nuget	patch
Microsoft.EntityFrameworkCore.SqlServer (source)	9.0.10 → 9.0.18			nuget	patch
Microsoft.EntityFrameworkCore.Sqlite (source)	9.0.10 → 9.0.18			nuget	patch
Microsoft.EntityFrameworkCore.Tools (source)	9.0.10 → 9.0.18			nuget	patch
NLog.Extensions.Logging	6.0.5 → 6.1.4			nuget	minor
NLog.Web.AspNetCore	6.0.5 → 6.1.4			nuget	minor
System.Diagnostics.DiagnosticSource (source)	9.0.10 → 9.0.18			nuget	patch
System.IdentityModel.Tokens.Jwt	8.14.0 → 8.22.0			nuget	minor
github/codeql-action	v4.37.3 → v4.37.4			action	patch
xunit.runner.visualstudio	3.1.4 → 3.1.5			nuget	patch

---

Release Notes

NLog/NLog.Extensions.Logging (NLog.Extensions.Logging)

v6.1.4

• #​852 Updated to NLog v6.1.4 (@​snakefoot)
• #​850 Fix Sonar Code Smells (@​snakefoot)
• #​847 AppVeyor - Visual Studio 2026 (@​snakefoot)

v6.1.3

• #​838 NLogLoggerFactory DisposeAsync with ConfigureAwait(false) (@​11v1)
• #​834 + #​835 MicrosoftConsoleJsonLayout - Added IncludeActivityIds to output TraceId + SpanId + ParentId (@​snakefoot)
• #​837 MicrosoftConsoleJsonLayout - Keep encoded newlines for Exception (@​snakefoot)
• #​843 Updated to NLog v6.1.3 (@​snakefoot)

v6.1.2

• #​831 MicrosoftConsoleJsonLayout - Forward DottedRecursion to State-JsonLayout (@​snakefoot)
• #​832 Updated to NLog v6.1.1 (@​snakefoot)

v6.1.1

• #​822 NLogLogger - Optimize for default EventId capture (@​snakefoot)
• #​824 Introduced WriteToJsonConsole for fluent API to match AddJsonConsole (@​snakefoot)
• #​825 NLogLoggerProvider - Implement IAsyncDisposable (@​snakefoot)
• #​826 MicrosoftConsoleJsonLayout - Forward MaxRecursionLimit to State-JsonLayout (@​snakefoot)
• #​827 MicrosoftConsoleLayoutRenderer - Apply Span for EventId (@​snakefoot)
• #​828 Replace NETCOREAPP3_1_OR_GREATER with new NET (@​snakefoot)
• #​830 Updated to NLog v6.1 (@​snakefoot)

v6.1.0

• #​818 Added TargetFramework .NET 10 (@​snakefoot)

v6.0.6

• #​817 Updated to NLog v6.0.6 (@​snakefoot)
• #​814 Avoid boxing ITuple when used for BeginScope (@​snakefoot)
• #​813 Allow BeginScope to perform reflection of KeyValuePair (@​snakefoot)

NLog/NLog.Web (NLog.Web.AspNetCore)

v6.1.4

• NLog.Web.AspNetCore

  • #​1151 Updated dependency NLog v6.1.4 (@​snakefoot)
  • #​1145 AppVeyor - Visual Studio 2026 (@​snakefoot)

• NLog.Web

  • #​1151 Updated dependency NLog v6.1.4 (@​snakefoot)
  • #​1145 AppVeyor - Visual Studio 2026 (@​snakefoot)

v6.1.3

• NLog.Web.AspNetCore

  • #​1137 Updated dependency NLog v6.1.3 (@​snakefoot)

• NLog.Web

  • #​1137 Updated dependency NLog v6.1.3 (@​snakefoot)

v6.1.2

• NLog.Web.AspNetCore

  • #​1119 Updated dependency NLog v6.1.1 (@​snakefoot)

• NLog.Web

  • #​1119 Updated dependency NLog v6.1.1 (@​snakefoot)

v6.1.1

• NLog.Web.AspNetCore

  • #​1113 Skip HttpRequest duration check when DurationThresholdMs = Zero (@​snakefoot)
  • #​1115 Updated dependency NLog v6.1 (@​snakefoot)

• NLog.Web

  • #​1113 Skip HttpRequest duration check when DurationThresholdMs = Zero (@​snakefoot)
  • #​1115 Updated dependency NLog v6.1 (@​snakefoot)

v6.1.0

• NLog.Web.AspNetCore
  • #​1110 Added NET10 targetframework (@​snakefoot)
  • #​1110 aspnet-request-tls-handshake supporting NegotiatedCipherSuite + HostName (@​snakefoot)

v6.0.6: Version 6.0.6

• #​1111 Updated to NLog v6.0.6

AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet (System.IdentityModel.Tokens.Jwt)

v8.22.0

Compare Source

What's Changed

• Promote exception to property, add test by @​westin-m in #​3486
• Add IgnoreCaseWhenValidatingAudience flag to audience validation by @​cpp11nullptr in #​3563

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

v8.21.0

Compare Source

v8.20.0

Compare Source

Performance Improvements

• Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3552.
• Add claims dictionary preallocation. See PR #​3542.

Bug Fixes

• Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.2...8.20.0

v8.19.2

Compare Source

What's Changed

• Improve serializer and JWE key unwrap handling by @​iNinja in #​3544

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.1...8.19.2

v8.19.1

Compare Source

====

Bug Fixes

• Update JwtSecurityTokenHandler for IssuerSigningKeyResolverUsingConfiguration to take priority over IssuerSigningKeyResolver, matching the documented contract and the correct behavior already present in JsonWebTokenHandler. See PR #​3519.

v8.19.0

Compare Source

====

New Features

• Add ML-DSA (FIPS 204) post-quantum signature support. See PR #​3479.
• Cache custom crypto providers in CryptoProviderFactory. See PR #​3489.

Bug Fixes

• Disable automatic redirects on default HttpClient for JKU retrieval. See PR #​3494.
• Adjust rented buffer handling in claim set parsing. See PR #​3493.
• Tidy null handling in SAML conditions validation. See PR #​3491.
• Improve validation of jku claim. See PR #​3481.
• Limit telemetry algorithm dimension cardinality. See PR #​3490.
• Add defensive copy of collections in ValidationParameters. See PR #​3492.
• Update TokenValidationParameter copy constructor to make a deep copy. See PR #​3488.
• Update to fail-closed when replay protection isn't configured and other DPoP hardening. See PR #​3505.
• Apply RFC 3986 section 6.2.2 normalization to DPoP htu comparison. See PR #​3509.

v8.18.0

Compare Source

New Features

• Introduced a new interface IConfigurationEventHandlerContextAware<T> that provides context to the configuration event handler implementation, allowing it to optionally bypass a cache lookup. See PR #​3444.
• Added Microsoft.IdentityModel.Dpop — a new package implementing DPoP (Demonstrating Proof-of-Possession) per RFC 9449. Provides both client-side and server-side proof validation with no System.Net.Http dependency. See PR #​3443.

v8.17.0

Compare Source

====

Dependencies

• Downgrade Microsoft.Extensions.Logging.Abstractions to 8.0.0 on .NET 10 to match the version on .NET 8 and .NET 9. See PR #​3435.

v8.16.0

Compare Source

====

New Features

• Add telemetry around signature validation. See PR #​3415 for details.

Fundamentals

• Fix FileVersion format to use two-digit year and day of year. See PR #​3389 for details.

v8.15.0

Compare Source

====

New Features

• Add ECDsa support in X509SecurityKey and JsonWebKeyConverter.ConvertFromX509SecurityKey
  Extended X509SecurityKey and JsonWebKeyConverter.ConvertFromX509SecurityKey to support ECDSA keys.
  See PR #​2377 for details.

Bug Fixes

• Sanitize logs to avoid leaking sensitive data
  Updated logging to sanitize sensitive values, reducing the risk of inadvertently exposing secrets or PII in logs.
  See PR #​3316 for details.
• Optimize log sanitization with SearchValues
  Improved the performance of the log sanitization logic introduced earlier by using SearchValues, making sanitization more efficient in high-throughput scenarios.
  See PR #​3341 for details.
• Update test for IDX10400
  Adjusted the IDX10400 test to align with the current behavior and error messaging.
  See PR #​3314 for details.

Fundamentals

• Add supported algorithm tests
  Added new tests to validate the set of supported cryptographic algorithms, increasing confidence in algorithm coverage and compatibility.
  See PR #​3296 for details.
• Migrate repository agent rules from .clinerules to agents.md
  Moved repository agent/AI-assist rules into markdown documentation to make them more visible and easier to maintain.
  See PR #​3313 for details.
• Migrate Microsoft.IdentityModel.TestExtensions from Newtonsoft.Json to System.Text.Json
  Updated Microsoft.IdentityModel.TestExtensions to use System.Text.Json instead of Newtonsoft.Json, aligning tests with the runtime serialization stack.
  See PR #​3356 for details.
• Disable code coverage comments
  Turned off automated code coverage comments on PRs to reduce noise while retaining coverage data elsewhere.
  See PR #​3349 for details.
• Fix CodeQL alerts
  Addressed CodeQL-reported issues to improve security posture and static analysis cleanliness.
  See PR #​3364 for details.

.NET 10 / SDK and tooling updates

• Building with .NET 10 preview / RC 1
  Updated the repository to build and test against .NET 10.0 preview/RC1, ensuring early compatibility with the upcoming runtime.
  See PRs #​3287, #​3357, and #​3358 for details.
• Fix .NET 10 test execution consistency
  Ensured consistent use of the TargetNetNext parameter across build, test, and pack phases so .NET 10.0 tests execute reliably.
  See PR #​3337 for details.
• Update project files and workflows for .NET 10.0 compatibility
  Adjusted project files and CI workflows to correctly target and run on .NET 10.0, including test and pack scenarios.
  See PR #​3363 for details.
• Update .NET version to meet CG compliance
  Updated the .NET version references to be compliant with corporate governance (CG) requirements.
  See PR #​3353 for details.
• Update Coverlet collector and test SDK
  • Bumped CoverletCollectorVersion to 6.0.4.
    See PR #​3333 for details.
  • Upgraded Microsoft.NET.Test.Sdk to a newer version for improved test reliability and tooling support.
    See PR #​3336 for details.
• Update runTests.ps1 to specify dotnet directory
  Updated runTests.ps1 to accept an explicit dotnet directory, improving test execution robustness in environments with multiple SDK installations.
  See PR #​3368 for details.
• Adjust dotnetcore workflow targeting for .NET 10 SDK
  Iterated on the CI workflow configuration to correctly target the .NET 10 SDK:
  • Temporarily removed targeting of the .NET 10 SDK in dotnetcore.yml.
    See PR #​3335.
  • Reverted that change to restore .NET 10 SDK targeting.
    See PR #​3339 for details.

Documentation

• Update support policy documentation
  Refreshed supportPolicy.md to reflect the latest support policy for IdentityModel.
  See PR #​3367 for details.

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

xunit/visualstudio.xunit (xunit.runner.visualstudio)

v3.1.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[lubomirw]

Dependency bumps only; CI green (build + dotnet test on amd64/arm64, Sonar, CodeQL). Copilot's Npgsql-alignment finding does not apply: provider 9.0.4 is the newest 9.0.x and accepts EF Core [9.0.1, 10.0.0).