fix(dotnet): Bump the dependencies group with 5 updates

[dependabot]

Updated Intility.Authorization.Azure.GuestPolicies from 2.2.1 to 2.2.2.

Release notes

Sourced from Intility.Authorization.Azure.GuestPolicies's releases.

2.2.2

2.2.2 (2026-02-20)

Bug Fixes

• Bump the minor-patch-updates group with 1 update (5ac3583)
• harden GitHub Actions workflows and update dependabot config (e123423)
• Use framework-appropriate package versions for Microsoft.AspNetCore.Authorization (62a01cd)

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.2 to 10.0.3.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Azure.AppConfiguration.AspNetCore from 8.4.0 to 8.5.0.

Release notes

Sourced from Microsoft.Azure.AppConfiguration.AspNetCore's releases.

8.5.0-preview

Microsoft.Extensions.Configuration.AzureAppConfiguration 8.5.0-preview - November 14th, 2025

Enhancements

• Added a new method ConnectAzureFrontDoor to AzureAppConfigurationOptions, which can be used to load configuration settings from Azure App Configuration via an Azure Front Door endpoint. This enables client (browser) applications to take advantage of CDN benefits, such as scale, when fetching configuration. #​706

Microsoft.Azure.AppConfiguration.AspNetCore 8.5.0-preview - November 14th, 2025

• Updated Microsoft.Extensions.Configuration.AzureAppConfiguration reference to 8.5.0-preview. See the release notes for more information on the changes.

Microsoft.Azure.AppConfiguration.Functions.Worker 8.5.0-preview - November 14th, 2025

• Updated Microsoft.Extensions.Configuration.AzureAppConfiguration reference to 8.5.0-preview. See the release notes for more information on the changes.

Commits viewable in compare view.

Updated Microsoft.Identity.Web from 4.3.0 to 4.4.0.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.4.0

New features

• Add AOT-compatible web API authentication for .NET 10+. See #​3705 and #​3664.
• Propagate long-running web API session key back to callers in user token acquisition. See #​3728.
• Add OBO event initialization for OBO APIs. See #​3724.
• Add support for calling WithClientClaims flow for token acquisition. See #​3623.
• Add OnBeforeTokenAcquisitionForOnBehalfOf event. See #​3680.

Bug fixes

• Throw InvalidOperationException with actionable message when a custom credential is not registered. See #​3626.
• Fix event firing for InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync. See #​3717.
• Update OnBeforeTokenAcquisitionForOnBehalfOf to construct ClaimsPrincipal from token. See #​3714.
• Add a retry counter for acquire token and updated tests with a fake secret. See #​3682.
• Fix OBO user error handling. See #​3712.
• Fix override merging for app token (and others). See #​3644.
• Fix certificate reload logic to only trigger on certificate-specific errors. See #​3653.
• Update ROPC flow CCA to pass SendX5C to MSAL. See #​3671.

Dependencies updates

• Bump qs in /tests/DevApps/SidecarAdapter/typescript. See #​3725.
• Downgrade Microsoft.Extensions.Configuration.Binder to 2.1.0 on .NET Framework. See #​3730.
• Update .NET SDK to 10.0.103 to address DOTNET-Security-10.0 vulnerability. See #​3726.
• Upgrade to Microsoft.Identity.Abstractions 11 for AoT compatibility. See #​3699.
• Update to MSAL 4.81.0. See #​3665.

Documentation

• Add documentation for auto-generated session key for long-running OBO session. See #​3729.
• Improve the Aspire doc article and skills. See #​3695.
• Add an article and agent skill to add Entra ID to an Aspire app. See #​3689.
• Fix misleading comment in CertificatelessOptions.ManagedIdentityClientId. See #​3667.
• Add Copilot explore tool functionality. See #​3694.

Fundamentals

• Remove unnecessary warning suppression. See #​3715.
• Migrate labs to Lab.API 2.x (first pass). See #​3710.
• Update Sidecar E2E test constants. See #​3693.
• Fix intermittent failures in CertificatesObserverTests. See #​3687.
• Add validation baseline exclusions. See #​3684.
• Add dSTS integration tests. See #​3677.
• Fix FIC test. See #​3663.
• Update IdentityWeb version, build logic, and validation. See #​3659.

New Contributors

• @​XiaoxinMS2 made their first contribution in Add dSTS integration tests AzureAD/microsoft-identity-web#3677
• @​RyAuld made their first contribution in Fix intermittent failures in CertificatesObserverTests AzureAD/microsoft-identity-web#3687
• @​agocke made their first contribution in Update AOT annotations AzureAD/microsoft-identity-web#3664
• @​MZOLN made their first contribution in Remove unnecessary flag switch that causes official build to break. AzureAD/microsoft-identity-web#3700
• @​christian-posta made their first contribution in Fix override merging for app token (and others) AzureAD/microsoft-identity-web#3644
• @​4gust made their first contribution in Added retry counter for acquire token and modified added a test with … AzureAD/microsoft-identity-web#3682
• @​rayluo made their first contribution in Update OnBeforeTokenAcquisitionForOnBehalfOf event to construct ClaimsPricipal from token AzureAD/microsoft-identity-web#3714

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore from 10.1.1 to 10.1.4.

Release notes

Sourced from Swashbuckle.AspNetCore's releases.

10.1.4

What's Changed

• Bump swagger-ui-dist from 5.31.0 to 5.31.1 in /src/Swashbuckle.AspNetCore.SwaggerUI by @​dependabot in Bump swagger-ui-dist from 5.31.0 to 5.31.1 in /src/Swashbuckle.AspNetCore.SwaggerUI domaindrivendev/Swashbuckle.AspNetCore#3792
• Return null on example, as it was with OpenApiNull before by @​jgarciadelanoceda in Return null on example, as it was with OpenApiNull before domaindrivendev/Swashbuckle.AspNetCore#3793

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.3...v10.1.4

10.1.3

What's Changed

• Fix null examples being represented as the string "null" by @​jgarciadelanoceda in Fix null examples being represented as the string null domaindrivendev/Swashbuckle.AspNetCore#3788

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.2...v10.1.3

10.1.2

What's Changed

• Fix browser caching behaviour by @​martincostello in Fix browser caching behaviour domaindrivendev/Swashbuckle.AspNetCore#3772
• Fix document URL serialization by @​martincostello in Fix document URL serialization domaindrivendev/Swashbuckle.AspNetCore#3773

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.1...v10.1.2

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions