Bump Microsoft.Identity.Web and System.IdentityModel.Tokens.Jwt

[dependabot]

Updated Microsoft.Identity.Web from 4.13.2 to 4.14.2.

Release notes

Sourced from Microsoft.Identity.Web's releases.

4.14.2

Dependencies updates

• Bump the Microsoft.IdentityModel.* (Wilson) version to 8.22.0. See #​3986.
• Fix the net8.0 crypto floor to use the patched System.Security.Cryptography.Xml 8.0.4 (and its System.Security.Cryptography.Pkcs 8.0.1 dependency) instead of over-bumping to the 9.0.18 servicing line (CVE-2026-47302, -47304, -50525, -50648). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged. See #​3989.

4.14.0

New features

• Add MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience to partition the app token cache by resource/audience. See #​3979.
• Expose MSAL's background token-refresh callback through Id.Web via TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted. See #​3973.
• Add MicrosoftIdentityOptions.UseFastUnboundedCache; stop short-circuiting the in-memory token cache serialization provider. See #​3970.
• OIDC FIC (Microsoft.Identity.Web.OidcFIC) now supports mTLS token binding. See #​3851.

Bug fixes

• Token binding: the CCA cache key now distinguishes a bound credential (UseBoundCredential = true) from its unbound equivalent; the certificate-error retry path invalidates the cache entry for the actual request mode (bearer vs mTLS PoP).
• Forward the OpenTelemetry tags enricher onto the inner FIC client-assertion leg. See #​3968.

Dependencies updates

• Microsoft.Identity.Client → 4.87.0 (#​3975)
• Microsoft.Identity.Abstractions → 12.6.0 (#​3976)
• System.Security.Cryptography.Xml / System.Security.Cryptography.Pkcs → patched (CVE-2026-47302, -47304, -50525, -50648) (#​3964)
• notsecurity group: 1 update (#​3965)

Full changelog: AzureAD/microsoft-identity-web@4.13.2...4.14.0

Commits viewable in compare view.

Updated System.IdentityModel.Tokens.Jwt from 8.19.2 to 8.22.0.

Release notes

Sourced from System.IdentityModel.Tokens.Jwt's releases.

8.22.0

What's Changed

• Promote exception to property, add test by @​westin-m in [cherry-pick] promote exception to property, add test (#3471) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3486
• Add IgnoreCaseWhenValidatingAudience flag to audience validation by @​cpp11nullptr in Backport: Add IgnoreCaseWhenValidatingAudience flag to audience validation (#3558) AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3563

Full Changelog: AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

8.21.0

Performance Improvements

• Add JsonWebToken header-replacement path to avoid re-parsing payload. See PR #​3553.
• Add claims dictionary preallocation. See PR #​3550.

Bug Fixes

• Fix CI build failures: remove unused log message and add missing DPoP API entries. See PR #​3551.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)