Oliver Kieselbach 5b139f90e7 Backend: Pkcs past two .NET DoS advisories, Moq 4.21-safe log assertion, no Dependabot major for Application Insights 3 ...

- Microsoft.Identity.Web 4.3.0 brings System.Security.Cryptography.Pkcs 10.0.0 through its token
  cache, affected by GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7 (fixed in 10.0.13). A direct
  reference lifts it to 10.0.14 until Microsoft.Identity.Web 4.17.0 or later is in.
- Moq 4.21 annotates the It.IsAnyType match parameter as nullable. The GraphTokenService log
  assertion checks for null first, so the pending dotnet group update compiles.
- Dependabot no longer proposes Microsoft.ApplicationInsights.WorkerService 3: the OpenTelemetry
  rewrite drops telemetry processors and the Functions worker integration still builds on 2.x.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-05 22:45:55 +01:00

..

assets

docs(readme): refresh screenshots, add social preview source

2026-09-03 14:50:19 +02:00

codeql

ci(codeql): exclude js/missing-rate-limiting; a test pins every OAuth route to its limiter (D-281)

2026-09-24 18:58:08 +02:00

ISSUE_TEMPLATE

docs(repo): AGPL-3.0 root license, MCP section in README, security policy and issue forms

2026-09-03 14:29:14 +02:00

scripts

Bootstrap leaves nothing behind: loader 1.3 and installer 2.7 (D-375)

2026-10-22 13:34:54 +02:00

workflows

Dependabot: SWA CLI lockfile in tools/, overrides for adm-zip and tmp, private submodules skipped, postcss override follows its devDependency

2026-11-05 18:55:55 +01:00

dependabot.yml

Backend: Pkcs past two .NET DoS advisories, Moq 4.21-safe log assertion, no Dependabot major for Application Insights 3

2026-11-05 22:45:55 +01:00

FUNDING.yml

Update Buy Me a Coffee username in FUNDING.yml

2026-02-24 11:55:17 +01:00

zizmor.yml

Dependabot: SWA CLI lockfile in tools/, overrides for adm-zip and tmp, private submodules skipped, postcss override follows its devDependency

2026-11-05 18:55:55 +01:00