Bump the duende group with 5 updates#1231
Merged
github-actions[bot] merged 1 commit intomasterfrom Dec 2, 2025
Merged
Conversation
Bumps Duende.BFF from 3.0.0 to 4.0.0 Bumps Duende.BFF.Yarp from 3.0.0 to 4.0.0 Bumps Duende.IdentityServer from 7.3.2 to 7.4.0 Bumps Duende.IdentityServer.AspNetIdentity from 7.3.2 to 7.4.0 Bumps Duende.IdentityServer.EntityFramework from 7.3.2 to 7.4.0 --- updated-dependencies: - dependency-name: Duende.BFF dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: duende - dependency-name: Duende.BFF.Yarp dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: duende - dependency-name: Duende.IdentityServer dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: duende - dependency-name: Duende.IdentityServer.AspNetIdentity dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: duende - dependency-name: Duende.IdentityServer.EntityFramework dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: duende ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
.NET
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
github-actions
bot
deleted the
dependabot/nuget/Identity/IdentityCenter/duende-98f7c06b5e
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Duende.BFF from 3.0.0 to 4.0.0.
Release notes
Sourced from Duende.BFF's releases.
4.0.0
This is the fourth release Duende Backend for Frontend Security Framework 4.0.0. The changes since the last release are:
Enhancements
Bug Fixes
4.0.0-rc.4
This is the fourth release candidate of Duende Backend for Frontend Security Framework 4.0.0. The changes since the last preview release are:
Enhancements
Bug Fixes
4.0.0-rc.3
Changes and improvements
AddBlazorServerafter callingAddServerSideSessions[#2230]4.0.0-rc.2
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Changes since RC1:
Duende.AccessTokenManagement 4.0.0Breaking changes since RC2:
Based on feedback from the community, we have made a couple of functional improvements and renamed certain properties to clarify the API.
Renamed properties
The following concepts have been renamed:
LocalPath. It was used to map properties from a path local to the BFF to a remote path or a url. We received feedback that this was confusing. Since .Net already contains a property that could helpPathStringwe decided to removeLocalPathand rely onPathStringonly.Originhas been renamed toHostHeaderValue. Technically, we're binding frontends to an origin, which is a data structure that contains the scheme, host and port number). However, we're not binding the frontend to the Origin Header*, but to the Host Header. This caused quite a bit of confusion as origins are also used in Cross Origin Resource Sharing.BffFrontend.MappedToPath()toBffFrontend.MapToPathBffFrontend.MappedToOrigin()toBffFrontend.MapToHost()RemoteApi.LocalPathtoRemoteApi.MatchingPathBffFrontend.SelectionCriteriatoBffFrontend.MatchingCriteriaBffFrontendConfiguration.MatchingOrigintoBffFrontendConfiguration.MatchingHostHeaderThe methods
BffFrontend.MapToHostandBffFrontend.MapToPathare now mutually exclusive. Setting both will throw. If you want to match a frontend based on both a Host and a Path, you should useBffFrontend.MapTo()BffFrontend.WithIndexHtmltoBffFrontend.WithCdnIndexUrl(to make it's purpose clearer).IIndexHtmlClienttoIStaticFilesHttpClientIndexHtmlClientNametoStaticAssetsClientNameDevelopment time Static files proxying
We introduced additional functionality for proxying static files. Initially, we only support proxying an index.html file from a CDN. This is still the recommended way to deploy a frontend. There was no support for local development however.
... (truncated)
4.0.0-rc.1
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Changes since preview 2:
BffBuilder type (returned from services.AddBff()) is now an interface called IBffServicesBuilder. This is used as the basis for extension methods.
IBffServicesBuilder.WithDefaultCookieOptions is now called IBffServicesBuilder.ConfigureCookies()
IBffServicesBuilder.WithDefaultOpenIdConnectOptions is now called IBffServicesBuilder.ConfigureOpenIdConnect()
To support split host login scenarios', you can use a referer header in the Silent Login, coupled with BffOptions.AllowedSilentLoginReferers to create a list of allowed referers.
IFrontendCollection no longer exposes a GetAll method, but now implements IEnumerable.
ReturnUrlValidator.IsValidAsync now only accepts a uri
User sessions are now partitioned per frontend. IUserSessionStore has been updated to reflect this change. Note, you will have to run a migration to rename the column "ApplicationName" to "PartitionKey", including corresponding interfaces. Note, the migrations project has been updated to reflect this change.
When you add EntityFramework based sessions to your system, it no longer automatically enables session cleanup. The property BffOptions.EnableSessionCleanup is removed. You now have to call AddSessionCleanupBackgroundProcess() to enable session migration.
Changes since preview 1:
Upgrade guide
This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help.
Remote APIs
The syntax for configuring remote APIs has changed slightly:
// Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") ... (truncated) ## 4.0.0-preview3 This release is a major change from the previous release. The biggest improvement here is multi-frontend support. The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal. # Changes and improvements * Support for login prompts, such as prompt = create => https://github.com/DuendeSoftware/products/issues/1701 * Deprecated silent login endpoint in favor of prompt=none * Allow anti forgery check to be disabled via a delegate => https://github.com/DuendeSoftware/products/pull/1932 * Multi-frontend support => https://github.com/DuendeSoftware/products/pull/2032 * Duende.AccessTokenManagement V4 => https://github.com/DuendeSoftware/products/pull/2032 * Open Telemetry support => https://github.com/DuendeSoftware/products/pull/1945 ## Changes since preview 2: * **BffBuilder** type (returned from **services.AddBff**()) is now an interface called **IBffServicesBuilder**. This is used as the basis for extension methods. * **IBffServicesBuilder.WithDefaultCookieOptions** is now called **IBffServicesBuilder.ConfigureCookies()** * **IBffServicesBuilder.WithDefaultOpenIdConnectOptions** is now called **IBffServicesBuilder.ConfigureOpenIdConnect()** * To support split host login scenarios', you can use a referer header in the Silent Login, coupled with **BffOptions.AllowedSilentLoginReferers** to create a list of allowed referers. * **IFrontendCollection** no longer exposes a **GetAll** method, but now implements IEnumerable<Frontend>. * **ReturnUrlValidator.IsValidAsync** now only accepts a uri * User sessions are now partitioned per frontend. **IUserSessionStore** has been updated to reflect this change. Note, you will have to run a migration to rename the column "ApplicationName" to "PartitionKey", including corresponding interfaces. Note, the migrations project has been updated to reflect this change. * When you add EntityFramework based sessions to your system, it no longer automatically enables session cleanup. The property **BffOptions.EnableSessionCleanup** is removed. You now have to call **AddSessionCleanupBackgroundProcess**() to enable session migration. ## Changes since preview 1: * Removed custom signin url => https://github.com/DuendeSoftware/products/pull/2056 * Fixed server side sessions & sliding cookie configuration => https://github.com/DuendeSoftware/products/pull/2041 * Fixed logout => https://github.com/DuendeSoftware/products/pull/2060 # Upgrade guide This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help. ## Remote APIs The syntax for configuring remote APIs has changed slightly: ```diff lang="csharp" title="*.cs" // Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") - .WithOptionalUserAccessToken(); + .WithAccessToken(RequiredTokenType.UserOrNone);... (truncated)
4.0.0-preview2
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Changes since preview 1:
Upgrade guide
This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help.
Remote APIs
The syntax for configuring remote APIs has changed slightly:
// Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") - .WithOptionalUserAccessToken(); + .WithAccessToken(RequiredTokenType.UserOrNone);TokenTypehas been renamed toRequiredTokenType.WithAccessToken()WithOptionalUserAccessToken()but withRequiredTokenType.UserOrNoneConfiguring Token Types In YARP
The required token type configuration in yarp has also changed slightly. It uses the enum values from
RequiredTokenType.Extending The BFF
Simplified Wireup Without Explicit Authentication Setup
... (truncated)
4.0.0-Preview1
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Upgrade guide
This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help.
Remote APIs
The syntax for configuring remote APIs has changed slightly:
// Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") - .WithOptionalUserAccessToken(); + .WithAccessToken(RequiredTokenType.UserOrNone);TokenTypehas been renamed toRequiredTokenType.WithAccessToken()WithOptionalUserAccessToken()but withRequiredTokenType.UserOrNoneConfiguring Token Types In YARP
The required token type configuration in yarp has also changed slightly. It uses the enum values from
RequiredTokenType.Extending The BFF
Simplified Wireup Without Explicit Authentication Setup
The V3 style of wireup still works, but BFF V4 comes with a newer style of wireup:
... (truncated)
4.0.0-preview2
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Changes since preview 1:
Upgrade guide
This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help.
Remote APIs
The syntax for configuring remote APIs has changed slightly:
// Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") - .WithOptionalUserAccessToken(); + .WithAccessToken(RequiredTokenType.UserOrNone);TokenTypehas been renamed toRequiredTokenType.WithAccessToken()WithOptionalUserAccessToken()but withRequiredTokenType.UserOrNoneConfiguring Token Types In YARP
The required token type configuration in yarp has also changed slightly. It uses the enum values from
RequiredTokenType.Extending The BFF
Simplified Wireup Without Explicit Authentication Setup
... (truncated)
4.0.0-Preview1
This release is a major change from the previous release. The biggest improvement here is multi-frontend support.
The extensibility approach has been drastically changed. To reduce the public API surface, and improve our ability to evolve the library, we no longer make every class in the system public with virtual methods. Implementation logic now is internal.
Changes and improvements
Upgrade guide
This release introduces many breaking changes. Some small, some large. We'll do our best to document how to upgrade here. Should you run into an upgrade issue that's not documented, please reach out to our discussion forum and we'll do our best to help.
Remote APIs
The syntax for configuring remote APIs has changed slightly:
// Use a client credentials token app.MapRemoteBffApiEndpoint("/api/client-token", "https://localhost:5010") - .RequireAccessToken(TokenType.Client); + .WithAccessToken(RequiredTokenType.Client); // Use the client token only if the user is logged in app.MapRemoteBffApiEndpoint("/api/optional-user-token", "https://localhost:5010") - .WithOptionalUserAccessToken(); + .WithAccessToken(RequiredTokenType.UserOrNone);TokenTypehas been renamed toRequiredTokenType.WithAccessToken()WithOptionalUserAccessToken()but withRequiredTokenType.UserOrNoneConfiguring Token Types In YARP
The required token type configuration in yarp has also changed slightly. It uses the enum values from
RequiredTokenType.Extending The BFF
Simplified Wireup Without Explicit Authentication Setup
The V3 style of wireup still works, but BFF V4 comes with a newer style of wireup: