Bump OpenIddict from 2.0.1 to 4.0.0

[dependabot]

Bumps OpenIddict from 2.0.1 to 4.0.0.

Release notes

Sourced from OpenIddict's releases.

4.0.0

For more information about this release, read OpenIddict 4.0 general availability.

4.0.0-rc2

This RC release introduces the following changes:

• The System.Net.Http integration packages for the client and validation stacks now support specifying an e-mail address that will be used in the From header of backchannel requests (for more information about the From HTTP request header, read https://datatracker.ietf.org/doc/html/rfc9110#section-10.1.2):

options.UseSystemNetHttp()
       .SetContactAddress("contact@domain.com")
       .SetProductInformation(typeof(Startup).Assembly);

• An issue affecting the ASP.NET Core Data Protection integration and device authorization codes was identified and fixed.

• An issue affecting the OpenIddictExtensions.AddClaims() extension and preventing userinfo and introspection responses containing complex JSON nodes in top-level array claims from being properly handled was identified and fixed (thanks @​danbluhmhansen! ❤️)

4.0.0-rc1

This RC release introduces the following changes:

• While initially planned for OpenIddict 5.0, modifications introducing breaking behavior changes in the URIs handling will finally ship as part of 4.0. Since these changes affect how endpoint URIs are configured, returned and resolved, users are invited to read openiddict/openiddict-core#1613 before migrating to OpenIddict 4.0 RC1.

• Relative redirect/post-logout-redirect URIs are now supported by the client stack, for both custom client registrations and web provider integrations:

options.UseWebProviders()
       .UseGitHub(options =>
       {
           // ...
       options.SetRedirectUri("callback/login/github");
   });

• The client stack now requires enabling flows explicitly exactly like the server stack, which allows offering better exceptions on misconfigurations and avoids requiring registering signing/encryption credentials when only non-interactive flows like password or client_credentials are used:

options.AllowAuthorizationCodeFlow()
       .AllowRefreshTokenFlow();

• By default, the client stack now aborts challenge operations that are triggered from non-HTTPS pages with an exception message indicating that things may not work properly due to SameSite constraints when using HTTP instead of HTTPS. While not recommended, the client offers the same DisableTransportSecurityRequirement() option as the server stack to disable the HTTPS requirement.

options.UseAspNetCore()
       .DisableTransportSecurityRequirement();
options.UseOwin()
.DisableTransportSecurityRequirement();
</tr></table>

... (truncated)

Commits

• a31209d Update Versions.props to build 4.0.0 packages
• 62a10af Store the provider name in the state token as a private claim and update the ...
• db72098 Update the sponsors section
• 1d5413c Update the System.Net.Http integrations to always disable cookies support as ...
• 11c5b7e Add Pro Santé Connect to the list of supported providers
• 6ed9eb2 Infer the redirection/post-logout redirection endpoint URIs from the redirect...
• 70cfaba Update the sponsors section
• 46e2e4c Add client_credentials to the list of grant types supported by Reddit
• 5d28210 Update the web provider generator to support creating builder methods for cer...
• af73574 Update the System.Net.Http integrations to support per-provider HttpClient in...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)