Update OrchardCore.OpenId to explicitly reference Microsoft.IdentityM…

…odel.Protocols.OpenIdConnect (#16057)
OrchardCMS · May 15, 2024 · 8dca5ad · 8dca5ad
1 parent 6679b28
commit 8dca5ad
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/src/OrchardCore.Build/Dependencies.props b/src/OrchardCore.Build/Dependencies.props
@@ -42,6 +42,16 @@
     <PackageManagement Include="Microsoft.Extensions.Azure" Version="1.7.3" />
     <PackageManagement Include="Microsoft.Extensions.Http.Resilience" Version="8.5.0" />
     <PackageManagement Include="Microsoft.Identity.Web" Version="2.18.1" />
+
+    <!--
+      Important: the version of the Microsoft.IdentityModel.Protocols.OpenIdConnect package MUST
+      match the IdentityModel version transitively referenced by OpenIddict to ensure we don't
+      accidentally end up referencing inconsistent versions (which is not supported by IM).
+
+      See https://github.com/OrchardCMS/OrchardCore/pull/16057 for more information.
+    -->
+
+    <PackageManagement Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="7.5.1" />
     <PackageManagement Include="Microsoft.NET.Test.Sdk" Version="17.9.0" />
     <PackageManagement Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
     <PackageManagement Include="MimeKit" Version="4.5.0" />

diff --git a/src/OrchardCore.Modules/OrchardCore.OpenId/OrchardCore.OpenId.csproj b/src/OrchardCore.Modules/OrchardCore.OpenId/OrchardCore.OpenId.csproj
@@ -30,6 +30,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="OpenIddict.Server.AspNetCore" />
     <PackageReference Include="OpenIddict.Server.DataProtection" />
     <PackageReference Include="OpenIddict.Validation.AspNetCore" />