v8.41.0

What's Changed

• [identity] Bump Duende.IdentityServer v7.2.4 to v7.4.6 by @VSpyridonos in #855
• [builder] Add LogStartupBanner by @dkarkanas in #943
• [identity] - Add ServerSideSessions & MultipleActiveSessions support by @KrikTze in #947

Breaking Changes

Duende IdentityServer v7.4.6 — RequireClientSecret must be enabled for confidential clients

As part of the Duende IdentityServer upgrade from v7.2.4 to v7.4.6, clients using the client_credentials grant type
now must have RequireClientSecret set to true and a valid client secret configured. Previously, these clients
could operate with RequireClientSecret = false, but the updated version enforces secret validation more strictly.
Clients that do not meet this requirement will receive an invalid_client error when requesting tokens.

Run the following SQL migration against your IdentityServer database before deploying this update:

UPDATE c
SET c.RequireClientSecret = 1
FROM Client c
WHERE EXISTS (
    SELECT 1
    FROM ClientGrantType cgt
    WHERE cgt.ClientId = c.Id
      AND cgt.GrantType = 'client_credentials'
);

Make sure all affected clients also have a valid secret configured.

Full Changelog: v8.40.0...v8.41.0