New features
- Add
MicrosoftIdentityOptions.PartitionAppTokenCacheByAudienceto partition the app token cache by resource/audience. See #3979. - Expose MSAL's background token-refresh callback through Id.Web via
TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted. See #3973. - Add
MicrosoftIdentityOptions.UseFastUnboundedCache; stop short-circuiting the in-memory token cache serialization provider. See #3970. - OIDC FIC (
Microsoft.Identity.Web.OidcFIC) now supports mTLS token binding. See #3851.
Bug fixes
- Token binding: the CCA cache key now distinguishes a bound credential (
UseBoundCredential = true) from its unbound equivalent; the certificate-error retry path invalidates the cache entry for the actual request mode (bearer vs mTLS PoP). - Forward the OpenTelemetry tags enricher onto the inner FIC client-assertion leg. See #3968.
Dependencies updates
Microsoft.Identity.Client→ 4.87.0 (#3975)Microsoft.Identity.Abstractions→ 12.6.0 (#3976)System.Security.Cryptography.Xml/System.Security.Cryptography.Pkcs→ patched (CVE-2026-47302, -47304, -50525, -50648) (#3964)- notsecurity group: 1 update (#3965)
Full changelog: 4.13.2...4.14.0