build(deps): bump actions/setup-dotnet from 5.4.0 to 6.0.0

.azure-pipelines/nuget.config

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This Nuget config file is only used in release builds to redirect all
+NuGet package sources to the Central Feed Services (CFS) feed.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="CFS" value="https://pkgs.dev.azure.com/mseng/1ES/_packaging/1ES_PublicPackages/nuget/v3/index.json" />
+  </packageSources>
+</configuration>

.azure-pipelines/release.yml

@@ -134,6 +134,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)\.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: PowerShell@2
                   displayName: 'Read version file'
                   inputs:
@@ -295,6 +304,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: Bash@3
                   displayName: 'Read version file'
                   inputs:
@@ -570,6 +588,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: Bash@3
                   displayName: 'Read version file'
                   inputs:
@@ -639,7 +666,7 @@ extends:
                       inlineOperation: |
                         [
                           {
-                            "KeyCode": "CP-453387-Pgp",
+                            "KeyCode": "CP-500207-Pgp",
                             "OperationCode": "LinuxSign",
                             "ToolName": "sign",
                             "ToolVersion": "1.0",
@@ -673,6 +700,15 @@ extends:
                   artifactName: 'dotnet-tool'
             steps:
               - checkout: self
+              - task: CopyFiles@2
+                displayName: 'Use Central Feed Services (CFS)'
+                inputs:
+                  SourceFolder: '$(Build.SourcesDirectory)\.azure-pipelines'
+                  Contents: 'nuget.config'
+                  TargetFolder: '$(Build.SourcesDirectory)'
+                  Overwrite: true
+              - task: NuGetAuthenticate@1
+                displayName: 'Authenticate to NuGet feeds'
               - task: PowerShell@2
                 displayName: 'Read version file'
                 inputs:

.github/workflows/codeql-analysis.yml

@@ -22,10 +22,10 @@ jobs:
         language: [ 'csharp' ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
+      uses: actions/setup-dotnet@v6.0.0
       with:
         dotnet-version: 10.0.x
 

.github/workflows/continuous-integration.yml

@@ -25,10 +25,10 @@ jobs:
             os: windows-11-arm
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
+      uses: actions/setup-dotnet@v6.0.0
       with:
         dotnet-version: 10.0.x
 
@@ -82,10 +82,10 @@ jobs:
         runtime: [ linux-x64, linux-arm64, linux-arm ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
+      uses: actions/setup-dotnet@v6.0.0
       with:
         dotnet-version: 10.0.x
 
@@ -126,10 +126,10 @@ jobs:
         runtime: [ osx-x64, osx-arm64 ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
+      uses: actions/setup-dotnet@v6.0.0
       with:
         dotnet-version: 10.0.x
 

.github/workflows/lint-docs.yml

@@ -18,7 +18,7 @@ jobs:
     name: Lint markdown files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9
         with:
@@ -30,7 +30,7 @@ jobs:
     name: Check for broken links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Run link checker
         # For any troubleshooting, see:

.github/workflows/validate-install-from-source.yml

@@ -45,7 +45,7 @@ jobs:
             GNUPGHOME=/root/.gnupg tdnf install tar -y # needed for `actions/checkout`
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: |
           sh "${GITHUB_WORKSPACE}/src/linux/Packaging.Linux/install-from-source.sh" -y

Directory.Packages.props

@@ -14,9 +14,9 @@
     <PackageVersion Include="Avalonia.Win32" Version="11.1.3" />
 
     <!-- Microsoft Identity -->
-    <PackageVersion Include="Microsoft.Identity.Client" Version="4.65.0" />
-    <PackageVersion Include="Microsoft.Identity.Client.Broker" Version="4.65.0" />
-    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.65.0" />
+    <PackageVersion Include="Microsoft.Identity.Client" Version="4.84.2" />
+    <PackageVersion Include="Microsoft.Identity.Client.Broker" Version="4.84.2" />
+    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.84.2" />
 
     <!-- MSBuild -->
     <PackageVersion Include="Microsoft.Build.Framework" Version="16.0.461" />

VERSION

@@ -1 +1 @@
-2.8.0.0
+2.9.1.0

docs/credstores.md

@@ -277,7 +277,7 @@ Note that you'll want to ensure that another credential helper is placed before
 GCM in the `credential.helper` Git configuration or else you will be prompted to
 enter your credentials every time you interact with a remote repository.
 
-[access-windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0
+[access-windows-credential-manager]: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows
 [aws-cloudshell]: https://aws.amazon.com/cloudshell/
 [azure-cloudshell]: https://docs.microsoft.com/azure/cloud-shell/overview
 [cmdkey]: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey

docs/generic-oauth.md

@@ -42,6 +42,7 @@ following values in your Git configuration:
 - Client Secret (optional)
 - Redirect URL (optional, defaults to `http://127.0.0.1`)
 - Scopes (optional)
+- Response Mode (optional, defaults to `query`)
 - OAuth Endpoints
   - Authorization Endpoint
   - Token Endpoint
@@ -62,6 +63,7 @@ git config --global credential.<HOST>.oauthAuthorizeEndpoint <AuthEndpoint>
 git config --global credential.<HOST>.oauthTokenEndpoint <TokenEndpoint>
 git config --global credential.<HOST>.oauthScopes <Scopes>
 git config --global credential.<HOST>.oauthDeviceEndpoint <DeviceEndpoint>
+git config --global credential.<HOST>.oauthResponseMode <ResponseMode>
 ```
 
 **Example commands:**
@@ -83,13 +85,35 @@ git config --global credential.<HOST>.oauthDeviceEndpoint <DeviceEndpoint>
     oauthScopes = "code:write profile:read"
     oauthDefaultUserName = "OAUTH"
     oauthUseClientAuthHeader = false
+    oauthResponseMode = "query"
 ```
 
 ### Additional configuration
 
 Depending on the specific implementation of OAuth with your Git host you may
 also need to specify additional behavior.
 
+#### Response mode
+
+The response mode controls how the authorization server returns the response to
+the loopback redirect URI once the user has authenticated. GCM supports the
+following values:
+
+- `query` (default) - parameters are returned in the redirect URI query string.
+- `fragment` - parameters are returned in the redirect URI fragment.
+- `form_post` - parameters are returned as an auto-submitting HTML form that is
+  POSTed to the redirect URI, as described by the
+  [OAuth 2.0 Form Post Response Mode][form-post-spec] specification.
+
+Most hosts use the default `query` mode. Only set this if your host requires a
+specific response mode:
+
+```shell
+git config --global credential.<HOST>.oauthResponseMode <query|fragment|form_post>
+```
+
+[form-post-spec]: https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html
+
 #### Token user name
 
 If your Git host requires that you specify a username to use with OAuth tokens

docs/github-apideprecation.md

@@ -143,6 +143,6 @@ the new token-based authentication requirements **DO NOT** apply to GHES:
 [windows-cli-save-pat-image]: img/windows-cli-save-pat.png
 [vs-2019]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2019
 [vs-2017]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2017
-[windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0
+[windows-credential-manager]: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows
 [windows-gui-add-pat-image]: img/windows-gui-add-pat.png
 [windows-gui-credentials-image]: img/windows-gui-credentials.png

docs/linux-validate-gpg.md

@@ -10,46 +10,42 @@ the latest Debian package and/or tarball signature.
 apt-get install -y curl debsig-verify
 
 # Download public key signature file
-curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
-| grep -E 'browser_download_url.*gcm-public.asc' \
-| cut -d : -f 2,3 \
-| tr -d \" \
-| xargs -I 'url' curl -L -o gcm-public.asc 'url'
+curl -Os https://packages.microsoft.com/keys/microsoft-2025.asc
 
 # De-armor public key signature file
-gpg --output gcm-public.gpg --dearmor gcm-public.asc
+gpg --output microsoft-2025.gpg --dearmor microsoft-2025.asc
 
-# Note that the fingerprint of this key is "3C853823978B07FA", which you can
+# Note that the fingerprint of this key is "EE4D7792F748182B", which you can
 # determine by running:
-gpg --show-keys gcm-public.asc | head -n 2 | tail -n 1 | tail -c 17
+gpg --show-keys microsoft-2025.asc | head -n 2 | tail -n 1 | tail -c 17
 
 # Copy de-armored public key to debsig keyring folder
-mkdir /usr/share/debsig/keyrings/3C853823978B07FA
-mv gcm-public.gpg /usr/share/debsig/keyrings/3C853823978B07FA/
+mkdir /usr/share/debsig/keyrings/EE4D7792F748182B
+mv microsoft-2025.gpg /usr/share/debsig/keyrings/EE4D7792F748182B/
 
 # Create an appropriate policy file
-mkdir /etc/debsig/policies/3C853823978B07FA
-cat > /etc/debsig/policies/3C853823978B07FA/generic.pol << EOL
+mkdir /etc/debsig/policies/EE4D7792F748182B
+cat > /etc/debsig/policies/EE4D7792F748182B/generic.pol << EOL
 <?xml version="1.0"?>
 <!DOCTYPE Policy SYSTEM "https://www.debian.org/debsig/1.0/policy.dtd">
 <Policy xmlns="https://www.debian.org/debsig/1.0/">
 
-  <Origin Name="Git Credential Manager" id="3C853823978B07FA" Description="Git Credential Manager public key"/>
+  <Origin Name="Git Credential Manager" id="EE4D7792F748182B" Description="Git Credential Manager public key"/>
 
   <Selection>
-    <Required Type="origin" File="gcm-public.gpg" id="3C853823978B07FA"/>
+    <Required Type="origin" File="microsoft-2025.gpg" id="EE4D7792F748182B"/>
   </Selection>
 
   <Verification MinOptional="0">
-    <Required Type="origin" File="gcm-public.gpg" id="3C853823978B07FA"/>
+    <Required Type="origin" File="microsoft-2025.gpg" id="EE4D7792F748182B"/>
   </Verification>
 
 </Policy>
 EOL
 
-# Download Debian package
+# Download Debian package (substitute `x64` with `arm64` on ARM machines)
 curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
-| grep "browser_download_url.*deb" \
+| grep "browser_download_url.*-x64-.*deb" \
 | cut -d : -f 2,3 \
 | tr -d \" \
 | xargs -I 'url' curl -L -o gcm.deb 'url'
@@ -61,24 +57,20 @@ debsig-verify gcm.deb
 ## Tarball
 ```shell
 # Download the public key signature file
-curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
-| grep -E 'browser_download_url.*gcm-public.asc' \
-| cut -d : -f 2,3 \
-| tr -d \" \
-| xargs -I 'url' curl -L -o gcm-public.asc 'url'
+curl -Os https://packages.microsoft.com/keys/microsoft-2025.asc
 
 # Import the public key
-gpg --import gcm-public.asc
+gpg --import microsoft-2025.asc
 
 # Download the tarball and its signature file
-curl -s https://api.github.com/repos/ldennington/git-credential-manager/releases/latest \
+curl -s https://api.github.com/repos/git-ecosystem/git-credential-manager/releases/latest \
 | grep -E 'browser_download_url.*gcm-linux.*[0-9].[0-9].[0-9].tar.gz' \
 | cut -d : -f 2,3 \
 | tr -d \" \
 | xargs -I 'url' curl -LO 'url'
 
 # Trust the public key
-echo -e "5\ny\n" |  gpg --command-fd 0 --expert --edit-key 3C853823978B07FA trust
+echo -e "5\ny\n" |  gpg --command-fd 0 --expert --edit-key EE4D7792F748182B trust
 
 # Verify the signature
 gpg --verify gcm-linux_amd64*.tar.gz.asc gcm-linux*.tar.gz

global.json

@@ -1,7 +1,7 @@
 {
   "sdk": {
     "rollForward": "latestMajor",
-    "version": "8.0"
+    "version": "8.0.100"
   }
 }
 

src/shared/Atlassian.Bitbucket.Tests/Cloud/BitbucketOAuth2ClientTest.cs

@@ -36,7 +36,7 @@ public async Task BitbucketOAuth2Client_GetAuthorizationCodeAsync_ReturnsCode()
 
             Bitbucket.Cloud.BitbucketOAuth2Client client = GetBitbucketOAuth2Client();
 
-            MockGetAuthenticationCodeAsync(finalCallbackUri, null, client.Scopes);
+            MockGetAuthenticationResponseAsync(finalCallbackUri, null, client.Scopes);
 
             MockCodeGenerator();
 
@@ -56,7 +56,7 @@ public async Task BitbucketOAuth2Client_GetAuthorizationCodeAsync_RespectsClient
 
             Bitbucket.Cloud.BitbucketOAuth2Client client = GetBitbucketOAuth2Client();
 
-            MockGetAuthenticationCodeAsync(finalCallbackUri, clientId, client.Scopes);
+            MockGetAuthenticationResponseAsync(finalCallbackUri, clientId, client.Scopes);
 
             MockCodeGenerator();
 
@@ -115,7 +115,7 @@ private void MockCodeGenerator()
             codeGenerator.Setup(c => c.CreatePkceCodeChallenge(OAuth2PkceChallengeMethod.Sha256, pkceCodeVerifier)).Returns(pkceCodeChallenge);
         }
 
-        private void MockGetAuthenticationCodeAsync(Uri finalCallbackUri, string overrideClientId, IEnumerable<string> scopes)
+        private void MockGetAuthenticationResponseAsync(Uri finalCallbackUri, string overrideClientId, IEnumerable<string> scopes)
         {
             var authorizationUri = new UriBuilder(CloudConstants.OAuth2AuthorizationEndpoint)
             {
@@ -128,7 +128,8 @@ private void MockGetAuthenticationCodeAsync(Uri finalCallbackUri, string overrid
              + "&scope=" + WebUtility.UrlEncode(string.Join(" ", scopes)).ToLower()
             }.Uri;
 
-            browser.Setup(b => b.GetAuthenticationCodeAsync(authorizationUri, rootCallbackUri, ct)).Returns(Task.FromResult(finalCallbackUri));
+            browser.Setup(b => b.GetAuthenticationResponseAsync(authorizationUri, rootCallbackUri, OAuth2ResponseMode.Default, ct))
+                .Returns(Task.FromResult(finalCallbackUri.GetQueryParameters()));
         }
 
         private Uri MockFinalCallbackUri()