[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Duende.IdentityServer (source)	[7.4.6] → [8.0.10]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2nd week starting on the 2 week of the year before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-40601
• Link: https://bitwarden.atlassian.net/browse/PM-40601

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 20.99%. Comparing base (df91576) to head (475fbb0).

❗ There is a different number of reports uploaded between BASE (df91576) and HEAD (475fbb0). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (df91576)	HEAD (475fbb0)
	2	1

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8025       +/-   ##
===========================================
- Coverage   74.83%   20.99%   -53.85%     
===========================================
  Files        2750     1589     -1161     
  Lines      117618    67864    -49754     
  Branches    10781     5506     -5275     
===========================================
- Hits        88022    14246    -73776     
- Misses      26940    53389    +26449     
+ Partials     2656      229     -2427     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

This Renovate PR performs a major version bump of Duende.IdentityServer (7.4.6 → 8.0.2), a security-critical authentication/OIDC dependency. Only src/Core/Core.csproj and 58 regenerated lock files changed — there are no accompanying C# code changes. CI is currently red: Run tests, the Identity Docker build, and the Sso Docker build all fail, which indicates v8 introduces breaking API changes that reach the two services most coupled to IdentityServer.

Code Review Details

• ⚠️ : Major Duende.IdentityServer v7→v8 bump breaks Identity/Sso builds and tests (CI red); v8 breaking changes must be migrated in code before merge
  • src/Core/Core.csproj:60

Dependency Changes

Package	Change	Ecosystem
Duende.IdentityServer	7.4.6 → 8.0.2 (major)	NuGet

Lock file hygiene is clean: the manifest and all 58 lock files are consistently updated to 8.0.2 with no leftover 7.4.6 references. The new transitive Duende.Private.Licensing (v8 licensing enforcement) is already accounted for via options.LicenseKey in src/Identity/Utilities/ServiceCollectionExtensions.cs.