[deps] Auth: Update Duende.IdentityServer to 7.4.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Duende.IdentityServer (source)	7.2.4 → 7.4.6

---

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-25801
• Link: https://bitwarden.atlassian.net/browse/PM-25801

[claude]

Claude finished @renovate[bot]'s task in 3m 41s —— View job

---

Review Summary

PR: [deps] Auth: Update Duende.IdentityServer to 7.4.4
Decision: ✅ Approve

Overview

This Renovate bot PR upgrades Duende.IdentityServer from version 7.2.4 to 7.4.4 in src/Core/Core.csproj. This is a minor version upgrade spanning two releases (7.2 -> 7.3 -> 7.4).

Analysis

Scope of change: Single-line version bump in the project file.

Compatibility review: Bitwarden implements several Duende.IdentityServer interfaces:

• IProfileService - ProfileService.cs
• IPersistedGrantStore - PersistedGrantStore.cs
• IClientStore - DynamicClientStore.cs
• ICorsPolicyService - CustomCorsPolicyService.cs
• IResourceOwnerPasswordValidator - ResourceOwnerPasswordValidator.cs
• ICustomTokenRequestValidator - CustomTokenRequestValidator.cs
• IAuthorizationCodeStore - AuthorizationCodeStore.cs (extends DefaultGrantStore)

These interfaces have remained stable across Duende.IdentityServer 7.x minor versions. The implementations use standard patterns that are expected to remain compatible.

Security: Upgrading to 7.4.4 includes bug fixes and security improvements from the Duende team. This is beneficial for authentication security.

Risk level: Low - minor version upgrades in the 7.x line are designed to be backward compatible.

Recommendation

• Ensure all CI tests pass before merging
• Monitor authentication flows after deployment as standard practice for identity provider upgrades

---

[github-actions]

Checkmarx One – Scan Summary & Details – 96898af2-0340-47a2-aab9-b728ac1a10b4

---

Fixed Issues (2)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 293
	Use_Of_Hardcoded_Password	/src/Core/Constants.cs: 212

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.64%. Comparing base (c118f23) to head (a397fbc).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6323      +/-   ##
==========================================
+ Coverage   57.53%   57.64%   +0.10%     
==========================================
  Files        2032     2033       +1     
  Lines       89486    89557      +71     
  Branches     7957     7976      +19     
==========================================
+ Hits        51487    51625     +138     
+ Misses      36154    36068      -86     
- Partials     1845     1864      +19     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[JaredSnider-Bitwarden]

A single question below

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JaredSnider-Bitwarden]

LGTM!