chore(deps,middleware)(deps): bump the runtime-patches group in /middleware with 3 updates

[dependabot]

Bumps the runtime-patches group in /middleware with 3 updates: @azure/msal-node, bonjour-service and jose.

Updates @azure/msal-node from 5.4.2 to 5.4.3

Release notes

Sourced from @​azure/msal-node's releases.

@​azure/msal-react v5.4.3

5.4.3

Fri, 05 Jun 2026 22:24:23 GMT

Patches

• Bump @​azure/msal-browser to v5.12.0 (beachball)

@​azure/msal-node v5.4.3

5.4.3

Wed, 29 Jul 2026 00:26:31 GMT

Patches

• Bump @​azure/msal-common to v16.11.3 (beachball)

Commits

• 3e4b837 Fix/telemetry broker fields consistency (#8699)
• cdab897 feat(msal-browser): Add retry logic and telemetry for token POST failures (#8...
• e1fbfbf Post-release PR (#8715)
• 83ab1ca Bump next from 15.5.19 to 15.5.21 (#8727)
• 1262aaf Bump shell-quote from 1.8.4 to 1.10.0 (#8731)
• 11f7233 Bump body-parser from 1.20.5 to 1.20.6 (#8719)
• 1afc948 Bump @​azure/msal-browser to 5.17.2 to match @​azure/msal-browser-1p (#8726)
• 0e34960 Streamline platform broker request to MSAL JS acquire-token contract params (...
• 3168a46 Bump tar from 7.5.16 to 7.5.21 (#8717)
• 489de12 Bump fast-uri from 3.1.2 to 3.1.4 (#8720)
• Additional commits viewable in compare view

Updates bonjour-service from 1.4.3 to 1.4.4

Release notes

Sourced from bonjour-service's releases.

1.4.4

What's Changed

• Export classes as types too, not just values by @​andersk in onlxltd/bonjour-service#84
• Bump tar from 7.5.16 to 7.5.22 by @​dependabot[bot] in onlxltd/bonjour-service#85
• Bump js-yaml from 4.2.0 to 4.3.0 by @​dependabot[bot] in onlxltd/bonjour-service#86

New Contributors

• @​andersk made their first contribution in onlxltd/bonjour-service#84

Full Changelog: onlxltd/bonjour-service@1.4.3...1.4.4

Commits

• e72ca10 Update yarn.lock
• 693311c Merge branch 'dependabot/npm_and_yarn/js-yaml-4.3.0'
• 2f0b012 Merge branch 'dependabot/npm_and_yarn/tar-7.5.22'
• f870315 Bump js-yaml from 4.2.0 to 4.3.0
• a17fe30 Bump tar from 7.5.16 to 7.5.22
• 38fadf7 Export classes as types too, not just values
• See full diff in compare view

Updates jose from 6.2.4 to 6.2.5

Release notes

Sourced from jose's releases.

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

Changelog

Sourced from jose's changelog.

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

Commits

• 3bac350 chore(release): 6.2.5
• 544f179 refactor(types): trim published declaration comments
• ef6b73e ci: enforce the family split and check the built dist
• c2f0ca3 refactor: fold single-consumer modules into their consumers
• 0b59a69 refactor: discriminate a key once
• 30f72af refactor: parse a Protected Header in one place
• 73d83b5 refactor: write each algorithm identifier once
• da69b68 refactor: generate and import keys from the entry
• 971057e refactor: assert key shape and type from the entry
• 98b50ab refactor: resolve the content encryption algorithm once
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[dependabot]

Labels

The following labels could not be found: deps, middleware. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.