npm - plugin-data-source-mssql - Versions diffs - 2.0.6 → 2.0.8 - Mend

plugin-data-source-mssql 2.0.6 → 2.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4974) hide show

package/dist/tedious/node_modules/@azure/msal-node/lib/msal-node.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-node v5.1.4 2026-04-21 */
+/*! @azure/msal-node v5.2.1 2026-05-11 */
 'use strict';
 'use strict';
-var uuid = require('uuid');
+var node_crypto = require('node:crypto');
 var crypto = require('crypto');
 var jwt = require('jsonwebtoken');
 var http = require('http');
@@ -150,7 +150,7 @@ class Serializer {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -398,7 +398,7 @@ const EncodingTypes = {
     UTF8: "utf-8",
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -451,7 +451,7 @@ const INSTANCE_AWARE = "instance_aware";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -482,7 +482,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage(code));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -502,7 +502,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -582,7 +582,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -605,7 +605,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -631,7 +631,8 @@ const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
-const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const issuerValidationFailed = "issuer_validation_failed";
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -647,6 +648,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
     invalidRequestMethodForEAR: invalidRequestMethodForEAR,
+    issuerValidationFailed: issuerValidationFailed,
     logoutRequestEmpty: logoutRequestEmpty,
     missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
     missingSshJwk: missingSshJwk,
@@ -659,7 +661,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -747,7 +749,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userCanceled: userCanceled
 });
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -942,7 +944,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1349,7 +1351,7 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1402,7 +1404,7 @@ function mapToQueryString(parameters) {
     return queryParameterArray.join("&");
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1441,7 +1443,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1702,12 +1704,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.5.1";
+const version$1 = "16.6.1";
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1727,7 +1729,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1810,7 +1812,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1890,7 +1892,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2047,7 +2049,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2133,6 +2135,15 @@ const rawMetdataJSON = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
+            {
+                preferred_network: "login.windows-ppe.net",
+                preferred_cache: "login.windows-ppe.net",
+                aliases: [
+                    "login.windows-ppe.net",
+                    "sts.windows-ppe.net",
+                    "login.microsoft-ppe.com",
+                ],
+            },
         ],
     },
 };
@@ -2204,7 +2215,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2212,7 +2223,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2250,7 +2261,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2288,7 +2299,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2303,7 +2314,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2325,7 +2336,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2349,7 +2360,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2492,7 +2503,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2530,8 +2541,10 @@ class CacheManager {
         const allAccounts = this.getAllAccounts(accountFilter, correlationId);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
-            const sortedAccounts = allAccounts.sort((account) => {
-                return account.idTokenClaims ? -1 : 1;
+            const sortedAccounts = allAccounts.sort((a, b) => {
+                const aHasClaims = a.idTokenClaims ? 1 : 0;
+                const bHasClaims = b.idTokenClaims ? 1 : 0;
+                return bHasClaims - aHasClaims;
             });
             return sortedAccounts[0];
         }
@@ -3621,7 +3634,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3635,7 +3648,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3690,7 +3703,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3785,7 +3798,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3812,7 +3825,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3867,7 +3880,7 @@ function delay(t, value) {
     return new Promise((resolve) => setTimeout(() => resolve(value), t));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4126,7 +4139,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4188,7 +4201,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
  */
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4281,7 +4294,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4361,7 +4374,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4425,7 +4438,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4493,7 +4506,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4512,7 +4525,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /**
  * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
  * @param base64Decode
@@ -4544,7 +4557,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4892,7 +4905,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4902,7 +4915,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4920,7 +4933,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4941,7 +4954,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5027,7 +5040,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5058,7 +5071,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5172,7 +5185,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5184,7 +5197,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5194,7 +5207,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5204,7 +5217,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5309,7 +5322,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5564,7 +5577,7 @@ class Authority {
         }, this.correlationId);
     }
     /**
-     * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+     * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
      * from the configured canonical authority
      * @returns
      */
@@ -5633,6 +5646,8 @@ class Authority {
         // Get metadata from network if local sources aren't available
         let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
         if (metadata) {
+            // Validate the issuer returned by the OIDC discovery document.
+            this.validateIssuer(metadata.issuer);
             // If the user prefers to use an azure region replace the global endpoints with regional information.
             if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                 metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
@@ -5801,7 +5816,7 @@ class Authority {
         throw createClientConfigurationError(untrustedAuthority);
     }
     updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
-        this.logger.verbose("Attempting to get cloud discovery metadata  from authority configuration", this.correlationId);
+        this.logger.verbose("Attempting to get cloud discovery metadata from authority configuration", this.correlationId);
         this.logger.verbosePii(`Known Authorities: '${this.authorityOptions.knownAuthorities ||
             NOT_APPLICABLE}'`, this.correlationId);
         this.logger.verbosePii(`Authority Metadata: '${this.authorityOptions.authorityMetadata ||
@@ -6001,6 +6016,139 @@ class Authority {
     isAliasOfKnownMicrosoftAuthority(host) {
         return InstanceDiscoveryMetadataAliases.has(host);
     }
+    /**
+     * Validates the `issuer` returned by an OIDC discovery document against
+     * this authority, per
+     * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+     *
+     * The issuer is accepted when ANY of the following holds:
+     *  1. The issuer scheme + host + port match the authority's (path may
+     *     differ). Applies to all authorities.
+     *  2. The authority is a Microsoft cloud authority (public, sovereign,
+     *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+     *     Microsoft authority host set.
+     *  3. Same as (2), but the issuer host is a single-label regional variant
+     *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+     *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+     *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+     *     path.
+     *
+     * @param issuer The `issuer` value returned in the OIDC discovery document.
+     * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+     */
+    validateIssuer(issuer) {
+        if (!issuer) {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+        let issuerUrl;
+        try {
+            issuerUrl = new URL(issuer);
+        }
+        catch {
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        const issuerScheme = issuerUrl.protocol;
+        const issuerHost = issuerUrl.host;
+        const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
+        const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
+        // Rule 1: Same scheme and host
+        const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
+        // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+        const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
+            this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+        /*
+         * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+         * (HTTPS only). E.g. westus2.login.microsoft.com
+         */
+        const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
+            this.matchesRegionalMicrosoftHost(issuerHost);
+        /*
+         * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+         * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+         */
+        const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+        // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+        if (matchesAuthorityOrigin ||
+            matchesKnownMicrosoftHost ||
+            matchesRegionalMicrosoftHost ||
+            matchesCiamTenantPattern) {
+            return;
+        }
+        // issuer validation fails if none of the above rules are satisfied
+        throw createClientConfigurationError(issuerValidationFailed);
+    }
+    /**
+     * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+     * may differ. Applies to all authorities.
+     */
+    matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
+        return issuerScheme === authorityScheme && issuerHost === authorityHost;
+    }
+    /**
+     * Rule 3: The issuer host is a regional variant
+     * (`{region}.{host}`) of a known Microsoft authority host.
+     * E.g. `westus2.login.microsoft.com`.
+     */
+    matchesRegionalMicrosoftHost(issuerHost) {
+        const firstDot = issuerHost.indexOf(".");
+        if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+            const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+            return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+        }
+        return false;
+    }
+    /**
+     * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+     * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+     *
+     * The bare tenant name is extracted from the authority's first path segment
+     * when available (stripping the `.onmicrosoft.com` suffix that
+     * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+     * the authority host (to support CIAM custom domain scenarios).
+     *
+     * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+     * because the OIDC issuer may use either form depending on the authority URL
+     * that was used to trigger discovery.
+     */
+    matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
+        /*
+         * authorityPathSegments[0] is the first path segment of the *authority
+         * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+         * Additional CIAM issuer path segments such as "/v2.0" are part of the
+         * issuer string, not the authority URL's PathSegments.
+         */
+        const pathSegment = authorityPathSegments[0];
+        /*
+         * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+         * present (introduced by transformCIAMAuthority), or fall back to the
+         * first label of the authority hostname for non-transformed/custom-domain
+         * CIAM authorities.
+         */
+        const tenantName = pathSegment
+            ? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
+                ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
+                : pathSegment
+            : authorityHost.split(".")[0];
+        if (!tenantName) {
+            return false;
+        }
+        const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
+        const validCiamPatterns = [
+            ciamBaseURL,
+            `${ciamBaseURL}/${tenantName}`,
+            `${ciamBaseURL}/${tenantName}/v2.0`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
+            `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+        ];
+        /*
+         * Compose the canonical issuer string from URL components and strip any
+         * trailing slashes from the path so it can be compared to the pattern set.
+         */
+        const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+        const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+        return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
+    }
     /**
      * Checks whether the provided host is that of a public cloud authority
      *
@@ -6132,7 +6280,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6166,7 +6314,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6423,7 +6571,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6644,7 +6792,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6760,7 +6908,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6909,7 +7057,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6942,7 +7090,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6959,7 +7107,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
-/*! @azure/msal-common v16.5.1 2026-04-21 */
+/*! @azure/msal-common v16.6.1 2026-05-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7423,6 +7571,9 @@ const ManagedIdentityHeaders = {
     METADATA_HEADER_NAME: "Metadata",
     APP_SERVICE_SECRET_HEADER_NAME: "X-IDENTITY-HEADER",
     ML_AND_SF_SECRET_HEADER_NAME: "secret",
+    CLIENT_SKU: X_CLIENT_SKU,
+    CLIENT_VER: X_CLIENT_VER,
+    CLIENT_REQUEST_ID: "x-ms-client-request-id",
 };
 /**
  * Managed Identity Query Parameters - used in network requests
@@ -8042,12 +8193,11 @@ function buildManagedIdentityConfiguration({ clientCapabilities, managedIdentity
  */
 class GuidGenerator {
     /**
-     *
-     * RFC4122: The version 4 UUID is meant for generating UUIDs from truly-random or pseudo-random numbers.
-     * uuidv4 generates guids from cryprtographically-string random
+     * Generates a random [RFC 4122](https://www.rfc-editor.org/rfc/rfc4122.txt) version 4 UUID. The UUID is generated using a
+     * cryptographic pseudorandom number generator.
      */
     generateGuid() {
-        return uuid.v4();
+        return node_crypto.randomUUID();
     }
     /**
      * verifies if a string is  GUID
@@ -8668,7 +8818,7 @@ class NodeStorage extends CacheManager {
         return [...Object.keys(cache)];
     }
     /**
-     * Clears all cache entries created by MSAL (except tokens).
+     * Clears all cache entries created by MSAL except authority metadata..
      */
     clear() {
         this.logger.trace("Clearing cache entries created by MSAL", "");
@@ -8676,6 +8826,9 @@ class NodeStorage extends CacheManager {
         const cacheKeys = this.getKeys();
         // delete each element
         cacheKeys.forEach((key) => {
+            if (this.isAuthorityMetadata(key)) {
+                return;
+            }
             this.removeItem(key);
         });
         this.emitChange();
@@ -9162,7 +9315,7 @@ class ClientAssertion {
 /* eslint-disable header/header */
 const name = "@azure/msal-node";
-const version = "5.1.4";
+const version = "5.2.1";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9711,7 +9864,7 @@ class ClientApplication {
         return createDiscoveredInstance(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions, this.logger, requestCorrelationId, new StubPerformanceClient());
     }
     /**
-     * Clear the cache
+     * Clear the cache except for authority metadata.
      */
     clearCache() {
         this.storage.clear();
@@ -10966,6 +11119,14 @@ class BaseManagedIdentitySource {
         this.cryptoProvider = cryptoProvider;
         this.disableInternalRetries = disableInternalRetries;
     }
+    /**
+     * Generates a new correlation ID for request tracing.
+     *
+     * @returns A new GUID string for use as a correlation or request ID
+     */
+    createCorrelationId() {
+        return this.cryptoProvider.createNewGuid();
+    }
     /**
      * Processes the network response and converts it to a standardized server token response.
      * This async version allows for source-specific response processing logic while maintaining
@@ -11899,6 +12060,11 @@ class Imds extends BaseManagedIdentitySource {
     createRequest(resource, managedIdentityId) {
         const request = new ManagedIdentityRequestParameters(HttpMethod.GET, this.identityEndpoint);
         request.headers[ManagedIdentityHeaders.METADATA_HEADER_NAME] = "true";
+        request.headers[ManagedIdentityHeaders.CLIENT_SKU] =
+            Constants.MSAL_SKU;
+        request.headers[ManagedIdentityHeaders.CLIENT_VER] = version;
+        request.headers[ManagedIdentityHeaders.CLIENT_REQUEST_ID] =
+            this.createCorrelationId();
         request.queryParameters[ManagedIdentityQueryParameters.API_VERSION] =
             IMDS_API_VERSION;
         request.queryParameters[ManagedIdentityQueryParameters.RESOURCE] =