Common code used by both the Active Directory Authentication Library (ADAL) and the Microsoft Authentication Library (MSAL)
Java · KotlinMIT★ 55 estrellas⑂ 50 forksdesde nov 2017Ver en GitHub ↗
AzureAD/microsoft-authentication-library-common-for-android tiene un índice de salud de 75 sobre 100, lo que lo sitúa en la banda Bueno. Su puntuación más alta es Vitality (99/100) y la más baja, Community & Adoption (51/100). Se actualizó por última vez hoy. 5 personas concentran la mayor parte del trabajo reciente.
75
global / 100
Bueno
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
75
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Dependencias directas libres de avisos conocidos — ninguna dependencia directa tiene un aviso conocido
0/25
Dependencias indirectas libres de avisos conocidos — el conjunto transitivo no es separable de las dependencias de desarrollo y prueba en este alcance
0/40
Sin avisos pendientes — ningún aviso tiene fecha de publicación
Datos de entrada utilizados
source
osv
advisories
0
affected_packages
0
assessed_packages
1
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluidos de la puntuación (sin datos o no aplicable): Dependencias indirectas libres de avisos conocidos, Sin avisos pendientes. Los pesos restantes se han renormalizado. Se cotejaron 1 dependencias resueltas con OSV. Este repositorio no publica ningún paquete que el índice resuelva, por lo que se evaluó en su lugar el grafo de dependencias del repositorio. Ese grafo mezcla fijaciones de desarrollo y prueba con las dependencias distribuidas, de modo que solo se puntúan las dependencias declaradas en tiempo de ejecución; los hallazgos transitivos se informan como contexto y quedan excluidos de la puntuación. No se analiza la alcanzabilidad.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Arranque con un solo comando — LabApiUtilities/build.gradle, build.gradle, common-java-root/build.gradle (convención del toolchain, sin ejecutor de tareas)
22/22
Pruebas automatizadas
0/11
Configuración de lint / formato
11/11
Verificación estática de tipos — Java (tipado estático)
0/10
Entorno reproducible
10/10
Práctica demostrada con agentes — 57 de los últimos 100 commits con autoría o crédito de agente
0/8
Mantenimiento automatizado — no se observan actualizaciones automáticas de dependencias
0/10
OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
Código verificable por tipos — Java (tipado estático)
54.3/55
Tamaños de archivo manejables — 21/1657 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_language
Java
largest_source_bytes
166.283
source_files_sampled
1657
oversized_source_files
21
Datos clave
55estrellas de GitHub
63contribuidores
255commits en los últimos 12 meses
0días desde el último push
100versiones publicadas
5factor bus
32issues abiertas
Mavenecosistemas de paquetes
Advertencias de recopilación de datos
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Más detalle
Historial de estrellas y forks 0 ★ / 50 ⇿
0Estrellas
50Forks
99Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 16Menor 27Parche 55
Cada punto abarca 8 días.
OpenSSF Scorecard 5.1 / 10
5.1agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-28 08:26 UTC
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 1 paquetes directos y 0 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
Registro
Paquete
Versión
Relación
NuGet
ILMerge
3.0.29
directa
Avisos de dependencias 0
Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 1 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 0 tienen avisos conocidos, de los cuales 0 son directas.
Ningún aviso conocido afecta a las dependencias evaluadas.
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 43852,
"has_wiki": true,
"homepage": null,
"languages": {
"C#": 122387,
"AIDL": 5670,
"Java": 8053666,
"Kotlin": 2713559,
"Python": 908,
"JavaScript": 9296
},
"pushed_at": "2026-07-28T07:33:10Z",
"created_at": "2017-11-01T14:27:40Z",
"owner_type": "Organization",
"updated_at": "2026-07-28T00:28:44Z",
"description": "Common code used by both the Active Directory Authentication Library (ADAL) and the Microsoft Authentication Library (MSAL)",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "dev",
"license_spdx_raw": "MIT",
"primary_language": "Java",
"significant_languages": [
"Java",
"Kotlin"
]
},
"owner": {
"blog": "http://azure.microsoft.com/en-us/services/active-directory/",
"name": "Azure Active Directory",
"type": "Organization",
"login": "AzureAD",
"company": null,
"location": "Redmond, WA",
"followers": 797,
"avatar_url": "https://avatars.githubusercontent.com/u/2966316?v=4",
"created_at": "2012-12-04T23:19:57Z",
"is_verified": null,
"public_repos": 57,
"account_age_days": 4983
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v24.5.0",
"kind": "minor",
"published_at": "2026-07-15T03:07:31Z"
},
{
"tag": "v24.4.0",
"kind": "minor",
"published_at": "2026-06-18T00:59:04Z"
},
{
"tag": "v24.3.0",
"kind": "minor",
"published_at": "2026-05-30T01:52:55Z"
},
{
"tag": "v24.2.0",
"kind": "minor",
"published_at": "2026-05-01T17:23:23Z"
},
{
"tag": "v24.1.1",
"kind": "patch",
"published_at": "2026-04-17T18:14:49Z"
},
{
"tag": "v24.1.0",
"kind": "minor",
"published_at": "2026-03-27T01:23:08Z"
},
{
"tag": "v24.0.1",
"kind": "patch",
"published_at": "2026-03-06T00:54:52Z"
},
{
"tag": "v24.0.0",
"kind": "major",
"published_at": "2026-02-26T22:45:47Z"
},
{
"tag": "v23.3.0",
"kind": "minor",
"published_at": "2026-02-07T00:02:50Z"
},
{
"tag": "v23.2.0",
"kind": "minor",
"published_at": "2026-01-08T01:45:24Z"
},
{
"tag": "v23.1.1",
"kind": "patch",
"published_at": "2025-12-02T22:19:33Z"
},
{
"tag": "v23.1.0",
"kind": "minor",
"published_at": "2025-11-13T19:00:40Z"
},
{
"tag": "v23.0.2",
"kind": "patch",
"published_at": "2025-10-09T22:03:11Z"
},
{
"tag": "v22.1.0",
"kind": "minor",
"published_at": "2025-09-09T15:20:46Z"
},
{
"tag": "v22.0.3",
"kind": "patch",
"published_at": "2025-08-27T00:29:29Z"
},
{
"tag": "v22.0.1",
"kind": "patch",
"published_at": "2025-08-11T22:01:59Z"
},
{
"tag": "v22.0.0",
"kind": "major",
"published_at": "2025-08-06T20:22:45Z"
},
{
"tag": "v21.4.0",
"kind": "minor",
"published_at": "2025-07-08T00:16:56Z"
},
{
"tag": "v21.3.0",
"kind": "minor",
"published_at": "2025-06-16T21:02:23Z"
},
{
"tag": "v21.2.0",
"kind": "minor",
"published_at": "2025-06-05T19:24:53Z"
},
{
"tag": "v21.1.0",
"kind": "minor",
"published_at": "2025-06-05T19:24:30Z"
},
{
"tag": "v21.0.1",
"kind": "patch",
"published_at": "2025-05-02T02:32:27Z"
},
{
"tag": "v21.0.0",
"kind": "major",
"published_at": "2025-04-03T20:52:04Z"
},
{
"tag": "v20.1.3",
"kind": "patch",
"published_at": "2025-03-13T00:34:01Z"
},
{
"tag": "v20.1.2",
"kind": "patch",
"published_at": "2025-03-12T16:25:39Z"
},
{
"tag": "v20.1.1",
"kind": "patch",
"published_at": "2025-03-07T16:12:59Z"
},
{
"tag": "v19.0.2",
"kind": "patch",
"published_at": "2025-02-14T01:33:46Z"
},
{
"tag": "v20.0.0",
"kind": "major",
"published_at": "2025-02-10T09:48:26Z"
},
{
"tag": "v19.0.1",
"kind": "patch",
"published_at": "2025-01-27T04:50:12Z"
},
{
"tag": "v18.2.4",
"kind": "patch",
"published_at": "2025-01-23T23:16:17Z"
},
{
"tag": "v19.0.0",
"kind": "major",
"published_at": "2025-01-08T20:42:22Z"
},
{
"tag": "v18.2.3",
"kind": "patch",
"published_at": "2025-01-07T00:06:43Z"
},
{
"tag": "v18.2.2",
"kind": "patch",
"published_at": "2024-11-19T05:16:10Z"
},
{
"tag": "v18.2.1",
"kind": "patch",
"published_at": "2024-11-15T22:18:04Z"
},
{
"tag": "v18.2.0",
"kind": "minor",
"published_at": "2024-11-12T20:14:54Z"
},
{
"tag": "v18.1.2",
"kind": "patch",
"published_at": "2024-11-12T19:50:57Z"
},
{
"tag": "v18.1.0",
"kind": "minor",
"published_at": "2024-10-08T19:36:31Z"
},
{
"tag": "v17.7.2",
"kind": "patch",
"published_at": "2024-09-18T16:55:34Z"
},
{
"tag": "v18.0.0",
"kind": "major",
"published_at": "2024-09-12T19:08:15Z"
},
{
"tag": "v17.7.1",
"kind": "patch",
"published_at": "2024-09-13T00:08:48Z"
},
{
"tag": "v17.7.0",
"kind": "minor",
"published_at": "2024-08-08T19:53:06Z"
},
{
"tag": "v17.6.1",
"kind": "patch",
"published_at": "2024-07-15T21:13:14Z"
},
{
"tag": "v17.5.0",
"kind": "minor",
"published_at": "2024-06-12T01:02:21Z"
},
{
"tag": "v17.4.0",
"kind": "minor",
"published_at": "2024-05-22T17:58:51Z"
},
{
"tag": "v17.3.0",
"kind": "minor",
"published_at": "2024-04-15T16:11:34Z"
},
{
"tag": "v17.1.4",
"kind": "patch",
"published_at": "2024-03-28T15:36:10Z"
},
{
"tag": "v17.2.1",
"kind": "patch",
"published_at": "2024-03-28T15:30:57Z"
},
{
"tag": "v17.2.0",
"kind": "minor",
"published_at": "2024-03-14T20:23:31Z"
},
{
"tag": "v17.1.3",
"kind": "patch",
"published_at": "2024-03-13T20:27:25Z"
},
{
"tag": "v17.1.1",
"kind": "patch",
"published_at": "2024-02-21T19:07:38Z"
},
{
"tag": "v17.1.0",
"kind": "minor",
"published_at": "2024-02-13T00:56:12Z"
},
{
"tag": "v17.0.1",
"kind": "patch",
"published_at": "2024-01-25T20:43:04Z"
},
{
"tag": "v17.0.0",
"kind": "major",
"published_at": "2024-01-08T23:33:02Z"
},
{
"tag": "v16.3.0",
"kind": "minor",
"published_at": "2024-01-08T22:54:05Z"
},
{
"tag": "v16.2.0",
"kind": "minor",
"published_at": "2023-11-17T19:22:10Z"
},
{
"tag": "v16.1.2",
"kind": "patch",
"published_at": "2023-11-16T00:56:43Z"
},
{
"tag": "v16.1.1",
"kind": "patch",
"published_at": "2023-11-08T17:55:39Z"
},
{
"tag": "v16.1.0",
"kind": "minor",
"published_at": "2023-10-08T20:28:49Z"
},
{
"tag": "v16.0.1",
"kind": "patch",
"published_at": "2023-09-20T15:56:17Z"
},
{
"tag": "v15.0.0",
"kind": "major",
"published_at": "2023-08-08T04:12:59Z"
},
{
"tag": "v14.0.1",
"kind": "patch",
"published_at": "2023-07-24T04:18:31Z"
},
{
"tag": "v14.0.0",
"kind": "major",
"published_at": "2023-07-11T21:47:56Z"
},
{
"tag": "v13.0.3",
"kind": "patch",
"published_at": "2023-06-21T00:01:45Z"
},
{
"tag": "v12.0.2",
"kind": "patch",
"published_at": "2023-06-20T17:11:11Z"
},
{
"tag": "v13.0.1",
"kind": "patch",
"published_at": "2023-06-12T13:42:59Z"
},
{
"tag": "v12.0.1",
"kind": "patch",
"published_at": "2023-05-17T22:51:33Z"
},
{
"tag": "v11.0.1",
"kind": "patch",
"published_at": "2023-05-17T22:29:26Z"
},
{
"tag": "v12.0.0",
"kind": "major",
"published_at": "2023-05-09T23:56:22Z"
},
{
"tag": "v11.0.0",
"kind": "major",
"published_at": "2023-04-06T18:44:17Z"
},
{
"tag": "v10.1.1",
"kind": "patch",
"published_at": "2023-03-08T06:31:27Z"
},
{
"tag": "v10.0.0",
"kind": "major",
"published_at": "2023-02-07T03:17:17Z"
},
{
"tag": "v-9.1.0",
"kind": "other",
"published_at": "2023-01-09T13:26:10Z"
},
{
"tag": "v9.0.0",
"kind": "major",
"published_at": "2022-11-12T12:09:28Z"
},
{
"tag": "v8.0.3",
"kind": "patch",
"published_at": "2022-11-01T16:26:16Z"
},
{
"tag": "v8.0.2",
"kind": "patch",
"published_at": "2022-10-19T16:29:20Z"
},
{
"tag": "v8.0.1",
"kind": "patch",
"published_at": "2022-10-15T00:06:02Z"
},
{
"tag": "v8.0.0",
"kind": "major",
"published_at": "2022-10-11T18:40:04Z"
},
{
"tag": "v7.0.1",
"kind": "patch",
"published_at": "2022-09-21T05:15:42Z"
},
{
"tag": "v6.0.1",
"kind": "patch",
"published_at": "2022-08-16T18:33:30Z"
},
{
"tag": "v6.0.0",
"kind": "major",
"published_at": "2022-07-26T21:02:10Z"
},
{
"tag": "v5.0.1",
"kind": "patch",
"published_at": "2022-07-08T00:18:39Z"
},
{
"tag": "v5.0.0",
"kind": "major",
"published_at": "2022-06-14T19:41:58Z"
},
{
"tag": "v4.2.0",
"kind": "minor",
"published_at": "2022-04-25T22:30:35Z"
},
{
"tag": "v4.1.0",
"kind": "minor",
"published_at": "2022-04-21T16:18:50Z"
},
{
"tag": "v3.6.9",
"kind": "patch",
"published_at": "2022-03-31T02:12:02Z"
},
{
"tag": "v4.0.5",
"kind": "patch",
"published_at": "2022-04-21T16:41:15Z"
},
{
"tag": "v4.0.4",
"kind": "patch",
"published_at": "2022-03-29T18:37:47Z"
},
{
"tag": "v4.0.3",
"kind": "patch",
"published_at": "2022-03-22T21:58:13Z"
},
{
"tag": "v4.0.2",
"kind": "patch",
"published_at": "2022-03-16T19:30:12Z"
},
{
"tag": "v3.6.8",
"kind": "patch",
"published_at": "2022-03-30T22:10:15Z"
},
{
"tag": "v4.0.1",
"kind": "patch",
"published_at": "2022-03-16T19:29:20Z"
},
{
"tag": "v3.6.7",
"kind": "patch",
"published_at": "2022-01-12T20:25:39Z"
},
{
"tag": "v3.6.6",
"kind": "patch",
"published_at": "2021-12-16T05:48:16Z"
},
{
"tag": "v3.6.5",
"kind": "patch",
"published_at": "2021-12-03T16:58:05Z"
},
{
"tag": "v3.6.4",
"kind": "patch",
"published_at": "2021-12-03T16:57:40Z"
},
{
"tag": "v3.6.3",
"kind": "patch",
"published_at": "2021-12-03T16:57:05Z"
},
{
"tag": "v3.6.2",
"kind": "patch",
"published_at": "2021-09-27T22:18:32Z"
},
{
"tag": "v3.6.1",
"kind": "patch",
"published_at": "2021-09-24T22:02:21Z"
},
{
"tag": "v3.6.0",
"kind": "minor",
"published_at": "2021-08-23T19:04:28Z"
},
{
"tag": "v3.5.0",
"kind": "minor",
"published_at": "2021-08-02T23:37:47Z"
}
],
"recent_commits": [
{
"oid": "a73fd923294d6c1f021746d7537bce0f09cd3d57",
"body": "…6 (#3184)\n\n## What\nAdds OpenID-VC PendingIntent **return-to-caller** support. When an eSTS\nCA-block interrupt redirects the auth WebView to an `openid-vc://` URL,\nthe request is handed off to Microsoft Authenticator (the VID wallet).\nThis lets Authenticator bring the **original caller's task** back\n[…]\nedit/3615936)\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add OpenID-VC PendingIntent return-to-caller support, Fixes AB#361593…",
"author_name": "Sowmya Malayanur",
"author_login": "somalaya",
"committed_at": "2026-07-28T00:28:38Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3f7e5769d628474a731a9b6d15e882eee9c4c10a",
"body": "…ixes AB#3647677 (#3180)\n\nAdd String finalizeBlob() to IOnboardingTelemetryRecorder so callers can\nfinalize the onboarding telemetry blob through the interface instead of\ndowncasting to the concrete OnboardingTelemetryRecorder. Mark the Kotlin\nimpl's finalizeBlob() as override, refresh the interface\n[…]\nom/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3647677)\n\n---------\n\nCo-authored-by: Zhipan Wang <zhipanwang@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Promote finalizeBlob() onto IOnboardingTelemetryRecorder interface, F…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-07-24T17:17:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "37396d29f0f906f3fe329ccde03ddee6ed268b3d",
"body": "…41 (#3181)\n\n## What\n\nAdds a decoupled JUnit4 retry mechanism for **instrumented**\n(androidTest) tests. The Gradle `org.gradle.test-retry` plugin only\nretries JVM/Robolectric unit tests (`tasks.withType(Test)`); it does\nnothing for `connectedAndroidTest`.\n\n## Changes\n- `FlakyTestRetryRule` (`TestRul\n[…]\nnd get fixed.\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add on-device retry rule for flaky instrumented-tests, Fixes AB#36783…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-07-24T00:06:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d259137a7c6d3dcc39982c5e236e344db8a334fb",
"body": "…nse, Fixes AB#3692269 (#3192)\n\n### Summary\nRenames the top-level `error` field to `code` in the WebApps API error\nresponse produced by `WebAppError` (`FIELD_ERROR` -> `FIELD_CODE`). This\nfield naming was not correct from the beginning, so we don't need to\nworry about any downstream regressions.\n\nTh\n[…]\nppErrorTest` -> passing.\n\n\n[AB#3692269](https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3692269/)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Rename WebAppError 'error' field to 'code' in WebApps API error respo…",
"author_name": "melissaahn",
"author_login": "melissaahn",
"committed_at": "2026-07-22T22:00:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14dc1a75bc68968f3883d8e7e74232bdc0723258",
"body": "…(#3170)\n\n## Summary\n\nAdds a flight-gated validation step to the AAD WebView client's\nbroker-install `intent://` handling path. When the flight is enabled,\nthe parsed intent's component/selector are cleared and its target\npackage must be the Google Play Store before the activity is launched.\nWhen th\n[…]\nDoes not touch `OneAuthSharedFunctions` or any 1P IPC surface.\n\n---------\n\nCo-authored-by: Cesar Acosta <cesaracosta@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add flighted validation in WebView intent handling, Fixes AB#3674205 …",
"author_name": "Cesar Acosta",
"author_login": "cacosta33",
"committed_at": "2026-07-22T20:09:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ec03b0d0e55d5c2a129e8c9eee97518bfda88b52",
"body": "Co-authored-by: Azure DevOps Pipeline <build-agent@azuredevops.com>",
"is_bot": false,
"headline": "Release integration/24.5.0 back to dev (#3183)",
"author_name": "Sowmya Malayanur",
"author_login": "somalaya",
"committed_at": "2026-07-15T00:40:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a107a4136a0c869df519f4fd9c0fe3f04b2daa71",
"body": "…ttacks (FireWatch c1bf88bd), Fixes AB#3665141 (#3136)\n\nFixes\n[AB#3665141](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3665141)\n— redirect URI prefix-confusion hardening.\n\n## Summary\n\nTighten redirect URI matching in\n`AzureActiveDirectoryWebViewClie\n[…]\n by Copilot CLI on behalf of @zhipanwang for IcM 31000000624712.\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>\nCo-authored-by: Zhipan Wang <zhipanwang@microsoft.com>",
"is_bot": false,
"headline": "Security: tighten redirect URI matching to prevent prefix-confusion a…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-07-09T23:39:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f94c0ee6ac6ea5ccf5313f8a31d004c5959c66e9",
"body": "…06 (#3171)\n\n## Summary\n\nAdds an optional, flight-gated row to the HTTP authentication dialog\nthat shows the requesting **host** and **realm**, so a user can see\nwhich origin is asking for credentials. Defaults off; when the flight is\ndisabled the dialog is byte-for-byte unchanged.\n\nWork item:\nhttps\n[…]\nDoes not touch `OneAuthSharedFunctions` or any 1P IPC surface.\n\n---------\n\nCo-authored-by: Cesar Acosta <cesaracosta@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Display request origin in HTTP auth dialog (flighted), Fixes AB#36742…",
"author_name": "Cesar Acosta",
"author_login": "cacosta33",
"committed_at": "2026-07-09T16:03:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ab3053d519a5a22cfae3403b3fd5d4529cc1964c",
"body": "…034 (#3177)\n\nAdd an exception for intune package from the \"Multiple-listening apps\"\ncheck, as this blocks COBO/COPE/AM API BYOD flows from using CCT Browser\nas their authorization agent, and causing an additional interactive flow\nas we fallback to webview.\n\n\n[AB#3686034](https://identitydivision.vi\n[…]\nusers.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "add intune as an exception for browser validation rule, Fixes AB#3686…",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-07-09T00:41:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ae8f0a0b79a8283f80575524bcff5635642ebf2a",
"body": "…the onboarding blob, Fixes AB#3462876 (#3122)\n\n**C5** in the onboarding telemetry feature series (follows merged #3088\n/ #3111 / #3117; sibling of #3121 C3).\n\nAdds `OnboardingBlockingErrorParser` so the onboarding blob captures\nrich AADSTS / OAuth blocking errors during interactive token requests —\n[…]\nom/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3462876)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>\nCo-authored-by: Zhipan Wang <zhipanwang@microsoft.com>",
"is_bot": false,
"headline": "Add OnboardingBlockingErrorParser bridging clitelem/error_codes into …",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-07-08T21:54:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b6a31f942072455e4c09a4cb7e314ecddb572a29",
"body": "…lers, Fixes AB#3679357 (#3173)\n\n## Issue\n\n`SwitchBrowserUriHelper.buildResumeUri` / `buildProcessUri` trigger AAD\ncloud discovery — a synchronous HTTPS call on a cold cache. When invoked\nfrom a UI thread\n(`AzureActiveDirectoryWebViewClient.shouldOverrideUrlLoading` or\n`WebViewAuthorizationFragment.\n[…]\nntitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3590610)\n(`[SWAG - M3] DUNA Impl for Sign-in-with-Google`).\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "SwitchBrowser: move cloud discovery off main thread; consolidate hand…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-07-08T06:47:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7ed73d8106923191ad15c259876814c22842d9f",
"body": "…cache-wipe data loss, Fixes AB#3679391 (#3174)",
"is_bot": false,
"headline": "Record root-cause telemetry on KeyStore secret-key wipes to diagnose …",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-07-08T00:53:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95e127fa0155cd08aa6a571a223d430281f6f452",
"body": "… a stub., Fixes AB#3679354 (#3175)\n\n[AB#3679354](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3679354)\n\nWe had this check, but [we removed it as part of an\noptimization](https://github.com/AzureAD/microsoft-authentication-library-common-for-android/\n[…]\nCopilot@users.noreply.github.com>\nCo-authored-by: Dome Pongmongkol <19558668+rpdome@users.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Invalidate active broker cache if the active broker got reverted into…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-07T23:47:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "61bf7208aed08543ab836e91209da85b091ab48f",
"body": "…3684385 (#3176)\n\nUpdates the default value of the WRAPPED_SECRET_KEY_SERIALIZER_VERSION\nflight from 0 to 1 in CommonFlight.java, switching the WrappedSecretKey\nserializer to version 1 by default.\n\n\n[AB#3684385](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3684385)\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Bump WrappedSecretKeySerializerVersion flight default to 1, Fixes AB#…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-07-07T22:47:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a800b51740be93165d538895f57e0f6451349dc0",
"body": "Extracted from #3177 to keep that PR focused solely on the Intune\nbrowser-validation change.\n\nThis PR contains only the CI / test-infrastructure changes that were\npreviously bundled in #3177:\n\n- **common.yml / common4j.yml**: add `continueOnError: true` to the\nbuild_test_dev (Dev Branch Testing) job\n[…]\n\n\n\n[AB#3686928](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3686928)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fadi/ci nonblocking ignore china, Fixes AB#3686928 (#3179)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-07-07T22:19:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "439929e8dee17f818597df4b4f06a3efeb524f5a",
"body": "…(#3156)\n\n## Summary\n\nWires OWASP Dependency-Check into the \\common\\ Android library.\n\n## What changed\n\n- Applied the \\org.owasp.dependencycheck\\ Gradle plugin (v12.2.2).\n- Configured the \\dependencyCheck { }\\ block:\n- \\ ailBuildOnCVSS\\ defaults to **7.0** (override with\n\\-PdependencyCheckFailOnCvss\n[…]\n How to run locally\n\n\\\\\\powershell\n./gradlew :common:dependencyCheckAnalyze -PnvdApiKey=<key>\n\\\\\\\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add OWASP Dependency-Check to common library build, Fixes AB#3557141 …",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-07-02T17:08:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "42525051b07397d57c16337c7e02217a74260725",
"body": "…eview patterns, Fixes AB#3660483 (#3172)\n\n### What\n\nAdds a new **§14 Recurring False-Positive Patterns — Do NOT Flag These**\nsection to `.github/copilot-instructions.md` (placed at the end of the\nrules, before the appendices), plus reciprocal cross-references in the\nTesting section (§7.1 and §7.2).\n[…]\nes\n[AB#3660483](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3660483)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Refine copilot-instructions.md to suppress recurring false-positive r…",
"author_name": "Shahzaib",
"author_login": "shahzaibj",
"committed_at": "2026-07-02T16:09:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1442b0ae1255bdd36c92bf90ac41a4f56bf5f620",
"body": "…019 (#3165)\n\n[AB#3607019](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3607019)\n\nHarden `Authority.isKnownAuthority()` to compare developer-configured\nknown authorities by exact, case-insensitive parsed host, consistent\nwith `getEquivalentConfigured\n[…]\nusers.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Use exact host matching for known-authority validation, Fixes AB#3607…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-07-01T23:16:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d53fd5f1f2ed5597826e91ec6676c88d058ae83d",
"body": "…ixes AB#3667378 (#3166)\n\nDue to a known issue in Company Portal, the App Protection Policy flow\ncan trigger twice. The second instance only appears while still on the\nGet Access screen. By waiting 10s before clicking Continue, we absorb\nthe potential second instance so the PIN flow only runs once.\n\n[…]\n53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3673330)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add wait on Get Access screen to handle duplicate APP flow trigger, F…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-25T22:56:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ec824322b0aaf12916a5f71817e68cbbf21ecb75",
"body": "…roker 16.1.0), Fixed AB#3673639 (#3167)\n\n## Summary\n\nThis fixes a **dormant key-generation defect** in the KeyStore-backed\nsecret-key provider that only **detonated at scale starting with broker\n16.1.0** (common 24.2.0). It is **not exclusive to 16.1.0** — the same\ndefect already leaked in **16.0.1\n[…]\nedit/3673639)\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix dormant KeyStore key-gen regression (explodes on API <= 30 from b…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-06-24T21:40:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e77470ad65548fdd91c4c5869ea097f76746aa25",
"body": "Add moshi-adapters dependency to Common module so downstream consumers\nlike OneAuth do not have to add it explicitly.\n\nMoshi is used device registration API IPC serialization. OneAuth is soon\ngoing call device registration APIs.\n\nFixes\n[AB#3673534](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3673534)\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add moshi adapter dependency, Fixes AB#3673534 (#3168)",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-23T15:41:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0b219baca3bdc00a610de9a9d5d70aad40e0bcfb",
"body": "…, Fixes AB#3667378 (#3158)\n\nDue to a known issue, the Enter PIN and Confirm PIN screens can appear\ntwice in succession during app protection policy setup. This change\nextracts PIN entry logic into a helper method and retries if the PIN\nscreen reappears unexpectedly.\n\nFixes\n[AB#3667378](https://iden\n[…]\n-91b5-ef6ba7a6bf26/_workitems/edit/3667378)\n\n\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1653057&view=results\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Add resiliency for duplicate PIN screens in handleAppProtectionPolicy…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-18T19:41:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a3391c39c5a66d068ecdc17739336aec5630d3d0",
"body": "…tion., Fixes AB#3669655 (#3162)\n\nThis pull request updates the build process for the `common4j` module to\nensure that `sourcesJar` and `javadocJar` artifacts are always generated\nas part of the `assemble` task. This change will make these artifacts\navailable for public Maven publication by default.\n[…]\nivision.visualstudio.com/Engineering/_build/results?buildId=1653173&view=results\n\n\n\n[AB#3669655](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3669655)",
"is_bot": false,
"headline": "Generate sourcesJar and javadocJar artifacts for public Maven publica…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-06-18T16:23:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb98ec58b36af556fed6de41480b783c8ee3df53",
"body": "### Summary\nUpdating changelog and versioning.\n\n\n[AB#3669341](https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3669341)\n\n---------\n\nCo-authored-by: Azure DevOps Pipeline <build-agent@azuredevops.com>\nCo-authored-by: Shahzaib <37125644+shahzaibj@users.noreply.github.com>\nCo-authored-by: Dome Pongmongkol <19558668+rpdome@users.noreply.github.com>",
"is_bot": false,
"headline": "Release integration/24.4.0 to dev, Fixes AB#3669341 (#3160)",
"author_name": "melissaahn",
"author_login": "melissaahn",
"committed_at": "2026-06-17T20:51:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "091268ebe167e4d458f45bec021fbb14d4b96560",
"body": "[AB#3582859](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3582859)\n\nWe're introducing stress test to the pipeline. To make sure we're not\ncausing a cascade failure (due to this test eating the \"time quota\" of\nexisting runs). We will create an exclusive stage for stresstest only.\n\nThis annotation will be used to mark which test should be in that stage.",
"is_bot": false,
"headline": "Add StressTest annotation, Fixes AB#3582859 (#3103)",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-17T17:57:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e616997b492974c2269055552853f4e64118dba",
"body": "[AB#3662302](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3662302)",
"is_bot": false,
"headline": "Update Delete Device Endpoint, Fixes AB#3662302 (#3157)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-06-17T07:46:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f505fc5fbdc8fe33dcbcc023bda256be86f44f39",
"body": "… (#3134)\n\n## Summary\nImproves error handling and telemetry in the switch browser flow.\n\n## Changes\n- **SwitchBrowserActivity**: Use setResultAndFinish for consistent\nresult delivery. Add error bundles for all failure paths.\n- **Telemetry**: Use nullable span references instead of\nSpanExtension.curr\n[…]\nusers.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Improve switch browser error handling and telemetry, Fixes AB#3624126…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-06-12T17:55:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ebde141a11985d06a320dd8e39ba8915fc215cf",
"body": "…y, Fixes AB#3662317 (#3153)\n\nFixes\n[AB#3662317](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3662317)\n\nThe `CHROME_DEV.signingCertificateThumbprint` in `AppRegistry` was\nmissing the `2H` characters in the middle of the base64 string, so\nBrowser SSO \n[…]\nateThumbprint = \"JlOLOTFn6OFBFWuWQJYJ8h/aozEN7/zLFTfioXiXTrU6Yaft4cdEbdpkoJIvmB7Gv2HpHu6QOz+XIaXybtzL7A==\"\n```\n\nA cherry-pick PR will follow for `release/24.4.0` (consumed by broker\n`release/16.3.0`).",
"is_bot": false,
"headline": "Fix incorrect Chrome Dev signing certificate thumbprint in AppRegistr…",
"author_name": "Shahzaib",
"author_login": "shahzaibj",
"committed_at": "2026-06-12T02:42:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a4aacb088d86e6488e1839933d384d5a81bca06f",
"body": "…#3662220 (#3151)",
"is_bot": false,
"headline": "Add a separate span for BatteryOptimizationExemption prompt, Fixes AB…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-12T01:53:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "585e9aa25f3a549b45232b09aa50c0b208065e0c",
"body": "…59061 (#3145)\n\nThis PR adds an explicit signal to the interactive auth result broadcast\nso downstream consumers (OneAuth) can detect whether the switch_browser\nprotocol flow was initiated during the session. Currently, we don't have\nstandard way to relaying back telemetry from Common to OneAuth, wh\n[…]\n an overridable hook.\n\nFixes\n[AB#359061](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/359061)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Add swtich browser flag to interactive result propertybag, Fixes AB#3…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-10T23:46:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cb83e33dd869ad4febc62f873a2cfd7ccdd01615",
"body": "[AB#3648301](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3648301)\n\nThe original change worked on Samsung S23, but not on the pipeline\n(Pixel)\n\nMade a change to accommodate that, validated via emulator.",
"is_bot": false,
"headline": "fix tbca prompt on pixel, Fixes AB#3648301 (#3150)",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-10T21:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e5eb634bdd495eca56374242a7e921829c969d6d",
"body": "……, Fixes AB#3659701 (#3149)\n\n…pp lists\n\n- Add MDE_APP_PROD and MDE_APP_DEBUG entries (com.microsoft.scmx)\n- Register MDE in GET_DEVICE_TOKEN_AUTHORIZED_APPS\n- Register MDE in DEVICE_REGISTRATION_AUTHORIZED_APPS\n\n\n[AB#3659701](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3659701)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Add Microsoft Defender for Endpoint (MDE) to AppRegistry authorized a…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-10T20:57:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be0cd6e8168aba2473de348c5a1582acfc7b63cd",
"body": "… AB#3462876, Fixes AB#3462876 (#3148)\n\n## What\n\n`OnboardingTelemetryRecorder.finalizeBlob()` now returns the populated\nblob whenever a valid `sessionCorrelationId` is present, instead of\nreturning an empty string when `blockingErrors` is empty.\n\n## Why\n\nThe previous early-return on empty `blockingE\n[…]\narding telemetry at all (no seed\ncreation in `BackgroundRequest`), so unaffected.\n\n\n[AB#3462876](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3462876)",
"is_bot": false,
"headline": "Onboarding telemetry: emit blob when sessionCorrelationId is present,…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-06-10T20:29:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7937bc09cb5592c096033ba7630843a4e15e2411",
"body": "…1 (#3144)\n\nFixes\n[AB#3658391](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3658391)\n\nFlip CommonFlight.SWITCH_BROWSER_PROTOCOL_REQUIRES_STATE default from\nfalse to true. This will be overridden in broker with default value =\nfalse, keeping broker be\n[…]\nit <mchand@microsoft.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Move SWITCH_BROWSER_PROTOCOL_REQUIRES_STATE to Broker Fixes AB#365839…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-10T17:48:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7007139b824a065aef0c6abf429b784c99381d60",
"body": "…3141)\n\nPropagate server telemetry in some additional branches of\nExceptionAdapter\n\n\n[AB#3604499](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3604499)\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add more telemetry coverage in ExceptionAdapater, Fixes AB#3604499 (#…",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-06-10T15:55:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "872e66e104e11241c0930bd18d16e8bd09c61d10",
"body": "Remove all mention of the legacy lab query api, as well as other apis i\ncome across.\n\nConsumers check:\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1648533&view=results\n\n\n[AB#3647753](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_work\n[…]\nhored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: siddhijain <siddhijain@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "remove all mention of lab query, Fixes AB#3647753 (#3107)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-06-10T06:34:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "66fb3c9537c0d8d3622484c482bb6662363b104d",
"body": "…#3648301 (#3142)\n\n[AB#3648301](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3648301)\n\nthis dialog will show up BEFORE the broker proceed to do WPJ\nregistration/key upgrade\n<img width=\"432\" height=\"936\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/dad6d946-e6f9-428d-9e0d-9d3d6a95a4fe\"\n/>\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add Battery Optimization Dialog Support in Token Bining aut, Fixes AB…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-09T23:58:35Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bb7b82dbaf8c5fabe9cc2c1ba9370de5b7195ad6",
"body": "…xes AB#3618269 (#3146)\n\n[AB#3618269](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3618269)\n\nWhen release-integration/24.3.0 was back-merged into dev (#3131), some\nentries that were merged to dev *after* the 24.3.0 RC cut got listed\nunder `Version 24\n[…]\n RC\" cut). Any entry\ncurrently listed under Version 24.3.0 that wasn't present at the RC cut\nmust have arrived via the back-merge.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix changelog: move dev-sync entries from Version 24.3.0 to vNext, Fi…",
"author_name": "Shahzaib",
"author_login": "shahzaibj",
"committed_at": "2026-06-09T23:31:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e404a43518b0306c0e63dff58f52a8ad315858f7",
"body": "… AB#3627515 (#3137)\n\n## Summary\nAdd enableSwitchBrowser param to AuthorizationActivityParameters and\nAuthorizationActivityFactory so consumers (OneAuth) can opt-in to the\nSwitch Browser protocol. When enabled, the factory checks browser\navailability (Chrome/Edge/AEA), if app has correctly configure\n[…]\nd\nmanifest check\n\n## Fixes\n[AB#3627515](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3627515)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Add enableSwitchBrowser opt-in to AuthorizationActivityFactory, Fixes…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-09T22:35:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eb36adaff545aa71c8953ce4c9a87271b77b4d8b",
"body": "…ity, Fixes AB#3627062 (#3139)\n\n[AB#3627062](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3627062)\n\n- getDeviceIdleMode and getPowerOptimizationSettings are no longer used\n(redundancy with other methods), removing.\n\n- Remove ENABLE_HANDLING_FOR_EDGE_\n[…]\new wrapper)\nis invoked, you'll see transition animations (which looks like \"flicker\"\nin broker flows where we might call acquiretoken multiple time. Removing\nthe animation so it no longer looks weird.",
"is_bot": false,
"headline": "Remove stale code, eliminate flickers due to BrokerAuthorizationActiv…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-09T21:57:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8f6e570223d7397cd8db83601c3f5e7d9dc497b3",
"body": "[AB#3618269](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3618269)\n\n---------\n\nCo-authored-by: Azure DevOps Pipeline <build-agent@azuredevops.com>\nCo-authored-by: fadidurah <88730756+fadidurah@users.noreply.github.com>\nCo-authored-by: Shahzaib Jameel <shjameel@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Merge Release integration/24.3.0 to dev, Fixes AB#3618269 (#3131)",
"author_name": "Shahzaib",
"author_login": "shahzaibj",
"committed_at": "2026-06-09T21:33:48Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3efa7f5252abffdbaec68f55bd2e78e86d48d71c",
"body": "…, Fixes AB#3590615 (#3133)\n\nIntroduces an open SwitchBrowserRedirectActivity in Common that handles\nbrowser redirects for the Switch Browser protocol. This activity catches\nthe /switch_browser_resume redirect and forwards it to\nSwitchBrowserActivity.\n\nBrokerBrowserRedirectActivity now extends this \n[…]\nadd\nintent-filters.\n\nFixes\n[AB#3590615](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3590615)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Add SwitchBrowserRedirectActivity for non-broker Switch Browser flows…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-06-08T22:48:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a96c1440230bf43996e472a4b23c7e4fc1906fa5",
"body": "[AB#3611236](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3611236)\n\nUpdates `opentelemetry-api` (and transitives) from 1.18.0 to 1.62.0.\n\n## Changes\n- `gradle/versions.gradle` -- `openTelemetryVersion` 1.18.0 -> 1.62.0\n- `BenchmarkSpan.kt` -- `setAtt\n[…]\n the project's Kotlin 1.8 compiler. The\npin is binary-compatible with `opentelemetry-api`/`-context` 1.62 --\n`extension-kotlin` only calls stable `Context` APIs that are unchanged\nacross 1.18 -> 1.62.",
"is_bot": false,
"headline": "Update OpenTelemetry to 1.62.0, AB#3611236, Fixes AB#3611236 (#3125)",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-06-08T17:47:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "906f0263ba2074d2b7fa8be6c3c66042b5a993b0",
"body": "……, Fixes AB#3622375 (#3138)\n\nThe 'Other ways to sign in' UI element check in handlePasswordField()\nwas hardcoded to FIND_UI_ELEMENT_TIMEOUT_SHORT (10s), which was\ninsufficient for the WebView to load login.live.com through the IPC +\nnetwork chain. This caused intermittent TimeoutExceptions in MSA b\n[…]\nndler.\n\nFixes: TestCase2688459 (NAA ATS), TestCase2637829 (MSA Prompt.Login)\n\nFixes\n[AB#3622375](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3622375)",
"is_bot": false,
"headline": "Fix MSA login timeout: use configurable timeout for 'Other ways to si…",
"author_name": "Sowmya Malayanur",
"author_login": "somalaya",
"committed_at": "2026-06-05T23:08:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "249a5fc8d862b4c21d01bc36f18c406ee1f6e4b7",
"body": "### Summary\nWe are disabling the GetCookies API as Edge will use getAllSsoTokens\ninstead. There shouldn't be any dependencies here as Edge nor anyone\nelse has actually been calling this API yet.\n\n\n[AB#3624552](https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3624552)",
"is_bot": false,
"headline": "Disabling GetCookies API from webapps APIs, Fixes AB#3624552 (#3135)",
"author_name": "melissaahn",
"author_login": "melissaahn",
"committed_at": "2026-06-05T16:29:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3503d1f3bd50d7e82a33e5030b7bfd8bdca2cbc6",
"body": "… (#2907)\n\nUpdating our ui infrastructure to point to ID4SLAB2 resources\n\n- Updated LAB api signatures\n- Updated UPN JSON fields\n- Rewire existing test classes to use the UPN JSON rather than LabQuery,\nwhich is no longer available on ID4SLAB2\n\n\n[AB#3525444](https://identitydivision.visualstudio.com/\n[…]\n53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3525444)\n\n---------\n\nCo-authored-by: richardtz12 <richardtz12@gmail.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Update common UI infrastucture to point to ID4SLAB2, Fixes AB#3525444…",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-06-04T16:14:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "111cc5a68aa5f53c84973da0ec21e8cf9d89fe02",
"body": "… (#3132)\n\nThis pull request makes a small but important configuration change to\nthe `CommonFlight` enum. The default value for the\n`ENABLE_PASSKEY_REGISTRATION` flight has been changed from `false` to\n`true`, enabling the passkey registration feature by default.\n\n* The `ENABLE_PASSKEY_REGISTRATION`\n[…]\n(https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3121984)\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Enable passkey registration feature in CommonFlight, Fixes AB#3121984…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-06-03T20:41:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "242da8c89d079ed093bcda308f9efec26dafb02a",
"body": "…I Automation, Fixes AB#3600652 (#3112)\n\nImplement custom HTTP headers request interceptor for native auth CIAM\nrequests\n\n- Add NativeAuthHeaderValidator to enforce header naming rules\n- Pass interceptor through the full config propagation chain:\nOAuth2StrategyParameters → NativeAuthCIAMAuthority →\n\n[…]\nored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: fadidurah <fadidurah@microsoft.com>\nCo-authored-by: fadidurah <88730756+fadidurah@users.noreply.github.com>",
"is_bot": false,
"headline": "Add NativeAuthRequestInterceptor for custom per-request headers and U…",
"author_name": "Silviu Petrescu",
"author_login": "spetrescu84",
"committed_at": "2026-06-03T14:45:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ea91c62619550949c557e15298c3afc701b5b329",
"body": "[AB#3609347](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3609347)\n\n## Why\n\nTwo things are slowing our broker library builds:\n\n1. **Feed routing** — we publish to `AndroidADAL` but consume from\n`NewAndroid`. NewAndroid has AndroidADAL as a deeper ups\n[…]\nld.gradles.\n- AndroidADAL → NewAndroid upstream relationship: will be configured\nmanually in ADO Artifacts after merge.\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Build perf: enable Gradle configure-on-demand, Fixes AB#3609347 (#3113)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-06-01T20:17:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ef688adc55132973a84244e8c5835467bf7731b0",
"body": "…127)\n\n## Summary\n- Add .gitattributes in common repo\n- Configure changelog.txt with merge=union to auto-resolve append-only\nchangelog conflicts\n\n## Validation\n- Verified: git check-attr merge -- changelog.txt => union\n\n[AB#3621652](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3621652)",
"is_bot": false,
"headline": "Auto-resolve changelog merges with union driver, Fixes AB#3621652 (#3…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-05-30T03:06:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd7c53a9e0669fae3f6319bf77a6a3189e6bb294",
"body": "During the acquire token flow, we make a call to /token endpoint to get\nan access token using PRT. As part of this call, there is a telemetry\nheader returned by ests for telemetry purposes, which we want to send\nback up to oneauth. it seems that there is an issue in the parsing that\ni missed, partic\n[…]\nts. This change fixes that, I\nvalidated it manually and Kevin is validating now.\n\n\n\n[AB#3604499](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3604499)",
"is_bot": false,
"headline": "Fix Token Endpoint Server Telemetry Parsing, Fixes AB#3604499 (#3128)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-05-27T19:56:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8638b3b9154e61ec4f6b6079b109fc424ce60bb9",
"body": "…e paths, Fixes AB#3462876 (#3123)\n\nMakes `MsalBrokerResultAdapter` carry the onboarding telemetry blob\nsymmetrically across **every** broker outcome (success, failure,\ncancel), closing the failure-path gap Veena flagged on #3111 and\nunblocking the broker recorder-lifecycle work.\n\n**What this adds:*\n[…]\ns auth logic. No flight gate\n(blob is only present if a prior PR seeded it).\n\nFixes\n[AB#3462876](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3462876)",
"is_bot": false,
"headline": "Propagate onboarding telemetry blob through broker success and failur…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-05-22T00:50:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf1f13404b11941d2238499a3a400f83e3c9d0cc",
"body": "…t, Fixes AB#3462876 (#3121)\n\n**C3** in the onboarding telemetry feature series (follows merged #3088\n/ #3111 / #3117).\n\nAdds optional onboarding-telemetry instrumentation to\n`AzureActiveDirectoryWebViewClient` so the WebView page-transition flow\ncan populate the onboarding blob.\n\n**What this adds:*\n[…]\n `AzureActiveDirectoryWebViewClientTest` covers all setter +\nemission paths.\n\nFixes\n[AB#3462876](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3462876)",
"is_bot": false,
"headline": "Wire onboarding telemetry hooks into AzureActiveDirectoryWebViewClien…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-05-21T22:51:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0a7211640965f038d0f9e547db1616a932e6f40a",
"body": "…61 (#3124)\n\n- Set the existing AttributeName.ipc_strategy on the\nDeviceRegistrationIpc span when an IPC strategy succeeds, making it easy\nto identify the winning strategy.\n- Refactor communicateProtocolWithStrategy into\nsendProtocolRequestToBroker to separate bundle packing from IPC\ntransport. Pack\n[…]\n(https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3571861)\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Emit ipc_strategy attribute and refactor execute flow, Fixes AB#35718…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-05-21T19:41:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e536e1ebce1b90ac3dbeceb59f61f7c60c08b567",
"body": "…AB#3611725 (#3126)\n\nFixes\n[AB#3611725](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3611725)\ntracks the common-side fix for the MSAL customer issue\n[#2414](https://github.com/AzureAD/microsoft-authentication-library-for-android/issues/2414).\n\n## Cus\n[…]\n the scenario the customer hit. Strict mismatches are still\nrejected.\n\n---------\n\nCo-authored-by: shjameel <shjameel@microsoft.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix Edge browser selection for multi-signer APKs (MSAL #2414), Fixes …",
"author_name": "Shahzaib",
"author_login": "shahzaibj",
"committed_at": "2026-05-21T05:43:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c217af2122711a29869c62afb893aa05785c1e31",
"body": "…1B, no browser 1.9 APIs), Fixes AB#3561426 (#3093)\n\n## Summary\n\nThis PR implements the **Common-side** of Auth Tab support for the\nswitch-browser flow using **Option 1B** — a provider-based architecture\nthat keeps Common free of `browser:1.9.0` dependencies.\n\n> **Companion PR**: Broker\n[#157](https\n[…]\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: p3dr0rv <76129899+p3dr0rv@users.noreply.github.com>\nCo-authored-by: p3dr0rv <pedroro@microsoft.com>",
"is_bot": false,
"headline": "[AuthTab] Rework Common to provider-based strategy selection (Option …",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-05-21T00:54:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1078f023cb5116541d1339f8a07e87e6608e0793",
"body": "[AB#3605734](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3605734)\n\nI don't think this is needed (we don't use bouncy here)... i'm just\nupdating for the sake of consistency.",
"is_bot": false,
"headline": "Update Bouncy to 1.84, Fixes AB#3605734 (#3116)",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-05-18T18:10:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "883db98d8968bc99327e2a79c72d4777388fdb47",
"body": "…B#3450074 (#3086)\n\n## Summary\n\nAdds the `provisionResourceAccountCredentials` IPC API to\n`DeviceRegistrationClientApplication` (DRCA) enabling OneAuth consumers\nto provision resource account credentials via the broker. Also adds\nTeams IP Phone (Sakurai) app entries to `AppRegistry`.\n\n## Changes\n\n##\n[…]\nlot <223556219+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: mohitc1 <22034758+mohitc1@users.noreply.github.com>",
"is_bot": false,
"headline": "Add provisionResourceAccountCredentials API to Common's DRCA, Fixes A…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-05-16T01:13:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aaf68b467c92f4c31fad5257e20c2dcab1bef55e",
"body": "…lemetry, Fixes AB#3462876 (#3117)\n\n## Summary\n\nAdds the remaining step ID and blocking error constants from the Mobile\nOnboarding Telemetry design (section 9 Step Taxonomy) to\n`OnboardingTelemetryConstants`. Pure additive - no behavior change, no\ncaller wiring in this PR.\n\nLinked Feature:\n[AB#34628\n[…]\nerSsoController`, `PrtController`, error\nhandler)\n- OneAuth caller updates (AM API + WebCP detection per Veena's PR #3088\ncomment)\n- **No breaking changes** - purely additive to the existing `object`.",
"is_bot": false,
"headline": "Add additional step ID and blocking error constants for onboarding te…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-05-16T00:15:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3e6df21e5a09ad8dba26adbe9c7f4d2ce532d736",
"body": "…sTokensWithInters… (#3114)\n\nFixes\n[AB#3590267](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3590267)\nThis PR extends use-filter-then-clone flight to one more method and add\nsome telemetry attributes to check if the latency of ATS can be\ncorrelated t\n[…]\nnts and credentials in memory.\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: siddhijain <30181294+siddhijain@users.noreply.github.com>",
"is_bot": false,
"headline": "Fixes AB#3590267 Extend filter-then-clone optimization to deleteAcces…",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-05-15T22:51:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "26de10819c595f0b718987521755cbd60e505059",
"body": "Propagate the parsed x-ms-clientdata (token endpoint) and clientdata\nquery parameter (authorize endpoint) data from the response handlers\nthrough TokenResult, MicrosoftStsAuthorizationResult, and ultimately\nonto AcquireTokenResult so callers can access server-side telemetry\n(error, sub-error, accoun\n[…]\n6ba7a6bf26/_workitems/edit/3604499)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Wire ClientDataInfo through AcquireTokenResult, Fixes AB#3604499 (#3109)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-05-15T20:47:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a101521fbb5837e218aad86386e494b5574596cd",
"body": "…#3111)\n\n## Summary\n\nAdds the IPC plumbing for the onboarding telemetry blob to flow\nclient↔broker. Independent of PR #3088 (which adds the\nrecorder/store/constants); both are needed together for end-to-end\nbrokered onboarding telemetry.\n\nLinked Feature:\n[AB#3462876](https://identitydivision.visuals\n[…]\nd locally via OneAuth `local-only-onboarding-telemetry`\nbranch + a combined Common build (`mavenLocal` `0.0.0-zhipan-mot-7`):\nseed JSON flows OneAuth → BrokerRequest → broker → BrokerResult →\nOneAuth.",
"is_bot": false,
"headline": "Broker IPC plumbing for onboarding telemetry blob, Fixes AB#3568357 (…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-05-15T01:19:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "27abc3170c0f77516ee69a83545ef58ce7c8e04e",
"body": "… store for mobile onboarding flow, Fixes AB#3462876 (#3088)\n\n## Summary\n\nAdds shared Android infrastructure for tracking mobile onboarding\ntelemetry — the E2E flow where users hit Conditional Access (CA)\nblocking errors (broker install, MDM enrollment, device registration)\nand must remediate before\n[…]\nd to Kotlin\n\n## Dependencies\n- **Upstream of**: OneAuth onboarding telemetry PR (Djinni + C++ core +\nAndroid platform layer)\n- **No breaking changes**: all new files, no modifications to existing\ncode",
"is_bot": false,
"headline": "Add onboarding telemetry recorder, constants, and session correlation…",
"author_name": "wzhipan",
"author_login": "wzhipan",
"committed_at": "2026-05-14T23:42:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "62b7c33b7f3a25e48d114315a890a7a48c244943",
"body": "…(#3102)",
"is_bot": false,
"headline": "handle app_link query parameter Intent Redirection, Fixes AB#3590136 …",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-05-14T03:53:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16b1bc822d89140feccdb645725239885a39508d",
"body": "…es AB#3587778 (#3106)\n\nThis pull request adds a new validation job for the MSAL Automation App\nto the Azure Pipelines configuration. This ensures that the automation\napp is built and validated as part of the pull request process,\nimproving test coverage and reliability for changes impacting this\nco\n[…]\nedit/3587778)\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add msalautomationapp validation job to build-consumers pipeline, Fix…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-05-13T06:04:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b9fc66b5b69c35f3ca533b1f5d2ff30d05ae9d87",
"body": "…57152 (#3045)\n\nWhen any change is made to a build.gradle or versions.gradle file that\nadds a new dependency or changes a dependency version, Copilot will now\ndisplay a warning pointing to the Adding or Updating Gradle Dependencies\ndocumentation.\n\n\n[AB#3557152](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3557152)\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add dependency change warning to copilot-instructions.md, Fixes AB#35…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-05-13T01:33:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "184019b87a1e038dfdc13d64671cb8bce2114f92",
"body": "…s enabled without in-memory cache instance (#3110)\n\nFixes\n[AB#3601828](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3601828)\n\n## Problem\n\nPR #3100 introduced casts from `mAccountCredentialCache` to\n`SharedPreferencesAccountCredentialCacheWithMemoryC\n[…]\n23556219+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: siddhijain <30181294+siddhijain@users.noreply.github.com>",
"is_bot": false,
"headline": "Fixes AB#3601828 Fix ClassCastException when cloneThenFilter flight i…",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-05-12T22:29:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5bce6117a9d3304ecd4db85e1b035675e4a84bd9",
"body": "…one', Fixes AB#3595497 (#3108)\n\nIn lookup mode, the ID token was always replaced with an empty-claims\nplaceholder regardless of the actual eSTS response. This caused the\nusername to be lost in the interactive fallback path where eSTS returns\na real ID token.\n\nFix: Only use the lookup placeholder wh\n[…]\nreturns sentinel username\n\n\n[AB#3595497](https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3595497)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Edge TB: Fix lookup mode: parse real ID token when response is not 'n…",
"author_name": "melissaahn",
"author_login": "melissaahn",
"committed_at": "2026-05-12T17:14:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dabefab6144029cbbe76f5ee833a82adada0c860",
"body": "…th filter-then-clone (#3100)\n\nFixes\n[AB#3588022](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3588022)\nApply filter-then-clone optimization to MsalOAuth2TokenCache.load() and\ngetIdTokensForAccountRecord() methods behind the existing\nENABLE_FILTER_TH\n[…]\n23556219+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: siddhijain <30181294+siddhijain@users.noreply.github.com>",
"is_bot": false,
"headline": "Fixes AB#3588022 Optimize load() and getIdTokensForAccountRecord() wi…",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-05-06T21:57:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a68f495634dea8d237ce9444d9166c89d6f7ff1e",
"body": "Fixes\n[AB#3557679](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3557679)\n\n---------\n\nCo-authored-by: Azure DevOps Pipeline <build-agent@azuredevops.com>",
"is_bot": false,
"headline": "Merge release integration/24.2.0 to dev, Fixes AB#3557679 (#3105)",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-05-05T17:13:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d2248976a887937edb1f9299120bfea920a1fe4",
"body": "…ixes AB#3586240 (#3097)\n\nAs seen here\n\nhttps://identitydivision.visualstudio.com/Engineering/ISP%20-%20ID%20Risk%20for%20Passkey%20Registration%20and%20Recovery/_build/results?buildId=1626465&view=logs&s=ff4555a9-e895-5c04-ab14-88c3aa79b4da&j=9a146641-6417-5767-ad44-2e332adab356\n\nSeems to have happ\n[…]\nlot <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: mohitc1 <22034758+mohitc1@users.noreply.github.com>",
"is_bot": false,
"headline": "Add handleButtonClickForObjectWithTextSafely overload to fix build, F…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-04-24T22:05:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2751979f808b1b195b499dd5a893e1200d327aa8",
"body": "…trategy, Fixes AB#3568776 (#3070)\n\nMultiple-apps-listening-on-same-URL-scheme validation previously ran at\nPCA initialization time in MSAL, surfacing errors immediately at startup\nbefore any token request was made. This caused false positives in broker\nflows where the browser path is never taken. T\n[…]\nored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: fadidurah <88730756+fadidurah@users.noreply.github.com>\nCo-authored-by: fadidurah <fadidurah@microsoft.com>",
"is_bot": false,
"headline": "Add BrowserRedirectValidator and integrate into BrowserAuthorizationS…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-04-24T16:11:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2388e1da872a9b5134cdb8c70fba71a5f5433cca",
"body": "… AB#3556494 (#3090)\n\n<a\nhref=\"https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3556494\n\n\">[[AB#3556494](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3556494)](https://identitydivision.visualstudio.com/Engineering/_workitems/edit\n[…]\nARqjhpcjEgUC1m9f8sjVib1RAlSQ9S09Zw)\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add support for Authenticator app activation links in WebView., Fixes…",
"author_name": "Rohit Luthra",
"author_login": "rohitluthra",
"committed_at": "2026-04-23T22:16:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d8249fa8561bc3dd58148b63f62ec0b0f0e19da5",
"body": "[AB#3580011](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3580011)\n\nWith\nhttps://github.com/AzureAD/microsoft-authentication-library-for-android/pull/2500\nThis is no longer needed.",
"is_bot": false,
"headline": "remove unused build parameter, Fixes AB#3580011 (#3089)",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-04-21T21:33:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85f1948e854aaf713de53fa45090c6664f9a740d",
"body": "…ption key with MSAL, Fixes AB#3577391 (#3081)\n\n[AB#3577391](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3577391)\n\n### Problem\n\nIn Company Portal, `AndroidAuthSdkStorageEncryptionManager` reads from\nthe global `AuthenticationSettings.INSTANCE.getSec\n[…]\n→ IPC fallback → cache re-populated\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix: WPJ's BrokerDiscovery cache crash due to shared predefined encry…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-04-20T21:18:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b53d87e341edafebd97375f0dc03951321b02b5f",
"body": "…ryAuthority class monitors, Fixes AB#3578299 (#3082)\n\n## Summary\n\nFixes an ABBA deadlock between `AzureActiveDirectory.class` and\n`AzureActiveDirectoryAuthority.class` monitors, discovered during ANR\ninvestigation on Microsoft Authenticator (Broker v16.0.0). Under high\nconcurrency (multiple apps ca\n[…]\no.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3578299)\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>\nCo-authored-by: Dome Pongmongkol <19558668+rpdome@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix ABBA deadlock between AzureActiveDirectory and AzureActiveDirecto…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-04-16T15:10:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d87bc2eddbb8444f3743e5e0f7d0cdc64f630e0d",
"body": "Update bouncy castle version due to vulnerability revealed\n\nhttps://identitydivision.visualstudio.com/Engineering/_componentGovernance/AuthClientAndroidPipelines/alert/13283474?typeId=34726829&pipelinesTrackingFilter=0\n\nValidation:\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1617164&view=results\n\n\n[AB#3565065](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3565065)",
"is_bot": false,
"headline": "bouncyCastleVersion 1.80, Fixes AB#3565065 (#3067)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-04-16T00:44:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16cd3650dc05d942b956f63493a88246430c43b0",
"body": "use feed for robolectric\n\n\n[AB#3544225](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3544225)",
"is_bot": false,
"headline": "use feed for robolectric, Fixes AB#3544225 (#3079)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-04-15T20:38:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1df7e038b782730aa9c1f30c70e1e40b240fa29e",
"body": "Fixes\n[AB#3577207](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3577207)\n\nThe failure is due to change ([Refactor device registration to use\nprotocol types and controller from common, Fixes AB#3512895 by\nmchand_microsoft · Pull Request #138 ·\nidentit\n[…]\n\nno device registration records.\" instead of \"[]\". This is better than\nreverting to \"[]\", given the message is more friendly for manual testing\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "Fix TestCase2519809 , Fixes AB#3577207 (#3080)",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-04-15T16:31:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ef1682804dfb6a2284f97e3cc13a04e5eb2473ed",
"body": "…ommon4j, Fixes AB#3561423 (#3072)\n\nAdds the feature flag and attribute constants needed to instrument the\nAuth Tab switch browser feature.\n\n## Changes\n\n### `CommonFlight.java`\n- New flight:\n`ENABLE_AUTH_TAB_FOR_SWITCH_BROWSER(\"EnableAuthTabForSwitchBrowser\",\nfalse)`\n\n### `AttributeName.java`\nFour n\n[…]\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: p3dr0rv <76129899+p3dr0rv@users.noreply.github.com>\nCo-authored-by: p3dr0rv <pedroro@microsoft.com>",
"is_bot": false,
"headline": "Add Auth Tab Switch Browser feature flag and telemetry constants to c…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-04-10T23:44:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4f869773aa60a3e46526fc3d0f0b2b12be17dbe6",
"body": "…r filtered retrieval, Fixes AB#3570409 (#3074)\n\nFixes\n[AB#3570409](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3570409)\n`removeAccount()`/`removeCredential()` were triggering decrypt-all via\n`keySet()` → `getAll()` just to check key existence. Adds\n[…]\n23556219+Copilot@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: siddhijain <30181294+siddhijain@users.noreply.github.com>",
"is_bot": false,
"headline": "Optimize token cache remove path and add filter-first-clone flight fo…",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-04-10T19:26:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4539cfa15d4ba164db6dc7a10fcf44f3d667b1c1",
"body": "…th, Fixes AB#3450073 (#3073)\n\n## Summary\nIntroduce `DeviceRegistrationClientApplication` as a public API for\nOneAuth consumers to perform device registration operations via IPC. Add\n`DeviceState` and `DiscoveryEndpoint` enums in common4j.\n\n## Changes\n\n### common4j\n- `DeviceState` enum — `DEVICE_VAL\n[…]\nes\n[AB#3450073](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3450073)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Phase 2 - Add DeviceRegistrationClientApplication in Common For OneAu…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-04-10T00:41:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "20bb1be8c9497d6451af560e205ea9891cb055ef",
"body": "…iminate zombie worker threads AB#3542516, Fixes AB#3542516 (#3055)\n\n**Related Work item**:\n[AB#3542516](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3542516)\n\n**Problem**:\nWhen ATS command-level timeout (30s) fires in\nCommandDispatcher.submitAcquire\n[…]\n5 tests pass\non JVM (no device required).\n- Manual testing: Verified fix locally — worker thread cancelled\nimmediately on timeout.\n\n---------\n\nCo-authored-by: prsaminathan <prsaminathan@microsoft.com>",
"is_bot": false,
"headline": "Add flight-gated HTTP cancellation on ATS command-level timeout to el…",
"author_name": "Praveen Kumar",
"author_login": "Prvnkmr337",
"committed_at": "2026-04-09T15:42:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "43ffd79564223ad9a495636d7bdd4aa74b4cae25",
"body": "…#3512895 (#3066)\n\nMove device registration protocol types, domain types, controller,\npacker, and IPC strategies provider from broker to common to enable\nOneAuth device registration support.\n\n Changes\n\n common4j\n\n- Protocol types: V0 params, responses, interfaces, serializer,\nconstants\n- Domain ty\n[…]\nes\n[AB#3512895](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3512895)\n\n---------\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": " Move device registration protocol infrastructure to common, Fixes AB…",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-04-08T00:34:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a5934cffc2a5192fda9bb7e61131878527281de4",
"body": "…B#3561424 (#3065)\n\nAdopt Android SDK 36 tooling. `SwitchBrowserActivity.kt` already carries\nthe required `onNewIntent(intent: Intent?)` nullable signature.\n\n## Version changes (`gradle/versions.gradle`)\n\n- `compileSdkVersion`: `35` → `36`\n- `buildToolsVersion`: `35.0.0` → `36.0.0`\n- `minSdkVersion`\n[…]\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: p3dr0rv <76129899+p3dr0rv@users.noreply.github.com>\nCo-authored-by: p3dr0rv <pedroro@microsoft.com>",
"is_bot": false,
"headline": "Upgrade compileSdkVersion to 36, buildToolsVersion to 36.0.0, Fixes A…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-04-07T23:29:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3b53d1ad83277082beca0b8f64c264acd361eae5",
"body": "ESTS will begin sending telemetry data in a response, which we will be\nemitting in broker telemetry. Here's the spec:\nhttps://microsoft.sharepoint-df.com/:w:/s/AuthSTSDocs/IQDIrGUMsdxVSZE3GlsMkqaBAXVzDyEJg2wCZk1JN_DeSF0?e=teY6EN&wdExp=TEAMS-TREATMENT&web=1&isSPOFile=1&ovuser=72f988bf-86f1-41af-91ab-\n[…]\n5c0-91b5-ef6ba7a6bf26/_workitems/edit/3556246)</a>\n\n---------\n\nCo-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Wire Server Telemetry response header, Fixes AB#3556246 (#3062)",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-04-07T18:07:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cd914e4d07fe3ef12df84fed380ed1a6e9817019",
"body": "The Singapore sovereign cloud was incorrectly named \"SovSG\" — the\ncorrect branding is \"GovSG\". This is a pure identifier rename; the\nhostname `login.sovcloud-identity.sg` is unchanged.\n\n### Production code\n- **`AzureActiveDirectoryCloud.java`**: `SOVSG_CLOUD_HOST` →\n`GOVSG_CLOUD_HOST`, `SOVSG` → `GO\n[…]\nuctions.md strictly.\n> \n\n\n</details>\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: mohitc1 <22034758+mohitc1@users.noreply.github.com>",
"is_bot": false,
"headline": "Rename SovSG → GovSG in Common module, Fixes AB#3565148 (#3068)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-04-03T17:29:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "06771b83f2e50c54517611da4ba6e27da221a556",
"body": "Merge Release branch back onto Dev for Common Library (v24.1.0)\n\nWorkItem id:\n[AB#3557594](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3557594)\n\n---------\n\nCo-authored-by: Azure DevOps Pipeline <build-agent@azuredevops.com>\nCo-authored-by: Siddhi <siddhijain@microsoft.com>\nCo-authored-by: Cesar Acosta <cesaracosta@microsoft.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Release integration/24.1.0, Fixes AB#3557594 (#3060)",
"author_name": "Cesar Acosta",
"author_login": "cacosta33",
"committed_at": "2026-03-27T20:37:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b9d3c56d8f886ac0362b1c57e468b8000daf6120",
"body": "This pull request refactors the `BrokerHost` class and related fragments\nto consolidate device registration operations into the\n`MultipleWpjApiFragment`, removing the legacy `SingleWpjApiFragment` as\nthis API is deprecated.\n\n\n[AB#3528431](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-\n[…]\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1612146&view=results\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Remove Single WPJ API usage from UI testing, Fixes AB#3528431 (#3021)",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-03-26T23:34:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d5d744da1e40ed8451a051b81f607d8a719b5faf",
"body": "…d (#3051)\n\nFixes\n[AB#3553684](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3553684)\nWhen getApplicationInfo throws NameNotFoundException for an uninstalled\npackage, the catch block logged the error but did not return. Execution\nfell through to code \n[…]\nrence applicationInfo.enabled,\ncausing a NullPointerException.\n\nReturn false immediately in the NameNotFoundException catch block so the\nmethod exits cleanly when the queried package is not installed.",
"is_bot": false,
"headline": "Fixes AB#3553684 Fix NPE in PackageHelper.isPackageInstalledAndEnable…",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-03-24T15:18:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0f94255e0ddd6664e9a5c8bf4daba70efcc17544",
"body": "…sm, Fixes AB#3544108 (#3036)\n\nImprove device deletion logic with enhanced logging and retry mechanism\nfor Instrumented test\nThe tests do not fail to often, checking the analytics we can see if\nfail once every month but still this may help to improve it.\n\n\nhttps://identitydivision.visualstudio.com/E\n[…]\n544108)\n\n\nvalidation:\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1608470&view=results\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Improve device deletion logic with enhanced logging and retry mechani…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-03-23T16:46:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "694e05ece545fe97242f0e724aafe3fd1d28bcaf",
"body": "Reverts AzureAD/microsoft-authentication-library-common-for-android#3046",
"is_bot": false,
"headline": "Revert \"Remove NativeAuthTeam ownership from CODEOWNERS\" (#3047)",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-03-21T02:37:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "69f5e5abf62c4a08a0a919bef8b8022ab111bc6e",
"body": "Fixes\n[AB#3536002](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3536002)\n\nAdds support for new sovereign clouds — Bleu (France), Delos (Germany),\nand SovSG (Singapore) — which are not yet returned by the global\ninstance discovery endpoint.\n\n**Changes\n[…]\nign authority recognition via\npre-seeded metadata\n- `AzureActiveDirectoryAuthorityCloudTest.kt` — `isSameCloudAsAuthority`\nfor sovereign clouds\n\n---------\n\nCo-authored-by: Mohit <mchand@microsoft.com>",
"is_bot": false,
"headline": "[Common] Bleu cloud support, Fixes AB#3536002 (#3027)",
"author_name": "Mohit",
"author_login": "mohitc1",
"committed_at": "2026-03-21T02:23:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6b3cd316fd2c7e5d8910664ccf23a26590a0eca9",
"body": "Removed area ownership for NativeAuthTeam in CODEOWNERS.",
"is_bot": false,
"headline": "Remove NativeAuthTeam ownership from CODEOWNERS (#3046)",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-03-21T02:16:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc4ae51fde6bffe0bcf211d517ddbaa664495dd6",
"body": "Fixes\n[AB#3549188](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3549188)\nadd helper method for BrokerDiscovery debugging",
"is_bot": false,
"headline": "Fixes AB#3549188 add helper method for BrokerDiscovery debugging (#3044)",
"author_name": "Siddhi",
"author_login": "siddhijain",
"committed_at": "2026-03-21T00:15:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d0db778f8f0155baf054b6745fabab27b70ddb7f",
"body": "…ght ENABLE_WEBVIEW_MULTIPLE_WINDOWS, Fixes AB#3541043 (#3042)\n\nWe are enabling the flight for opening TLR URLs in browser by default in\nthis PR, the actual code change to support this was added in\nhttps://github.com/AzureAD/microsoft-authentication-library-common-for-android/pull/3010\n\nFixes\n[AB#3541043](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3541043)",
"is_bot": false,
"headline": "Enabled opening of TLR URLs in browser by default by enabling the fli…",
"author_name": "Sowmya Malayanur",
"author_login": "somalaya",
"committed_at": "2026-03-20T23:07:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d875e0ab97a0e5d3264840a7fe21c6327edc4584",
"body": "…, Fixes AB#3544154 (#3020)\n\n[AB#3544154](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3544154)\n\nRun:\nhttps://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1608520&view=ms.vss-test-web.build-test-results-tab&runId=5744831&resul\n[…]\nom/user-attachments/assets/e02e2093-a39e-43a6-b95f-dfca789d7f5c\"\n/>\n<img width=\"1384\" height=\"1452\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/0e78744e-a8d7-4845-84eb-c962e9dfea83\"\n/>",
"is_bot": false,
"headline": "Fix the automation logic due to UI update in token protection CA flow…",
"author_name": "Dome Pongmongkol",
"author_login": "rpdome",
"committed_at": "2026-03-20T21:42:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "57013b7c106469a1fae7eae252512e3a8942bc1a",
"body": "… pipeline, Fixes AB#3549891 (#3038)\n\n## Summary\nReplace `MSSecurity-1ES-Build-Agents-Pool` with Microsoft-hosted\n`vmImage: 'windows-2022'` in the `common-cd.yml` pipeline.\n\n## Changes\n- **File:** `azure-pipelines/continuous-delivery/common-cd.yml`\n- **Before:** `pool: { name: MSSecurity-1ES-Build-A\n[…]\ns\n\n[AB#3549891](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3549891)\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Replace MSSecurity-1ES pool with Microsoft-hosted agents in common-cd…",
"author_name": "pedro romero vargas",
"author_login": "p3dr0rv",
"committed_at": "2026-03-20T18:51:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6a4258589c702c302fe1ac2a838ffb15552252ed",
"body": "…edirect, Fixes AB#3541420 (#3037)\n\nPreviously in this PR\nhttps://github.com/AzureAD/microsoft-authentication-library-common-for-android/pull/3013,\nwe added support for handling open-id vc urls in webview.\nThis PR adds a flight to disable the feature in brokered flows in case\nsomething goes wrong.\nT\n[…]\nes\n[AB#3541420](https://identitydivision.visualstudio.com/fac9d424-53d2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3541420)\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Set default value for the flight for open-id vc handling in webview r…",
"author_name": "Sowmya Malayanur",
"author_login": "somalaya",
"committed_at": "2026-03-20T05:40:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6868a1cd59519c220654fc3b1b13ba59b5f6f30e",
"body": "…872 (#2679)\n\nIntroduce Tracking for a new TDBR Claim that ESTS will send as part of\nClientInfo to denote EU Home tenants, then fetch the claim to route\ntelemetry to EU when applicable. This will be used to better comply with\nEuropean Data laws\n\n\n[AB#3200872](https://identitydivision.visualstudio.co\n[…]\nd2-45c0-91b5-ef6ba7a6bf26/_workitems/edit/3200872)\n\n---------\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\nCo-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Use tdbr claim to route telemetry traffic to EU region, Fixes AB#3200…",
"author_name": "fadidurah",
"author_login": "fadidurah",
"committed_at": "2026-03-20T03:10:51Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 100,
"commits_last_year": 255,
"latest_release_at": "2026-07-15T03:07:31Z",
"latest_release_tag": "v24.5.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 50,
"days_since_latest_release": 13,
"mean_days_between_releases": 20.9
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 50,
"stars": 55,
"watchers": 46,
"fork_history": {
"days": [
{
"date": "2018-07-26",
"count": 1
},
{
"date": "2018-10-07",
"count": 1
},
{
"date": "2018-10-11",
"count": 1
},
{
"date": "2019-01-13",
"count": 1
},
{
"date": "2019-01-30",
"count": 1
},
{
"date": "2019-02-26",
"count": 1
},
{
"date": "2019-06-03",
"count": 1
},
{
"date": "2019-09-19",
"count": 1
},
{
"date": "2019-10-01",
"count": 1
},
{
"date": "2019-10-11",
"count": 1
},
{
"date": "2020-02-04",
"count": 1
},
{
"date": "2020-03-17",
"count": 1
},
{
"date": "2020-05-21",
"count": 1
},
{
"date": "2020-06-01",
"count": 1
},
{
"date": "2020-07-13",
"count": 1
},
{
"date": "2020-09-08",
"count": 1
},
{
"date": "2020-09-17",
"count": 1
},
{
"date": "2021-03-16",
"count": 1
},
{
"date": "2021-05-13",
"count": 1
},
{
"date": "2022-01-14",
"count": 1
},
{
"date": "2022-03-26",
"count": 1
},
{
"date": "2022-06-22",
"count": 1
},
{
"date": "2022-07-21",
"count": 1
},
{
"date": "2022-10-21",
"count": 1
},
{
"date": "2022-11-17",
"count": 1
},
{
"date": "2022-11-18",
"count": 1
},
{
"date": "2022-11-19",
"count": 1
},
{
"date": "2022-12-20",
"count": 1
},
{
"date": "2023-01-18",
"count": 1
},
{
"date": "2023-04-04",
"count": 1
},
{
"date": "2023-06-20",
"count": 1
},
{
"date": "2024-09-24",
"count": 1
},
{
"date": "2024-10-03",
"count": 1
},
{
"date": "2024-11-21",
"count": 1
},
{
"date": "2025-05-26",
"count": 1
},
{
"date": "2025-06-05",
"count": 1
},
{
"date": "2025-07-16",
"count": 1
},
{
"date": "2025-07-17",
"count": 1
},
{
"date": "2025-08-14",
"count": 1
},
{
"date": "2025-08-18",
"count": 1
},
{
"date": "2025-09-10",
"count": 1
},
{
"date": "2025-09-11",
"count": 1
},
{
"date": "2025-10-17",
"count": 1
},
{
"date": "2025-12-18",
"count": 2
},
{
"date": "2026-01-27",
"count": 1
},
{
"date": "2026-02-08",
"count": 1
},
{
"date": "2026-04-12",
"count": 1
},
{
"date": "2026-05-02",
"count": 1
},
{
"date": "2026-07-15",
"count": 1
}
],
"complete": true,
"collected": 50,
"total_forks": 50
},
"star_history": null,
"open_issues_and_prs": 101
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"LabApiUtilities/build.gradle",
"build.gradle",
"common-java-root/build.gradle",
"common/build.gradle",
"common4j/build.gradle",
"keyvault/build.gradle",
"labapi/build.gradle",
"testutils/build.gradle",
"uiautomationutilities/build.gradle",
"uiautomationutilities/perf_tool/PerfIdentity.csproj"
],
"largest_source_bytes": 166283,
"source_files_sampled": 1657,
"oversized_source_files": 21,
"agent_instruction_files": [
".github/copilot-instructions.md"
],
"agent_instruction_max_bytes": 40392
},
"dependencies": {
"manifests": [
"LabApiUtilities/build.gradle",
"build.gradle",
"common-java-root/build.gradle",
"common/build.gradle",
"common4j/build.gradle",
"keyvault/build.gradle",
"labapi/build.gradle",
"testutils/build.gradle",
"uiautomationutilities/build.gradle"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 1,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"maven"
],
"dependencies": [
{
"name": "ilmerge",
"manifest": "uiautomationutilities/perf_tool/PerfIdentity.csproj",
"ecosystem": "nuget",
"version_constraint": "3.0.29"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "ILMerge",
"direct": true,
"version": "3.0.29",
"ecosystem": "nuget"
}
],
"collected": true,
"truncated": false,
"total_count": 1,
"direct_count": 1,
"indirect_count": 0
}
},
"maintainership": {
"issues": {
"open_prs": 69,
"merged_prs": 2411,
"open_issues": 32,
"closed_ratio": 0.872,
"closed_issues": 218,
"closed_unmerged_prs": 459
},
"bus_factor": 5,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "shahzaibj",
"commits": 1221,
"avatar_url": "https://avatars.githubusercontent.com/u/37125644?v=4"
},
{
"type": "User",
"login": "rpdome",
"commits": 846,
"avatar_url": "https://avatars.githubusercontent.com/u/19558668?v=4"
},
{
"type": "User",
"login": "AdamBJohnsonx",
"commits": 712,
"avatar_url": "https://avatars.githubusercontent.com/u/63813613?v=4"
},
{
"type": "User",
"login": "shoatman",
"commits": 481,
"avatar_url": "https://avatars.githubusercontent.com/u/8864677?v=4"
},
{
"type": "User",
"login": "p3dr0rv",
"commits": 467,
"avatar_url": "https://avatars.githubusercontent.com/u/76129899?v=4"
},
{
"type": "User",
"login": "melissaahn",
"commits": 361,
"avatar_url": "https://avatars.githubusercontent.com/u/97474059?v=4"
},
{
"type": "User",
"login": "fadidurah",
"commits": 318,
"avatar_url": "https://avatars.githubusercontent.com/u/88730756?v=4"
},
{
"type": "User",
"login": "iamgusain",
"commits": 306,
"avatar_url": "https://avatars.githubusercontent.com/u/75644120?v=4"
},
{
"type": "User",
"login": "heidijinxujia",
"commits": 230,
"avatar_url": "https://avatars.githubusercontent.com/u/16140683?v=4"
},
{
"type": "User",
"login": "paulkagiri",
"commits": 210,
"avatar_url": "https://avatars.githubusercontent.com/u/4158695?v=4"
}
],
"contributors_sampled": 63,
"top_contributor_share": 0.18
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"gradle-versions-watcher.yml",
"pull-request.yml",
"release-fix.yml",
"release-integration.yml",
"validate-pr-ab-id.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 8,
"reason": "binaries present in source code",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 2,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 7 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a73fd923294d6c1f021746d7537bce0f09cd3d57",
"ran_at": "2026-07-28T08:26:53Z",
"aggregate_score": 5.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-28T00:28:55Z",
"oldest_open_prs": [
{
"number": 518,
"created_at": "2019-06-07T10:01:09Z",
"last_comment_at": "2019-09-18T00:54:14Z",
"last_comment_author": "iambmelt"
},
{
"number": 1124,
"created_at": "2020-11-12T16:57:53Z",
"last_comment_at": "2020-12-12T20:12:37Z",
"last_comment_author": "shahzaibj"
},
{
"number": 1152,
"created_at": "2020-12-08T04:25:57Z",
"last_comment_at": "2020-12-12T20:10:14Z",
"last_comment_author": "shahzaibj"
},
{
"number": 1202,
"created_at": "2021-01-22T14:42:10Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1295,
"created_at": "2021-03-29T21:25:18Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1317,
"created_at": "2021-04-19T23:54:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1326,
"created_at": "2021-04-22T23:20:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1399,
"created_at": "2021-06-03T00:02:21Z",
"last_comment_at": "2021-06-03T18:10:59Z",
"last_comment_author": "shoatman"
},
{
"number": 1414,
"created_at": "2021-06-10T00:28:54Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1443,
"created_at": "2021-06-28T19:05:37Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1555,
"created_at": "2021-09-02T23:32:21Z",
"last_comment_at": "2021-09-03T00:42:49Z",
"last_comment_author": "shahzaibj"
},
{
"number": 1570,
"created_at": "2021-09-24T20:05:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1604,
"created_at": "2021-10-14T18:38:40Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1610,
"created_at": "2021-10-20T20:19:27Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1613,
"created_at": "2021-10-21T23:06:40Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1614,
"created_at": "2021-10-22T20:57:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1615,
"created_at": "2021-10-25T23:28:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1638,
"created_at": "2021-11-19T23:23:27Z",
"last_comment_at": "2021-12-07T00:01:58Z",
"last_comment_author": "tanmaymanolkar1"
},
{
"number": 1650,
"created_at": "2021-12-08T22:53:35Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1651,
"created_at": "2021-12-09T12:23:39Z",
"last_comment_at": "2022-05-12T17:39:07Z",
"last_comment_author": "gitaumoses4"
}
],
"last_merged_pr_at": "2026-07-28T00:28:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 29,
"created_at": "2017-11-22T18:47:48Z",
"last_comment_at": "2019-12-19T18:38:03Z",
"last_comment_author": "iambmelt"
},
{
"number": 31,
"created_at": "2017-11-27T00:45:25Z",
"last_comment_at": "2019-12-19T18:38:36Z",
"last_comment_author": "iambmelt"
},
{
"number": 138,
"created_at": "2018-06-15T15:45:33Z",
"last_comment_at": "2019-12-19T18:38:53Z",
"last_comment_author": "iambmelt"
},
{
"number": 312,
"created_at": "2018-11-28T01:07:40Z",
"last_comment_at": "2021-08-06T16:35:29Z",
"last_comment_author": "iambmelt"
},
{
"number": 353,
"created_at": "2019-01-30T16:06:59Z",
"last_comment_at": "2019-12-19T19:50:36Z",
"last_comment_author": "MichalDanielDobrzanski"
},
{
"number": 375,
"created_at": "2019-02-14T00:43:52Z",
"last_comment_at": "2021-08-06T16:37:03Z",
"last_comment_author": "iambmelt"
},
{
"number": 436,
"created_at": "2019-03-26T20:39:24Z",
"last_comment_at": "2021-08-06T16:33:40Z",
"last_comment_author": "iambmelt"
},
{
"number": 514,
"created_at": "2019-06-04T18:24:18Z",
"last_comment_at": "2021-08-06T16:33:17Z",
"last_comment_author": "iambmelt"
},
{
"number": 590,
"created_at": "2019-08-13T00:51:21Z",
"last_comment_at": "2019-12-19T18:27:25Z",
"last_comment_author": "iambmelt"
},
{
"number": 627,
"created_at": "2019-09-04T00:05:52Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 848,
"created_at": "2020-03-15T23:41:38Z",
"last_comment_at": "2021-03-03T00:05:13Z",
"last_comment_author": "iambmelt"
},
{
"number": 851,
"created_at": "2020-03-16T01:46:58Z",
"last_comment_at": "2021-03-03T00:04:10Z",
"last_comment_author": "iambmelt"
},
{
"number": 852,
"created_at": "2020-03-16T01:48:38Z",
"last_comment_at": "2021-03-03T00:03:33Z",
"last_comment_author": "iambmelt"
},
{
"number": 866,
"created_at": "2020-03-20T16:31:07Z",
"last_comment_at": "2021-03-03T00:02:59Z",
"last_comment_author": "iambmelt"
},
{
"number": 1558,
"created_at": "2021-09-06T11:39:06Z",
"last_comment_at": "2021-09-13T06:51:43Z",
"last_comment_author": "karthik-mut"
},
{
"number": 1565,
"created_at": "2021-09-11T08:02:07Z",
"last_comment_at": "2021-10-15T06:56:36Z",
"last_comment_author": "Valair"
},
{
"number": 1617,
"created_at": "2021-11-02T22:40:52Z",
"last_comment_at": "2021-11-02T22:46:44Z",
"last_comment_author": "AdamBJohnsonx"
},
{
"number": 1669,
"created_at": "2022-01-16T07:39:54Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1674,
"created_at": "2022-01-31T19:10:30Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1678,
"created_at": "2022-02-11T10:20:30Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/AzureAD/microsoft-authentication-library-common-for-android",
"host": "github.com",
"name": "microsoft-authentication-library-common-for-android",
"owner": "AzureAD"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"security": 61,
"vitality": 99,
"community": 51,
"governance": 84,
"engineering": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 99,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"commits_last_year": 255,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 50
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "50/52 weeks with commits",
"points": 34.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 50
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "255 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 255
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 100,
"latest_release_tag": "v24.5.0",
"releases_from_tags": false,
"days_since_latest_release": 13,
"mean_days_between_releases": 20.9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "100 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 100
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 13 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 13
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~20.9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 20.9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 51,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"forks": 50,
"stars": 55,
"watchers": 46,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "55 stars",
"points": 28.1,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 55
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "50 forks",
"points": 14.1,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 50
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "46 watchers",
"points": 9.2,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 46
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 84,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "excellent",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"bus_factor": 5,
"contributors_sampled": 63,
"top_contributor_share": 0.18
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "5 contributor(s) cover half of all commits",
"points": 45.9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 5
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 18% of commits",
"points": 18.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 18
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "63 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 63
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"merged_prs": 2411,
"open_issues": 32,
"closed_issues": 218,
"issue_closed_ratio": 0.872,
"closed_unmerged_prs": 459
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "87% of issues closed",
"points": 40.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 87
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "2411/2870 decided PRs merged",
"points": 32.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 2411,
"decided": 2870
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"followers": 797,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "AzureAD",
"public_repos": 57,
"account_age_days": 4983
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "797 followers of AzureAD",
"points": 20.9,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 797,
"login": "AzureAD"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "57 public repos, account ~13 yr old",
"points": 24.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 57
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 71,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "6 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 6
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 61,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 5.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "binaries present in source code",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 1 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 1
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 1,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 1,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 4
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 74,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.98,
"agent_instruction_files": [
".github/copilot-instructions.md"
],
"agent_instruction_max_bytes": 40392
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": ".github/copilot-instructions.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".github/copilot-instructions.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "98 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 98,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.57,
"toolchain_manifests": [
"LabApiUtilities/build.gradle",
"build.gradle",
"common-java-root/build.gradle",
"common/build.gradle",
"common4j/build.gradle",
"keyvault/build.gradle",
"labapi/build.gradle",
"testutils/build.gradle",
"uiautomationutilities/build.gradle",
"uiautomationutilities/perf_tool/PerfIdentity.csproj"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "LabApiUtilities/build.gradle, build.gradle, common-java-root/build.gradle (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "LabApiUtilities/build.gradle, build.gradle, common-java-root/build.gradle"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Java (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "57 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 57,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "Java",
"largest_source_bytes": 166283,
"source_files_sampled": 1657,
"oversized_source_files": 21
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Java (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Java"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "21/1657 source files over 60KB",
"points": 54.3,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 1657,
"oversized": 21
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-28T08:27:42.004240Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/AzureAD/microsoft-authentication-library-common-for-android.svg",
"full_name": "AzureAD/microsoft-authentication-library-common-for-android",
"license_state": "standard",
"license_spdx": "MIT"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con AzureAD/microsoft-authentication-library-common-for-android. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
