[deps] Auth: Update Duende.IdentityServer to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Duende.IdentityServer (source)	[7.4.6] → [8.0.2]

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2nd week starting on the 2 week of the year before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bitwarden-bot]

Internal tracking:

• ID: PM-40601
• Link: https://bitwarden.atlassian.net/browse/PM-40601

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 14.88%. Comparing base (63e1c66) to head (d3ed1a2).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8025       +/-   ##
===========================================
- Coverage   62.42%   14.88%   -47.55%     
===========================================
  Files        2289     1386      -903     
  Lines       99712    60194    -39518     
  Branches     9004     4784     -4220     
===========================================
- Hits        62250     8957    -53293     
- Misses      35290    51086    +15796     
+ Partials     2172      151     -2021     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

This Renovate PR performs a major version bump of Duende.IdentityServer (7.4.6 → 8.0.2), a security-critical authentication/OIDC dependency. Only src/Core/Core.csproj and 58 regenerated lock files changed — there are no accompanying C# code changes. CI is currently red: Run tests, the Identity Docker build, and the Sso Docker build all fail, which indicates v8 introduces breaking API changes that reach the two services most coupled to IdentityServer.

Code Review Details

• ⚠️ : Major Duende.IdentityServer v7→v8 bump breaks Identity/Sso builds and tests (CI red); v8 breaking changes must be migrated in code before merge
  • src/Core/Core.csproj:60

Dependency Changes

Package	Change	Ecosystem
Duende.IdentityServer	7.4.6 → 8.0.2 (major)	NuGet

Lock file hygiene is clean: the manifest and all 58 lock files are consistently updated to 8.0.2 with no leftover 7.4.6 references. The new transitive Duende.Private.Licensing (v8 licensing enforcement) is already accounted for via options.LicenseKey in src/Identity/Utilities/ServiceCollectionExtensions.cs.

[claude]

⚠️ IMPORTANT: Major bump (Duende.IdentityServer v7 → v8) is breaking the auth services — CI is red.

Details

This is a SemVer major upgrade of a security-critical auth/OIDC dependency, and CI reflects breaking changes reaching compiled code:

• Run tests — fail
• Build Docker images (Identity, ...) — fail
• Build Docker images (Sso, ...) — fail

Identity and Sso are the two services most tightly coupled to IdentityServer (~95 dependent files), so these failures point to v8 API breaking changes that must be migrated in code before this can merge, not just a version string bump.

The PR description (Renovate template) contains no breaking-change or migration notes. Duende publishes a v7→v8 migration guide — the breaking changes should be evaluated and the necessary code updates made in this PR so the Identity/Sso builds and test suite pass.

Note: the v8 licensing enforcement is already accounted for via options.LicenseKey in src/Identity/Utilities/ServiceCollectionExtensions.cs, so that specific new requirement is not the blocker.

Reference: https://bitwarden.atlassian.net/wiki/spaces/APPSEC/pages/2774466657/Dependency+Review+and+Approval