Altinn · martinothamar · Jun 26, 2025 · Jun 26, 2025 · Jun 26, 2025 · Jun 26, 2025
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -10,7 +10,7 @@
       "rollForward": false
     },
     "csharpier": {
-      "version": "1.0.1",
+      "version": "1.0.2",
       "commands": [
         "csharpier"
       ],

diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -9,57 +9,59 @@
     <PackageVersion Include="Altinn.Common.EFormidlingClient" Version="1.3.3" />
     <PackageVersion Include="Altinn.Common.PEP" Version="4.1.2" />
     <PackageVersion Include="Altinn.Platform.Models" Version="1.6.1" />
-    <PackageVersion Include="Altinn.Platform.Storage.Interface" Version="4.0.10" />
+    <PackageVersion Include="Altinn.Platform.Storage.Interface" Version="4.0.11" />
     <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.4.0" />
-    <PackageVersion Include="Azure.Identity" Version="1.13.2" />
-    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.3.0" />
-    <PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
-    <PackageVersion Include="BenchmarkDotNet.Diagnostics.dotTrace" Version="0.14.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.14.0" />
+    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.4.0" />
+    <PackageVersion Include="BenchmarkDotNet" Version="0.15.2" />
+    <PackageVersion Include="BenchmarkDotNet.Diagnostics.dotTrace" Version="0.15.2" />
     <PackageVersion Include="Buildalyzer.Workspaces" Version="7.1.0" />
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
-    <PackageVersion Include="CSharpier.MsBuild" Version="1.0.1"/>
-    <PackageVersion Include="FluentAssertions" Version="7.1.0" />
+    <PackageVersion Include="CSharpier.MsBuild" Version="1.0.2"/>
+    <PackageVersion Include="FluentAssertions" Version="7.2.0" />
     <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
     <PackageVersion Include="JWTCookieAuthentication" Version="3.0.1" />
     <PackageVersion Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.23.0" />
     <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="17.10.29"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.12" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.3.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.17" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.17" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.14.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic.Workspaces" Version="4.14.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="9.6.0" />
     <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="8.10.0" />
     <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="8.10.0" />
-    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.0.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.13.0" />
-    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.23" />
-    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.23" />
+    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.1.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="Microsoft.OpenApi" Version="1.6.24" />
+    <PackageVersion Include="Microsoft.OpenApi.Readers" Version="1.6.24" />
     <PackageVersion Include="MinVer" Version="6.0.0" />
     <PackageVersion Include="Moq" Version="4.20.72" />
-    <PackageVersion Include="NetEscapades.EnumGenerators" Version="1.0.0-beta11" />
+    <PackageVersion Include="NetEscapades.EnumGenerators" Version="1.0.0-beta14" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageVersion Include="Nullable.Extended.Analyzer" Version="1.15.6495" />
-    <PackageVersion Include="OpenTelemetry" Version="1.11.2" />
-    <PackageVersion Include="OpenTelemetry.Api" Version="1.11.2" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.11.2" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.11.2" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.11.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.11.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.11.1" />
+    <PackageVersion Include="Nullable.Extended.Analyzer" Version="1.15.6581" />
+    <PackageVersion Include="OpenTelemetry" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.12.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.12.0" />
     <PackageVersion Include="PolySharp" Version="1.15.0" />
-    <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.0.0" />
-    <PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
-    <PackageVersion Include="System.Linq.Async" Version="6.0.1" />
-    <PackageVersion Include="Verify.Xunit" Version="29.3.0" />
-    <PackageVersion Include="Verify.Http" Version="6.4.1" />
-    <PackageVersion Include="WireMock.Net" Version="1.7.4" />
+    <PackageVersion Include="Swashbuckle.AspNetCore" Version="8.1.4" />
+    <PackageVersion Include="System.Formats.Asn1" Version="9.0.6" />
+    <PackageVersion Include="System.Linq.Async" Version="6.0.3" />
+    <PackageVersion Include="Verify.Xunit" Version="29.5.0" />
+    <PackageVersion Include="Verify.Http" Version="6.6.0" />
+    <PackageVersion Include="WireMock.Net" Version="1.8.13" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.assert" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.1" />
   </ItemGroup>
 
   <ItemGroup>
     <!-- Transitive dependecies for JWTCookieAuthentication -->
-    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.7.0" />
+    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.12.1" />
     <PackageVersion Include="Microsoft.Rest.ClientRuntime" Version="2.3.24" />
     <PackageVersion Include="Microsoft.Rest.ClientRuntime.Azure" Version="3.3.19" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />

diff --git a/benchmark/Altinn.App.Benchmarks/Altinn.App.Benchmarks.csproj b/benchmark/Altinn.App.Benchmarks/Altinn.App.Benchmarks.csproj
@@ -25,9 +25,6 @@
         <PackageReference Include="BenchmarkDotNet"/>
         <PackageReference Include="BenchmarkDotNet.Diagnostics.dotTrace"/>
         <PackageReference Include="Buildalyzer.Workspaces"/>
-        <PackageReference Include="System.Formats.Asn1"/>
-            <!-- Add explicit reference to patched version to override vulnerable dependency -->
-        <PackageReference Include="Microsoft.Build.Tasks.Core"/>
     </ItemGroup>
     <ItemGroup>
         <ProjectReference Include="../../src/Altinn.App.Analyzers/Altinn.App.Analyzers.csproj" />

diff --git a/global.json b/global.json
@@ -1,6 +1,6 @@
 {
     "sdk": {
-        "version": "8.0.407",
+        "version": "8.0.411",
         "rollForward": "latestFeature",
         "allowPrerelease": false
     }

diff --git a/renovate.json b/renovate.json
@@ -9,6 +9,10 @@
     {
       "matchPackageNames": ["/dotnet(-|\\/)sdk/", "/^Microsoft\\.AspNetCore/", "/^Microsoft\\.Extensions/", "!Microsoft.Extensions.Caching.Hybrid"],
       "allowedVersions": "<=8"
+    },
+    {
+      "matchPackageNames": ["/^Microsoft\\.CodeAnalysis/", "/^Microsoft\\.Build/"],
+      "enabled": false
     }
   ]
 }
diff --git a/src/Altinn.App.Analyzers/Altinn.App.Analyzers.csproj b/src/Altinn.App.Analyzers/Altinn.App.Analyzers.csproj
@@ -34,7 +34,7 @@
   </ItemGroup> -->
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" PrivateAssets="all" VersionOverride="4.10.0" />
 
     <!-- <PackageReference Include="System.Text.Json" GeneratePathProperty="true"/>
     <None Include="$(PKGSystem_Text_Json)/lib/netstandard2.0/System.Text.Json.dll" CopyToOutputDirectory="PreserveNewest" /> -->

diff --git a/src/Altinn.App.Core/Features/Telemetry/Signing/Telemetry.SigningDelegationService.cs b/src/Altinn.App.Core/Features/Telemetry/Signing/Telemetry.SigningDelegationService.cs
@@ -24,7 +24,7 @@ private void InitSigningDelegation(InitContext context)
             {
                 foreach (var result in DelegationResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -36,7 +36,7 @@ private void InitSigningDelegation(InitContext context)
             {
                 foreach (var result in DelegationResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -57,10 +57,12 @@ private void InitSigningDelegation(InitContext context)
     }
 
     internal void RecordDelegation(DelegationResult result) =>
-        _counters[MetricNameDelegation].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameDelegation]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal void RecordDelegationRevoke(DelegationResult result) =>
-        _counters[MetricNameDelegationRevoke].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameDelegationRevoke]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal static class DelegationConst
     {

diff --git a/src/Altinn.App.Core/Features/Telemetry/Signing/Telemetry.SigningService.cs b/src/Altinn.App.Core/Features/Telemetry/Signing/Telemetry.SigningService.cs
@@ -25,7 +25,7 @@ private void InitSigning(InitContext context)
             {
                 foreach (var result in NotifySigneesResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -37,17 +37,19 @@ private void InitSigning(InitContext context)
             {
                 foreach (var result in ServiceOwnerPartyResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
     }
 
     internal void RecordNotifySignees(NotifySigneesResult result) =>
-        _counters[MetricNameNotifySignees].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameNotifySignees]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal void RecordGetServiceOwnerParty(ServiceOwnerPartyResult result) =>
-        _counters[MetricNameGetServiceOwnerParty].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameGetServiceOwnerParty]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal Activity? StartAssignSigneesActivity() => ActivitySource.StartActivity("SigningService.AssignSignees");
 

diff --git a/src/Altinn.App.Core/Features/Telemetry/Telemetry.Correspondence.cs b/src/Altinn.App.Core/Features/Telemetry/Telemetry.Correspondence.cs
@@ -17,7 +17,7 @@ private void InitCorrespondence(InitContext context)
             {
                 foreach (var result in CorrespondenceResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -36,7 +36,8 @@ private void InitCorrespondence(InitContext context)
     }
 
     internal void RecordCorrespondenceOrder(CorrespondenceResult result) =>
-        _counters[MetricNameOrder].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameOrder]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal static class Correspondence
     {

diff --git a/src/Altinn.App.Core/Features/Telemetry/Telemetry.Data.cs b/src/Altinn.App.Core/Features/Telemetry/Telemetry.Data.cs
@@ -16,14 +16,15 @@ private void InitData(InitContext context)
             MetricNameDataPatched,
             init: static m =>
             {
-                m.Add(0, new Tag(InternalLabels.Result, PatchResult.Success.ToStringFast()));
-                m.Add(0, new Tag(InternalLabels.Result, PatchResult.Error.ToStringFast()));
+                m.Add(0, new Tag(InternalLabels.Result, PatchResult.Success.ToStringFast(useMetadataAttributes: true)));
+                m.Add(0, new Tag(InternalLabels.Result, PatchResult.Error.ToStringFast(useMetadataAttributes: true)));
             }
         );
     }
 
     internal void DataPatched(PatchResult result) =>
-        _counters[MetricNameDataPatched].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameDataPatched]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
 
     internal Activity? StartDataPatchActivity(Instance instance)
     {

diff --git a/src/Altinn.App.Core/Features/Telemetry/Telemetry.Maskinporten.cs b/src/Altinn.App.Core/Features/Telemetry/Telemetry.Maskinporten.cs
@@ -17,7 +17,7 @@ private void InitMaskinporten(InitContext context)
             {
                 foreach (var result in RequestResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -28,7 +28,7 @@ private void InitMaskinporten(InitContext context)
             {
                 foreach (var result in RequestResultExtensions.GetValues())
                 {
-                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast()));
+                    m.Add(0, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
                 }
             }
         );
@@ -54,12 +54,14 @@ private void InitMaskinporten(InitContext context)
 
     internal void RecordMaskinportenTokenRequest(RequestResult result)
     {
-        _counters[MetricNameTokenRequest].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameTokenRequest]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
     }
 
     internal void RecordMaskinportenAltinnTokenExchangeRequest(RequestResult result)
     {
-        _counters[MetricNameTokenExchangeRequest].Add(1, new Tag(InternalLabels.Result, result.ToStringFast()));
+        _counters[MetricNameTokenExchangeRequest]
+            .Add(1, new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true)));
     }
 
     internal static class Maskinporten

diff --git a/src/Altinn.App.Core/Features/Telemetry/Telemetry.Notifications.cs b/src/Altinn.App.Core/Features/Telemetry/Telemetry.Notifications.cs
@@ -28,8 +28,8 @@ private void InitNotifications(InitContext context)
                     {
                         m.Add(
                             0,
-                            new Tag(InternalLabels.Type, type.ToStringFast()),
-                            new Tag(InternalLabels.Result, result.ToStringFast())
+                            new Tag(InternalLabels.Type, type.ToStringFast(useMetadataAttributes: true)),
+                            new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true))
                         );
                     }
                 }
@@ -40,16 +40,16 @@ private void InitNotifications(InitContext context)
     internal Activity? StartNotificationOrderActivity(OrderType type)
     {
         var activity = ActivitySource.StartActivity("Notifications.Order");
-        activity?.SetTag(InternalLabels.Type, type.ToStringFast());
+        activity?.SetTag(InternalLabels.Type, type.ToStringFast(useMetadataAttributes: true));
         return activity;
     }
 
     internal void RecordNotificationOrder(OrderType type, OrderResult result) =>
         _counters[MetricNameOrder]
             .Add(
                 1,
-                new Tag(InternalLabels.Type, type.ToStringFast()),
-                new Tag(InternalLabels.Result, result.ToStringFast())
+                new Tag(InternalLabels.Type, type.ToStringFast(useMetadataAttributes: true)),
+                new Tag(InternalLabels.Result, result.ToStringFast(useMetadataAttributes: true))
             );
 
     internal static class Notifications

diff --git a/src/Altinn.App.Internal.Analyzers/Altinn.App.Internal.Analyzers.csproj b/src/Altinn.App.Internal.Analyzers/Altinn.App.Internal.Analyzers.csproj
@@ -34,7 +34,7 @@
   </ItemGroup> -->
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" PrivateAssets="all" VersionOverride="4.10.0" />
     <PackageReference Include="PolySharp" PrivateAssets="all" IncludeAssets="runtime; build; native; contentfiles; analyzers; buildtransitive" />
   </ItemGroup>
 </Project>
diff --git a/test/Altinn.App.Analyzers.Tests/Altinn.App.Analyzers.Tests.csproj b/test/Altinn.App.Analyzers.Tests/Altinn.App.Analyzers.Tests.csproj
@@ -23,9 +23,6 @@
     <PackageReference Include="Verify.Xunit"/>
 
     <PackageReference Include="Buildalyzer.Workspaces"/>
-    <PackageReference Include="System.Formats.Asn1"/>
-        <!-- Add explicit reference to patched version to override vulnerable dependency -->
-    <PackageReference Include="Microsoft.Build.Tasks.Core"/>
   </ItemGroup>
 
   <ItemGroup>

diff --git a/...tinn.App.Api.Tests/OpenApi/OpenApiSpecChangeDetection.SaveCustomOpenApiSpec.verified.json b/...tinn.App.Api.Tests/OpenApi/OpenApiSpecChangeDetection.SaveCustomOpenApiSpec.verified.json
@@ -2571,6 +2571,20 @@
         },
         "additionalProperties": false
       },
+      "ApiScopes": {
+        "type": "object",
+        "properties": {
+          "read": {
+            "type": "string",
+            "nullable": true
+          },
+          "write": {
+            "type": "string",
+            "nullable": true
+          }
+        },
+        "additionalProperties": false
+      },
       "InstanceSelection": {
         "type": "object",
         "properties": {
@@ -2726,6 +2740,9 @@
           "copyInstanceSettings": {
             "$ref": "#/components/schemas/CopyInstanceSettings"
           },
+          "apiScopes": {
+            "$ref": "#/components/schemas/ApiScopes"
+          },
           "storageAccountNumber": {
             "type": "integer",
             "format": "int32",

diff --git a/test/Altinn.App.Api.Tests/OpenApi/OpenApiSpecChangeDetection.SaveJsonSwagger.verified.json b/test/Altinn.App.Api.Tests/OpenApi/OpenApiSpecChangeDetection.SaveJsonSwagger.verified.json
@@ -6187,6 +6187,20 @@
         },
         "additionalProperties": false
       },
+      "ApiScopes": {
+        "type": "object",
+        "properties": {
+          "read": {
+            "type": "string",
+            "nullable": true
+          },
+          "write": {
+            "type": "string",
+            "nullable": true
+          }
+        },
+        "additionalProperties": false
+      },
       "AppProcessElementInfo": {
         "type": "object",
         "properties": {
@@ -6437,6 +6451,9 @@
           "copyInstanceSettings": {
             "$ref": "#/components/schemas/CopyInstanceSettings"
           },
+          "apiScopes": {
+            "$ref": "#/components/schemas/ApiScopes"
+          },
           "storageAccountNumber": {
             "type": "integer",
             "format": "int32",