Library version used

4.83.3

.NET version

4.81

Scenario

ConfidentialClient - web site (AcquireTokenByAuthCode)

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

Why is it that all of a sudden we started seeing package ValueTuple appearing in Web.Config when we do a Nuget Package updates for Identity.Client or Formats.Asn1 !?

It causes Web App runtime failure and the only solution is that we REMOVE Manually from Web.Config these lines

  <dependentAssembly>
    <assemblyIdentity name="System.ValueTuple" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
    <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0" />
  </dependentAssembly>

If we try to remove this package from the Solution, we receive an error

Unable to uninstall 'System.ValueTuple.4.6.2' because 'Microsoft.Identity.Client.4.83.3, System.Formats.Asn1.10.0.5' depend on it.

When we researched the subject on GPT / google, we found that this package is part of the FRAMEWORK and should not be mentioned in Web.Config, so why Nuget Package Microsoft.Identity.Client refer to it !!!

This is breaking our CDN pipeline as we have to do manual intervention. It is really frustrating.

Please consider !!!

Relevant code snippets

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response