From a4492d49385748974332becc65ebf7e9e8e83f44 Mon Sep 17 00:00:00 2001
From: Zhengchen Tao <zhengchen.tao@outlook.com>
Date: Sun, 17 May 2026 13:47:26 +0800
Subject: [PATCH] fix(deps): drop explicit pin on
 Microsoft.IdentityModel.Tokens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JwtBearer 10.0.7 transitively brings in Microsoft.IdentityModel.JsonWebTokens
9.x, which calls Base64UrlEncoder.Decode(ReadOnlySpan<char>, Span<byte>) —
an overload only present in Microsoft.IdentityModel.Tokens 9.x. The
explicit pin to 8.9.0 forced NuGet to downgrade Tokens to 8.9, producing
a runtime MissingMethodException on every JWT validation. Symptom: every
incoming request gets 401, never visible at default log level.

Drop the explicit pin so JwtBearer's transitive dep wins. The code only
uses SymmetricSecurityKey etc., which are stable across versions.
---
 obsidian-mcp.csproj | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/obsidian-mcp.csproj b/obsidian-mcp.csproj
index 2c3c2cf..ce824f8 100644
--- a/obsidian-mcp.csproj
+++ b/obsidian-mcp.csproj
@@ -12,9 +12,14 @@
     <!-- MCP SDK（Streamable HTTP transport） -->
     <PackageReference Include="ModelContextProtocol" Version="1.0.0" />
     <PackageReference Include="ModelContextProtocol.AspNetCore" Version="1.0.0" />
-    <!-- JWT 验签 -->
+    <!-- JWT 验签。不显式 pin Microsoft.IdentityModel.Tokens：
+         JwtBearer 10.0.7 传递依赖 Microsoft.IdentityModel.JsonWebTokens 9.x，
+         JsonWebTokens 9.x 调 Base64UrlEncoder.Decode(ReadOnlySpan, Span)，
+         该 overload 在 Microsoft.IdentityModel.Tokens 9.x 才加入，显式 pin 8.9.0
+         会强制 NuGet downgrade Tokens 到 8.9 → runtime MissingMethodException。
+         让 JwtBearer 拉自己的传递依赖即可，代码用的 SymmetricSecurityKey 等
+         基础类型在任意版本都可用。 -->
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.9.0" />
     <!-- glob 匹配 -->
     <PackageReference Include="Microsoft.Extensions.FileSystemGlobbing" Version="10.0.7" />
   </ItemGroup>