Update Nimbus, Fixes AB#3328426

[melissaahn]

Summary

AB#3328426
Updating the Nimbus Jose + JWT version to 10.0.2 due to CVE: Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON · CVE-2025-53864 · GitHub Advisory Database

I had to change two instances where an internal dependency of Nimbus was being used for modifiers (I believe said dependency is the one under the CVE); those have been changed to using javax, which is what's being used for most of the related modifiers in the codebase.

Ran the pipeline successfully on my branches: https://identitydivision.visualstudio.com/Engineering/_build/results?buildId=1514283&view=results

AuthApp: currently on 10.2.0.
CP: Notified, and they said they will update the version. CP built successfully on the pipeline.
LTW: Notified, and they moved to 10.0.2.
OneAuth: Notified; their test app built successfully on the pipeline.

[github-actions]

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

[Copilot]

Pull Request Overview

This PR updates the Nimbus JOSE + JWT library from version 9.37.3 to 10.0.2 to address a security vulnerability (CVE-2025-53864) related to DoS attacks when processing deeply nested JSON.

• Updated Nimbus library version in gradle dependencies
• Replaced deprecated net.jcip.annotations imports with javax.annotation.concurrent equivalents
• Added changelog entry documenting the update

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
gradle/versions.gradle	Updated nimbusVersion from 9.37.3 to 10.0.2
common/src/main/java/com/microsoft/identity/common/internal/ui/webview/certbasedauth/DialogHolder.java	Replaced net.jcip.annotations.ThreadSafe with javax.annotation.concurrent.ThreadSafe
common/src/main/java/com/microsoft/identity/common/internal/authorities/AzureActiveDirectoryAudienceDeserializer.java	Replaced net.jcip.annotations.Immutable with javax.annotation.concurrent.Immutable
changelog.txt	Added changelog entry for the Nimbus version update

Comments suppressed due to low confidence (1)

gradle/versions.gradle:41

• The version 10.0.2 for Nimbus JOSE + JWT appears to be non-existent. The latest available version as of my knowledge cutoff is 9.x series. Please verify that version 10.0.2 exists and is publicly available.

    nimbusVersion = "10.0.2"