## Summary

Brings `main` into `releases/v2` for the 2.0.7 Libraries release, with
quoted-replies (PR #389) excluded. Scope is **Legacy / Libraries only**
— `core/` is not in scope for this release.

Single squashed commit.

## What's in this release

- All commits merged to main since 2.0.6 (the previous Libraries
release), notably:
- **Reactions GA** (PR #509) —
`[Experimental("ExperimentalTeamsReactions")]` removed across Libraries
  - Prompt Preview Support (PR #433)
  - MCP server auth security hardening (PR #448)
  - Various dependency bumps and bug fixes

## What's NOT in this release

**Quoted-replies feature (PR #389) is excluded:**
- `MessageActivity.AddQuote()`, `PrependQuote()` builder methods —
absent
- `Context.Reply()` quote-aware behavior — reverted to legacy
`replyToId` + blockquote
- `Samples/Samples.Quoting` — removed
- QR-related tests — removed

**Kept intentionally:**
- `QuotedReplyEntity` and `QuotedReplyData` types stay in
`Microsoft.Teams.Api.Entities` (still annotated
`[Experimental("ExperimentalTeamsQuotedReplies")]`) so inbound
activities carrying `quotedReply` entities still parse
- `MessageActivity.AddTargetedMessageInfo` runtime strip-QR logic —
preserves prompt-preview cleanup
- Entity.cs serializer cases for `quotedReply` (with existing `#pragma
warning disable ExperimentalTeamsQuotedReplies`)

## Version

`version.json`: `2.0.6` → `2.0.7`

## Scope

**Libraries only.** `core/` (the `releases/core` track) is not affected
by this PR — when this prep merges to `releases/v2`, the `core/` tree
may appear in the branch as part of the merge, but the Legacy publish
pipeline only builds and ships from `Libraries/`, `Samples/`, and
`Tests/`.

## Test plan

- [x] `dotnet build Microsoft.Teams.sln --configuration Release` — 0
errors, 5 pre-existing warnings
- [x] `dotnet test Microsoft.Teams.sln --configuration Release` — all
suites pass across net8.0 and net10.0 (Api 407+407, Apps 136+136, Common
63+63, AI 17+17, McpClient 9+9, Graph 3+3, AspNetCore 25+25 with 1
pre-existing skip)
- [x] `dotnet pack` — nupkgs produced; consumer install verified (fresh
console project, `dotnet add package Microsoft.Teams.Apps --prerelease`,
`dotnet run` confirms `QuotedReplyEntity` ships,
`AddQuote`/`PrependQuote` absent, `AddTargetedMessageInfo` present,
`ReactionClient.AddAsync`/`DeleteAsync` present)
- [ ] Teams.NET-ESRP pipeline with `packageSet=Legacy`,
`publishType=Public` (post-merge)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

## Summary

Adds a Trust Model page under Essentials → App Configuration documenting
the layered authentication model the SDK uses for inbound JSON Web
Tokens.

## Why

A scanner flagged the SDK's `JsonWebToken` accessor class because it
does not perform signature verification at the point of token parsing. A
cross-SDK audit confirmed this is intentional architecture: signature
verification runs at the HTTP boundary (via the activity pipeline's
token validator), and the accessor class is a typed view over
already-validated payloads. Every consumer of decoded claims is
downstream of a validator pass.

This page makes the architectural invariant explicit for SDK consumers,
reviewers, and future contributors.

## What's covered

- What the SDK validates automatically on `/api/messages` (signature,
issuer, audience, lifetime, algorithm)
- What downstream code can rely on (typed accessors over validated
tokens)
- How to add custom authentication to non-default surfaces (MCP,
callbacks, webhooks) — references the `requireAuth` hook recently added
in microsoft/teams.ts#540 / microsoft/teams.net#448
- Anti-patterns to avoid (constructing the accessor from untrusted input
as a basis for authorization decisions)

## Build verified

`npm run build` clean.

## Related PRs

- TypeScript: microsoft/teams.ts#586
- Python: microsoft/teams.py#432
- .NET: microsoft/teams.net#517

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>