[dependabot]

Bumps the azure group with 5 updates in the / directory:

Package	From	To
github.com/Azure/azure-sdk-for-go/sdk/azcore	1.23.2	1.23.3
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.14.1	1.15.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v9	9.6.0-beta.1	9.7.0-beta.1
github.com/Azure/kubelogin	0.2.20	0.2.21
github.com/Azure/unbounded	0.15.0	0.16.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.2 to 1.23.3

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.23.3

1.23.3 (2026-10-06)

Bugs Fixed

• Fixed arm.ResourceID.Location being empty when the locations segment uses different casing.

Other Changes

• Added azure-deprecating to the default set of allowed (non-redacted) response headers for logging.
• Replaced internal default HTTP client with the one from sdk/internal.

Commits

• b0d63ac Prep azcore@v1.23.3 for release (#27681)
• 83e527f [azdatalake] Update azblob to v1.8.2 for service.Client GetSASURL fix (#27657)
• 4e68728 [Service Bus] Stabilize session timeout tests (#27609)
• f3c857e Sync eng/common directory with azure-sdk-tools for PR 17077 (#27678)
• c76d8f0 Fix location parsing for mixed-case resource IDs (#27669)
• 6e5da8b fix: add period to LICENSE.txt (#26886)
• add0a52 Configurations: 'specification/azurefleet/resource-manager/Microsoft.AzureFl...
• 856b379 feat(azcore): add azure-deprecating to default allowed logging headers (#27...
• 50a269f Fix base template. (#27666)
• 3714be0 Sync eng/common directory with azure-sdk-tools for PR 17167 (#27665)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.15.0

1.15.0 (2026-10-14)

Features Added

• ManagedIdentityCredential and DefaultAzureCredential support user-assigned managed identities on Azure Arc when the agent supports them
• WorkloadIdentityCredential supports identity binding mode via WorkloadIdentityCredentialOptions.EnableAzureProxy

Bugs Fixed

• ManagedIdentityCredential verifies the Service Fabric endpoint's certificate against IDENTITY_SERVER_THUMBPRINT and rejects redirects

Other Changes

• On Service Fabric, a custom ClientOptions.Transport must be an *http.Client with a nil Transport or a standard *http.Transport without custom TLS dialing or verification callbacks. Unsupported transports now cause credential construction to fail
• Upgraded dependencies

Commits

• bb7200c Update azcore v1.15.0 release date (#23569)
• d112082 [azopenaiextensions] Pushing release date to Monday (#23565)
• 9522165 [azopenai] 2024-08-01-preview generation (#23554)
• 42922c1 [azeventhubs,azservicebus] Applying retry fix to both eventhubs and servicebu...
• 5df372c Use common OIDC token env vars in post scripts (#23549)
• 1c2a108 BearerTokenPolicy handles CAE claims challenges by default (#23414)
• 8759ee6 [azopenaiextensions] Prepping for release tomorrow (#23551)
• a230ef2 [Search] Remove myself from CODEOWNERS (#23560)
• a743757 Sync eng/common directory with azure-sdk-tools for PR 9106 (#23555)
• 7c2d3a7 Use equality function check for persist oidc token step (#23559)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v9 from 9.6.0-beta.1 to 9.7.0-beta.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v9's releases.

sdk/resourcemanager/containerservice/armcontainerservice/v9.7.0-beta.1

9.7.0-beta.1 (2026-10-02)

Features Added

• New value AgentPoolModeMachines, AgentPoolModeManagedSystem added to enum type AgentPoolMode
• New value AgentPoolTypeFlexNodes added to enum type AgentPoolType
• New value BackendPoolTypePodIP added to enum type BackendPoolType
• New value LoadBalancerSKUService added to enum type LoadBalancerSKU
• New value OSSKUFlatcar, OSSKUMariner, OSSKUUbuntu2604, OSSKUWindowsAnnual added to enum type OSSKU
• New value PublicNetworkAccessSecuredByPerimeter added to enum type PublicNetworkAccess
• New value SnapshotTypeManagedCluster added to enum type SnapshotType
• New value TransitEncryptionTypeMTLS added to enum type TransitEncryptionType
• New value WorkloadRuntimeKataMshvVMIsolation added to enum type WorkloadRuntime
• New enum type AddonAutoscaling with values AddonAutoscalingDisabled, AddonAutoscalingEnabled
• New enum type AgentPoolNICPublicIPAddressVersion with values AgentPoolNICPublicIPAddressVersionIPv4
• New enum type AgentPoolNetworkInterfaceType with values AgentPoolNetworkInterfaceTypeDynamic, AgentPoolNetworkInterfaceTypeStandard
• New enum type AlertConfigurationMode with values AlertConfigurationModeDisabled, AlertConfigurationModeManaged
• New enum type AlertConfigurationProvisioningState with values AlertConfigurationProvisioningStateCanceled, AlertConfigurationProvisioningStateCreating, AlertConfigurationProvisioningStateDeleting, AlertConfigurationProvisioningStateFailed, AlertConfigurationProvisioningStateSucceeded, AlertConfigurationProvisioningStateUpdating
• New enum type BastionSKU with values BastionSKUPremium, BastionSKUStandard
• New enum type ClusterServiceLoadBalancerHealthProbeMode with values ClusterServiceLoadBalancerHealthProbeModeServiceNodePort, ClusterServiceLoadBalancerHealthProbeModeShared
• New enum type ControlPlaneScalingSize with values ControlPlaneScalingSizeH2, ControlPlaneScalingSizeH4, ControlPlaneScalingSizeH8
• New enum type DriftAction with values DriftActionRecreate, DriftActionSynced
• New enum type DriverType with values DriverTypeCUDA, DriverTypeGRID
• New enum type GuardrailsSupport with values GuardrailsSupportPreview, GuardrailsSupportStable
• New enum type IpvsScheduler with values IpvsSchedulerLeastConnection, IpvsSchedulerRoundRobin
• New enum type JWTAuthenticatorProvisioningState with values JWTAuthenticatorProvisioningStateCanceled, JWTAuthenticatorProvisioningStateCreating, JWTAuthenticatorProvisioningStateDeleting, JWTAuthenticatorProvisioningStateFailed, JWTAuthenticatorProvisioningStateSucceeded, JWTAuthenticatorProvisioningStateUpdating
• New enum type ManagementMode with values ManagementModeManaged, ManagementModeUnmanaged
• New enum type MeshMembershipProvisioningState with values MeshMembershipProvisioningStateCanceled, MeshMembershipProvisioningStateCreating, MeshMembershipProvisioningStateDeleting, MeshMembershipProvisioningStateFailed, MeshMembershipProvisioningStateSucceeded, MeshMembershipProvisioningStateUpdating
• New enum type MigStrategy with values MigStrategyMixed, MigStrategyNone, MigStrategySingle
• New enum type Mode with values ModeIPTABLES, ModeIPVS, ModeNFTABLES
• New enum type NodeDisruptionPolicy with values NodeDisruptionPolicyAllow, NodeDisruptionPolicyAllowDuringMaintenanceWindow, NodeDisruptionPolicyBlock
• New enum type NvidiaDriverMode with values NvidiaDriverModeDRA, NvidiaDriverModeDevicePlugin
• New enum type Operator with values OperatorDoesNotExist, OperatorExists, OperatorIn, OperatorNotIn
• New enum type PodLinkLocalAccess with values PodLinkLocalAccessIMDS, PodLinkLocalAccessNone
• New enum type ResourceProvisioningState with values ResourceProvisioningStateCanceled, ResourceProvisioningStateFailed, ResourceProvisioningStateSucceeded
• New enum type ResourceSKUCapacityScaleType with values ResourceSKUCapacityScaleTypeAutomatic, ResourceSKUCapacityScaleTypeManual, ResourceSKUCapacityScaleTypeNone
• New enum type ResourceSKURestrictionsReasonCode with values ResourceSKURestrictionsReasonCodeNotAvailableForSubscription, ResourceSKURestrictionsReasonCodeQuotaID
• New enum type ResourceSKURestrictionsType with values ResourceSKURestrictionsTypeLocation, ResourceSKURestrictionsTypeZone
• New enum type SafeguardsSupport with values SafeguardsSupportPreview, SafeguardsSupportStable
• New enum type SeccompDefault with values SeccompDefaultRuntimeDefault, SeccompDefaultUnconfined
• New enum type UpgradeStrategy with values UpgradeStrategyBlueGreen, UpgradeStrategyRolling
• New enum type VMState with values VMStateDeleted, VMStateRunning
• New function *AgentPoolsClient.BeginCompleteUpgrade(ctx context.Context, resourceGroupName string, resourceName string, agentPoolName string, options *AgentPoolsClientBeginCompleteUpgradeOptions) (*runtime.Poller[AgentPoolsClientCompleteUpgradeResponse], error)
• New function *AgentPoolsClient.ListBootstrapData(ctx context.Context, resourceGroupName string, resourceName string, agentPoolName string, body ListBootstrapDataRequest, options *AgentPoolsClientListBootstrapDataOptions) (AgentPoolsClientListBootstrapDataResponse, error)
• New function *AgentPoolsClient.BeginUpdate(ctx context.Context, resourceGroupName string, resourceName string, agentPoolName string, parameters AgentPoolUpdate, options *AgentPoolsClientBeginUpdateOptions) (*runtime.Poller[AgentPoolsClientUpdateResponse], error)
• New function NewAlertConfigurationsClient(subscriptionID string, credential azcore.TokenCredential, options *arm.ClientOptions) (*AlertConfigurationsClient, error)
• New function *AlertConfigurationsClient.BeginCreateOrUpdate(ctx context.Context, resourceGroupName string, resourceName string, configurationName string, resource AlertConfiguration, options *AlertConfigurationsClientBeginCreateOrUpdateOptions) (*runtime.Poller[AlertConfigurationsClientCreateOrUpdateResponse], error)
• New function *AlertConfigurationsClient.BeginDelete(ctx context.Context, resourceGroupName string, resourceName string, configurationName string, options *AlertConfigurationsClientBeginDeleteOptions) (*runtime.Poller[AlertConfigurationsClientDeleteResponse], error)
• New function *AlertConfigurationsClient.Get(ctx context.Context, resourceGroupName string, resourceName string, configurationName string, options *AlertConfigurationsClientGetOptions) (AlertConfigurationsClientGetResponse, error)
• New function *AlertConfigurationsClient.NewListByManagedClusterPager(resourceGroupName string, resourceName string, options *AlertConfigurationsClientListByManagedClusterOptions) *runtime.Pager[AlertConfigurationsClientListByManagedClusterResponse]

... (truncated)

Commits

• d74cc84 Configurations: 'specification/containerservice/resource-manager/Microsoft.C...
• 63912f9 Implement MSAL's ClientConfigurer for Service Fabric (#27685)
• 4ac42f5 Increment package version after release of azcore (#27683)
• b0d63ac Prep azcore@v1.23.3 for release (#27681)
• 83e527f [azdatalake] Update azblob to v1.8.2 for service.Client GetSASURL fix (#27657)
• 4e68728 [Service Bus] Stabilize session timeout tests (#27609)
• f3c857e Sync eng/common directory with azure-sdk-tools for PR 17077 (#27678)
• c76d8f0 Fix location parsing for mixed-case resource IDs (#27669)
• 6e5da8b fix: add period to LICENSE.txt (#26886)
• add0a52 Configurations: 'specification/azurefleet/resource-manager/Microsoft.AzureFl...
• Additional commits viewable in compare view

Updates github.com/Azure/kubelogin from 0.2.20 to 0.2.21

Release notes

Sourced from github.com/Azure/kubelogin's releases.

v0.2.21 release

Maintenance

• chore: bump Go to 1.26.6 to fix stdlib CVEs by @​psletsjooe in Azure/kubelogin#819
• Bump codecov/codecov-action from 7.1.0 to 7.1.1 by @​dependabot[bot] in Azure/kubelogin#818
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in Azure/kubelogin#813
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @​dependabot[bot] in Azure/kubelogin#812
• Bump codecov/codecov-action from 7.0.0 to 7.1.0 by @​dependabot[bot] in Azure/kubelogin#811
• Bump softprops/action-gh-release from 3.0.1 to 3.0.3 by @​dependabot[bot] in Azure/kubelogin#809

New Contributors

• @​psletsjooe made their first contribution in Azure/kubelogin#819

Full Changelog: Azure/kubelogin@v0.2.20...v0.2.21

Changelog

Sourced from github.com/Azure/kubelogin's changelog.

[0.2.21]

Maintenance

• chore: bump Go to 1.26.6 to fix stdlib CVEs by @​psletsjooe in Azure/kubelogin#819
• Bump codecov/codecov-action from 7.1.0 to 7.1.1 by @​dependabot[bot] in Azure/kubelogin#818
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in Azure/kubelogin#813
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @​dependabot[bot] in Azure/kubelogin#812
• Bump codecov/codecov-action from 7.0.0 to 7.1.0 by @​dependabot[bot] in Azure/kubelogin#811
• Bump softprops/action-gh-release from 3.0.1 to 3.0.3 by @​dependabot[bot] in Azure/kubelogin#809

New Contributors

• @​psletsjooe made their first contribution in Azure/kubelogin#819

Full Changelog: Azure/kubelogin@v0.2.20...v0.2.21

Commits

• 5328263 docs: add v0.2.21 changelog entry (#820)
• 244762c bump Go to 1.26.6 (#819)
• 5d03c6d Bump softprops/action-gh-release from 3.0.1 to 3.0.3 (#809)
• 84ba16d Bump codecov/codecov-action from 7.1.0 to 7.1.1 (#818)
• d8659c4 Bump codecov/codecov-action from 7.0.0 to 7.1.0 (#811)
• 6bb434a Bump docker/build-push-action from 7.3.0 to 7.4.0 (#812)
• cf6cfb8 Bump docker/setup-buildx-action from 4.3.0 to 4.4.0 (#813)
• See full diff in compare view

Updates github.com/Azure/unbounded from 0.15.0 to 0.16.0

Commits

• a10464b Racer integration (#932)
• See full diff in compare view

[Copilot]

🟡 Changes recommended

The controller image’s pinned Go builder is older than the new module minimum, blocking image builds.

1 open issue

• Update controller builder image for Go 1.26.9 minimum · New

What changed in this PR

Updates the AKS FlexNode agent’s Azure dependencies and related Go modules.

Changes:

• Upgrades five Azure dependencies, including authentication, container-service management, and Unbounded.
• Refreshes related dependency versions and checksums.
• Raises the minimum Go version from 1.26.6 to 1.26.9.

File	Description
go.sum	Updates checksums for upgraded dependencies.
go.mod	Updates dependency requirements and the minimum Go version.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Unbounded upgrade spans multiple pre-1.0 releases and needs integration validation of node provisioning and lifecycle compatibility before human approval.

1 open issue

• Update controller builder image for Go 1.26.9 minimum

_{Review effort: Balanced}

[hbc (bcho)]

Dependabot (@dependabot) rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[Copilot]

🔵 Needs a closer look

Authentication, beta AKS SDK, and shared-library compatibility need build and integration validation that was unavailable during review.

1 open issue

• Update controller builder image for Go 1.26.9 minimum

_{Review effort: Balanced}