build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.3.0 to 1.6.0

[dependabot]

Bumps github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.3.0 to 1.6.0.

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/internal/v1.6.0

1.6.0 (2024-04-16)

Features Added

• Options types for SetBodilessMatcher and SetDefaultMatcher now embed RecordingOptions
• Added a collection of default sanitizers for test recordings

sdk/azidentity/v1.6.0

1.6.0 (2024-06-10)

Features Added

• NewOnBehalfOfCredentialWithClientAssertions creates an on-behalf-of credential that authenticates with client assertions such as federated credentials

Breaking Changes

These changes affect only code written against a beta version such as v1.6.0-beta.4

• Removed AzurePipelinesCredential and the persistent token caching API. They will return in v1.7.0-beta.1

Bugs Fixed

• Managed identity bug fixes

sdk/azidentity/v1.6.0-beta.4

1.6.0-beta.4 (2024-05-14)

Features Added

• AzurePipelinesCredential authenticates an Azure Pipeline service connection with workload identity federation

sdk/azidentity/v1.6.0-beta.3

1.6.0-beta.3 (2024-04-09)

Breaking Changes

• DefaultAzureCredential now sends a probe request with no retries for IMDS managed identity environments to avoid excessive retry delays when the IMDS endpoint is not available. This should improve credential chain resolution for local development scenarios.

Bugs Fixed

• ManagedIdentityCredential now specifies resource IDs correctly for Azure Container Instances

sdk/azidentity/v1.5.2

1.5.2 (2024-04-09)

Bugs Fixed

• ManagedIdentityCredential now specifies resource IDs correctly for Azure Container Instances

Other Changes

• Restored v1.4.0 error behavior for empty tenant IDs
• Upgraded dependencies

... (truncated)

Commits

• 36f766d add sdk/resourcemanager/cosmos/armcosmos live test (#20705)
• c005ed6 sdk/resourcemanager/network/armnetwork live test (#20331)
• 5fa7df4 add sdk/resourcemanager/compute/armcompute live test (#20048)
• 0d22aed add sdk/resourcemanager/eventhub/armeventhub live test (#20686)
• 2a8d96d add sdk/resourcemanager/postgresql/armpostgresql live test (#20685)
• b2cddab [Release] sdk/resourcemanager/paloaltonetworksngfw/armpanngfw/0.1.0 (#20437)
• ed7f3c7 Fix azidentity troubleshooting guide link (#20736)
• 6dfd0cb [azeventhubs] Fixing checkpoint store race condition (#20727)
• 745d967 pass along the artifact name so we can override it later (#20732)
• 20b4dd8 Update changelog with latest features (#20730)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	2 findings
Authn/Authz Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request primarily involve updating the dependencies in the go.mod file. The key updates include:

1. Major Dependency Updates: The Azure SDK dependencies (azcore and azidentity) have been updated to newer versions, as well as other dependencies like google/uuid, stretchr/testify, golang.org/x/sync, and golang.org/x/text.
2. Indirect Dependency Updates: Several indirect dependencies have also been updated, including Azure/azure-sdk-for-go/sdk/internal, AzureAD/microsoft-authentication-library-for-go, golang-jwt/jwt/v4, pkg/browser, stretchr/objx, and various golang.org/x dependencies.

From an application security perspective, these dependency updates are generally a positive change, as they often include security fixes and improvements. It's important to review the release notes and changelogs of the updated dependencies, especially the Azure SDK and authentication-related libraries, to understand any security-related changes or improvements.

The update to the golang.org/x/crypto dependency is also worth noting, as this package provides cryptographic primitives for Go. Keeping dependencies like this up-to-date helps ensure that the application is using the latest security fixes and improvements.

Files Changed:

• go.mod: This file has been updated to reflect the changes in the project's dependencies. The changes include both major and indirect dependency updates, as described in the summary.

Powered by DryRun Security