From ad8e012705d818d8615b709abf16adcd81ffc8e6 Mon Sep 17 00:00:00 2001 From: Azure CLI Team Date: Tue, 26 May 2026 04:38:05 +0000 Subject: [PATCH 1/4] update azure-cli version to 2.87.0 --- src/azure-cli-core/HISTORY.rst | 10 ++ src/azure-cli-core/azure/cli/core/__init__.py | 2 +- .../azure/cli/core/commandIndex.latest.json | 2 +- .../azure/cli/core/helpIndex.latest.json | 2 +- src/azure-cli-core/setup.py | 2 +- src/azure-cli/HISTORY.rst | 99 +++++++++++++++++++ src/azure-cli/azure/cli/__main__.py | 2 +- src/azure-cli/requirements.py3.Darwin.txt | 4 +- src/azure-cli/requirements.py3.Linux.txt | 4 +- src/azure-cli/requirements.py3.windows.txt | 4 +- src/azure-cli/setup.py | 2 +- 11 files changed, 121 insertions(+), 12 deletions(-) diff --git a/src/azure-cli-core/HISTORY.rst b/src/azure-cli-core/HISTORY.rst index 4cd7bb9928b..db39cd8bf02 100644 --- a/src/azure-cli-core/HISTORY.rst +++ b/src/azure-cli-core/HISTORY.rst @@ -3,6 +3,16 @@ Release History =============== +2.87.0 +++++++ +* Raw githubusercontent urls are updated to refer azcli blob to restrict external system access (#33240) +* Resolve CVE-2026-44431 (#33351) +* Resolve CVE-2026-44432 (#33351) +* `az login`: Support Entra agentic session differentiation for Copilot agent requests (#33309) +* Resolve CVE-2026-45409 (#33401) +* Bump pymsalruntime to 0.20.6 (#33433) +* Git diff updated to match the two commits (branches head) only — no merge base needed (#33400) + 2.86.0 ++++++ * Resolve CVE-2025-15467 (#33201) diff --git a/src/azure-cli-core/azure/cli/core/__init__.py b/src/azure-cli-core/azure/cli/core/__init__.py index ccbdce87f75..06c369f88b8 100644 --- a/src/azure-cli-core/azure/cli/core/__init__.py +++ b/src/azure-cli-core/azure/cli/core/__init__.py @@ -4,7 +4,7 @@ # -------------------------------------------------------------------------------------------- # pylint: disable=line-too-long -__version__ = "2.86.0" +__version__ = "2.87.0" import os import sys diff --git a/src/azure-cli-core/azure/cli/core/commandIndex.latest.json b/src/azure-cli-core/azure/cli/core/commandIndex.latest.json index 5020681cf99..3b8b235b7e5 100644 --- a/src/azure-cli-core/azure/cli/core/commandIndex.latest.json +++ b/src/azure-cli-core/azure/cli/core/commandIndex.latest.json @@ -1,5 +1,5 @@ { - "version": "2.86.0", + "version": "2.87.0", "cloudProfile": "latest", "commandIndex": { "account": [ diff --git a/src/azure-cli-core/azure/cli/core/helpIndex.latest.json b/src/azure-cli-core/azure/cli/core/helpIndex.latest.json index 1c5acc360b3..2656bee6c3c 100644 --- a/src/azure-cli-core/azure/cli/core/helpIndex.latest.json +++ b/src/azure-cli-core/azure/cli/core/helpIndex.latest.json @@ -1,5 +1,5 @@ { - "version": "2.86.0", + "version": "2.87.0", "cloudProfile": "latest", "helpIndex": { "groups": { diff --git a/src/azure-cli-core/setup.py b/src/azure-cli-core/setup.py index fc8b0688ac4..745d1868a26 100644 --- a/src/azure-cli-core/setup.py +++ b/src/azure-cli-core/setup.py @@ -8,7 +8,7 @@ from codecs import open from setuptools import setup, find_packages -VERSION = "2.86.0" +VERSION = "2.87.0" # If we have source, validate that our version numbers match # This should prevent uploading releases with mismatched versions. diff --git a/src/azure-cli/HISTORY.rst b/src/azure-cli/HISTORY.rst index c0d13ee1b65..fed6b92e6e3 100644 --- a/src/azure-cli/HISTORY.rst +++ b/src/azure-cli/HISTORY.rst @@ -3,6 +3,105 @@ Release History =============== +2.87.0 +++++++ + +**ACR** + +* [BREAKING CHANGE] `az acr replication create/update`: Remove deprecated `--region-endpoint-enabled` flag and use `--global-endpoint-routing` instead (#33173) +* [BREAKING CHANGE] `az acr config content-trust update`: No longer accept the `enabled` status (#33174) +* [BREAKING CHANGE] `az acr check-health`: Remove Notary client check due to Docker Content Trust deprecation (#33174) +* `az acr login`: Make ACR audience customizable in AAD token acquisition (#33294) +* `az acr connected-registry resync`: Add command to manually trigger a sync from the parent registry (#33236) +* `az acr update`: Add `--endpoint-protocol` parameter to support specifying the endpoint protocol for the registry (#33089) +* `az acr login`: Fix regional endpoint matching for registries with DNL suffix (#33381) +* `az acr config content-trust/show/update`: Add deprecation labels and notices (#33174) + +**AKS** + +* Skip subnet validation for existing outbound type on update (#33418) +* `az aks add/update`: Add `enable-artifact-streaming` and `disable_artifact_streaming` options (#33257) + +**App Config** + +* `az appconfig kv set-snapshot-reference`: Add support to create a snapshot reference key-value (#33278) +* `az appconfig kv list`: Add support to list key-values from a snapshot reference (#33278) +* `az appconfig create\update\network-security-perimeter-configuration`: Add NSP support (#33407) + +**App Service** + +* [BREAKING CHANGE] `az webapp list-runtimes`: Output changed from flat string list to structured list of dicts with keys: os, runtime, version, config, support, end_of_life. Added `--runtime` and `--support` filter parameters. Removed deprecated `--linux` and `--show-runtime-details` parameters. (#32903) +* Remove stale `az webapp list-runtimes` breaking change pre-announcements (#33434) +* `az webapp log startup`: Add commands to list and view Linux container startup logs (#33256) +* `az webapp create`: Add `--site-scoped-certs` parameter to support enabling or disabling site-scoped certificates (#33306) +* `az webapp up`: Add warning message for future deprecation (#33410) +* `az functionapp deployment source config-zip`: Fix `KeyError` `'FUNCTIONS_WORKER_RUNTIME'` for Go function apps on Flex Consumption (#33404) +* `az functionapp update-strategy config set`: Add new command to set or update a function app's update strategy configuration (#33341) +* `az functionapp update-strategy config show`: Add new command to get the details of a function app's update strategy configuration (#33341) +* Fix #31394: `az functionapp deployment source config-zip`: Never ending loop on flex function app health check (#33388) + +**Compute** + +* [BREAKING CHANGE] `az vm create`: Change default `--size` from `Standard_DS1_v2` to `Standard_D2s_v5` (#33323) +* [BREAKING CHANGE] `az vmss create`: Change default `--vm-sku` from `Standard_DS1_v2` to `Standard_D2s_v5` (#33323) +* `az sig image-definition update`: Add ability to update image-definition start version (#33273) +* `az vm create/ update`: Support zone-resilient VM with `--zone-movement` (#33242) +* `az vm update`: Support cross-zone movement (#33242) +* `az vm deallocate`: Support vm force deallocate with `--force-deallocate` (#33242) +* `az vm/vmss create`: Support Ephemeral OS disk with full caching with `--ephemeral-os-disk-enable-full-caching` (#33292) + +**Container app** + +* `az containerapp`: Fix typo in help message (#33082) +* Fix #33369: `az containerapp up`: Resolve OS/Architecture models from correct SDK package (#33371) + +**Cosmos DB** + +* `az cosmosdb restore`: Fix cross-region restore by preserving source region in top-level location (#33274) + +**Key Vault** + +* `az keyvault create`: Fix keyvault create RequestDisallowedByPolicy error by explicitly setting `enableSoftDelete` in the request body (#33265) + +**MySQL** + +* BREAKING CHANGE `az mysql flexible-server backup create/restore/geo-restore/replica`: Remove `--storage-redundancy` (#33428) + +**NetAppFiles** + +* [BREAKING CHANGE] `az netappfiles volume update`: `--remote-volume-resource-id` has been deprecated (#33217) +* [BREAKING CHANGE] `az netappfiles volume create`: `--network-features` default value has changed to `Standard` (#33217) +* `az netappfiles cache`: Add new command group to mange Cache resources (#33217) +* `az netappfiles volume bucket`: Add new command group to mange Bucket resources (#33217) + +**Network** + +* `az network vnet create/update`: Add `--summarized-gateway-prefixes` to support summarized gateway prefixes (#33241) +* `az network application-gateway ssl-cert create/update`: Add `--hsm` to support Managed HSM (#33353) +* `az network virtual-network-appliance create/update`: Add `--private-ip-address-version` to support private ip address version (#33315) + +**POSGRESQL** + +* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove `--high-availability` for preferred argument `--zonal-resiliency` (#33300) + +**PostgreSQL** + +* [BREAKING CHANGE] `az postgres flexible-server upgrade`: Remove the enum for `--version` (#33116) +* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove deprecated `--cluster-option` and update validation logic (#33244) +* [BREAKING CHANGE] `az postgres flexible-server index-tuning`: Remove support for command group (#33344) +* [BREAKING CHANGE] `az postgres flexible-server backup create`: Remove backup name requirement and implement automatic name generation for backups (#33340) +* [BREAKING CHANGE] `az postgres flexible-server create/geo-restore/restore/revive-dropped`: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting `--address-prefixes` and `--subnet-prefixes` anymore (#33192) +* [BREAKING CHANGE] `az postgres flexible-server replica create`: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting `--address-prefixes` and `--subnet-prefixes` anymore (#33192) +* [BREAKING CHANGE] `az postgres flexible-server backup/db/firewall-rule/long-term-retention/migration/replica create`: Make consistent use of `--name` and `--server-name` across all commands (#33343) +* [BREAKING CHANGE] `az postgres flexible-server long-term-retention`: Remove support for command group (#33345) + +**Storage** + +* `az storage account create/update`: Support new value `Smart` for `--access-tier` (#33423) +* `az storage account create/update`: Support `--allowed-copy-scope` (#33423) +* `az storage account blob-service-properties update`: Add `--enable-static-website`, `--index-document`, `--default-index-document-path`, `--error-document-404-path` (#33423) +* `az storage account or-policy create/update`: Add `--tags-replication` (#33423) + 2.86.0 ++++++ diff --git a/src/azure-cli/azure/cli/__main__.py b/src/azure-cli/azure/cli/__main__.py index aae8ddb92c1..9994d67197b 100644 --- a/src/azure-cli/azure/cli/__main__.py +++ b/src/azure-cli/azure/cli/__main__.py @@ -17,7 +17,7 @@ from knack.log import get_logger __author__ = "Microsoft Corporation " -__version__ = "2.86.0" +__version__ = "2.87.0" logger = get_logger(__name__) diff --git a/src/azure-cli/requirements.py3.Darwin.txt b/src/azure-cli/requirements.py3.Darwin.txt index c81a230f341..dd81dab50c3 100644 --- a/src/azure-cli/requirements.py3.Darwin.txt +++ b/src/azure-cli/requirements.py3.Darwin.txt @@ -4,9 +4,9 @@ argcomplete==3.5.2 asn1crypto==0.24.0 azure-appconfiguration==1.7.2 azure-batch==15.0.0b1 -azure-cli-core==2.86.0 +azure-cli-core==2.87.0 azure-cli-telemetry==1.1.0 -azure-cli==2.86.0 +azure-cli==2.87.0 azure-common==1.1.22 azure-core==1.39.0 azure-cosmos==3.2.0 diff --git a/src/azure-cli/requirements.py3.Linux.txt b/src/azure-cli/requirements.py3.Linux.txt index 8e78fb2f239..07700ab14e6 100644 --- a/src/azure-cli/requirements.py3.Linux.txt +++ b/src/azure-cli/requirements.py3.Linux.txt @@ -4,9 +4,9 @@ argcomplete==3.5.2 asn1crypto==0.24.0 azure-appconfiguration==1.7.2 azure-batch==15.0.0b1 -azure-cli-core==2.86.0 +azure-cli-core==2.87.0 azure-cli-telemetry==1.1.0 -azure-cli==2.86.0 +azure-cli==2.87.0 azure-common==1.1.22 azure-core==1.39.0 azure-cosmos==3.2.0 diff --git a/src/azure-cli/requirements.py3.windows.txt b/src/azure-cli/requirements.py3.windows.txt index d98d8539337..9a57512cb3f 100644 --- a/src/azure-cli/requirements.py3.windows.txt +++ b/src/azure-cli/requirements.py3.windows.txt @@ -4,9 +4,9 @@ argcomplete==3.5.2 asn1crypto==0.24.0 azure-appconfiguration==1.7.2 azure-batch==15.0.0b1 -azure-cli-core==2.86.0 +azure-cli-core==2.87.0 azure-cli-telemetry==1.1.0 -azure-cli==2.86.0 +azure-cli==2.87.0 azure-common==1.1.22 azure-core==1.39.0 azure-cosmos==3.2.0 diff --git a/src/azure-cli/setup.py b/src/azure-cli/setup.py index 3b207a48122..d05560025df 100644 --- a/src/azure-cli/setup.py +++ b/src/azure-cli/setup.py @@ -17,7 +17,7 @@ logging.warning("Wheel is not available, disabling bdist_wheel hook") cmdclass = {} -VERSION = "2.86.0" +VERSION = "2.87.0" # If we have source, validate that our version numbers match # This should prevent uploading releases with mismatched versions. try: From 0fc5f0ffb17d4c09c5d28dbadf5996f50e94a9ec Mon Sep 17 00:00:00 2001 From: mansoor sarfraz Date: Tue, 26 May 2026 14:53:04 +1000 Subject: [PATCH 2/4] Apply suggestions from code review Co-authored-by: Julie Zhu <105691024+yanzhudd@users.noreply.github.com> Co-authored-by: necusjz Co-authored-by: Yu Chen <16348853+jsntcy@users.noreply.github.com> Co-authored-by: Naga Nandyala --- src/azure-cli-core/HISTORY.rst | 2 -- src/azure-cli/HISTORY.rst | 12 ++++++------ 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/src/azure-cli-core/HISTORY.rst b/src/azure-cli-core/HISTORY.rst index db39cd8bf02..341d54744fb 100644 --- a/src/azure-cli-core/HISTORY.rst +++ b/src/azure-cli-core/HISTORY.rst @@ -5,13 +5,11 @@ Release History 2.87.0 ++++++ -* Raw githubusercontent urls are updated to refer azcli blob to restrict external system access (#33240) * Resolve CVE-2026-44431 (#33351) * Resolve CVE-2026-44432 (#33351) * `az login`: Support Entra agentic session differentiation for Copilot agent requests (#33309) * Resolve CVE-2026-45409 (#33401) * Bump pymsalruntime to 0.20.6 (#33433) -* Git diff updated to match the two commits (branches head) only — no merge base needed (#33400) 2.86.0 ++++++ diff --git a/src/azure-cli/HISTORY.rst b/src/azure-cli/HISTORY.rst index fed6b92e6e3..69d5ad955e8 100644 --- a/src/azure-cli/HISTORY.rst +++ b/src/azure-cli/HISTORY.rst @@ -19,19 +19,19 @@ Release History **AKS** -* Skip subnet validation for existing outbound type on update (#33418) * `az aks add/update`: Add `enable-artifact-streaming` and `disable_artifact_streaming` options (#33257) **App Config** * `az appconfig kv set-snapshot-reference`: Add support to create a snapshot reference key-value (#33278) * `az appconfig kv list`: Add support to list key-values from a snapshot reference (#33278) -* `az appconfig create\update\network-security-perimeter-configuration`: Add NSP support (#33407) +* `az appconfig create/update/network-security-perimeter-configuration`: Add Network Security Perimeter (NSP) support (#33407) **App Service** -* [BREAKING CHANGE] `az webapp list-runtimes`: Output changed from flat string list to structured list of dicts with keys: os, runtime, version, config, support, end_of_life. Added `--runtime` and `--support` filter parameters. Removed deprecated `--linux` and `--show-runtime-details` parameters. (#32903) -* Remove stale `az webapp list-runtimes` breaking change pre-announcements (#33434) +* [BREAKING CHANGE] `az webapp list-runtimes`: Change output from flat string list to structured list of dicts with keys: os, runtime, version, config, support, end_of_life (#32903) +* `az webapp list-runtimes`: Add `--runtime` and `--support` filter parameters (#32903) +* [BREAKING CHANGE] `az webapp list-runtimes`: Remove deprecated `--linux` and `--show-runtime-details` parameters (#32903) * `az webapp log startup`: Add commands to list and view Linux container startup logs (#33256) * `az webapp create`: Add `--site-scoped-certs` parameter to support enabling or disabling site-scoped certificates (#33306) * `az webapp up`: Add warning message for future deprecation (#33410) @@ -45,7 +45,7 @@ Release History * [BREAKING CHANGE] `az vm create`: Change default `--size` from `Standard_DS1_v2` to `Standard_D2s_v5` (#33323) * [BREAKING CHANGE] `az vmss create`: Change default `--vm-sku` from `Standard_DS1_v2` to `Standard_D2s_v5` (#33323) * `az sig image-definition update`: Add ability to update image-definition start version (#33273) -* `az vm create/ update`: Support zone-resilient VM with `--zone-movement` (#33242) +* `az vm create/update`: Support zone-resilient VM with `--zone-movement` (#33242) * `az vm update`: Support cross-zone movement (#33242) * `az vm deallocate`: Support vm force deallocate with `--force-deallocate` (#33242) * `az vm/vmss create`: Support Ephemeral OS disk with full caching with `--ephemeral-os-disk-enable-full-caching` (#33292) @@ -65,7 +65,7 @@ Release History **MySQL** -* BREAKING CHANGE `az mysql flexible-server backup create/restore/geo-restore/replica`: Remove `--storage-redundancy` (#33428) +* [BREAKING CHANGE] `az mysql flexible-server backup create/restore/geo-restore/replica`: Remove `--storage-redundancy` (#33428) **NetAppFiles** From 4eb5db072d44e040cc6b2aba1d01b4e926131917 Mon Sep 17 00:00:00 2001 From: mansoor sarfraz Date: Tue, 26 May 2026 14:55:50 +1000 Subject: [PATCH 3/4] Apply suggestions from code review Co-authored-by: necusjz Co-authored-by: Naga Nandyala --- src/azure-cli-core/HISTORY.rst | 1 - src/azure-cli/HISTORY.rst | 5 +---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/src/azure-cli-core/HISTORY.rst b/src/azure-cli-core/HISTORY.rst index 341d54744fb..7985de267eb 100644 --- a/src/azure-cli-core/HISTORY.rst +++ b/src/azure-cli-core/HISTORY.rst @@ -9,7 +9,6 @@ Release History * Resolve CVE-2026-44432 (#33351) * `az login`: Support Entra agentic session differentiation for Copilot agent requests (#33309) * Resolve CVE-2026-45409 (#33401) -* Bump pymsalruntime to 0.20.6 (#33433) 2.86.0 ++++++ diff --git a/src/azure-cli/HISTORY.rst b/src/azure-cli/HISTORY.rst index 69d5ad955e8..04d55b6b016 100644 --- a/src/azure-cli/HISTORY.rst +++ b/src/azure-cli/HISTORY.rst @@ -80,12 +80,9 @@ Release History * `az network application-gateway ssl-cert create/update`: Add `--hsm` to support Managed HSM (#33353) * `az network virtual-network-appliance create/update`: Add `--private-ip-address-version` to support private ip address version (#33315) -**POSGRESQL** - -* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove `--high-availability` for preferred argument `--zonal-resiliency` (#33300) - **PostgreSQL** +* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove `--high-availability` for preferred argument `--zonal-resiliency` (#33300) * [BREAKING CHANGE] `az postgres flexible-server upgrade`: Remove the enum for `--version` (#33116) * [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove deprecated `--cluster-option` and update validation logic (#33244) * [BREAKING CHANGE] `az postgres flexible-server index-tuning`: Remove support for command group (#33344) From 99bb5d6ac0cf9421a3df4ac1124264111313592a Mon Sep 17 00:00:00 2001 From: mansoor sarfraz Date: Tue, 26 May 2026 15:00:07 +1000 Subject: [PATCH 4/4] Apply suggestions from code review Co-authored-by: Julie Zhu <105691024+yanzhudd@users.noreply.github.com> Co-authored-by: Naga Nandyala --- src/azure-cli/HISTORY.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/azure-cli/HISTORY.rst b/src/azure-cli/HISTORY.rst index 04d55b6b016..59fae05291c 100644 --- a/src/azure-cli/HISTORY.rst +++ b/src/azure-cli/HISTORY.rst @@ -19,7 +19,7 @@ Release History **AKS** -* `az aks add/update`: Add `enable-artifact-streaming` and `disable_artifact_streaming` options (#33257) +* `az aks add/update`: Add `--enable-artifact-streaming` and `--disable-artifact-streaming` parameters (#33257) **App Config** @@ -71,8 +71,8 @@ Release History * [BREAKING CHANGE] `az netappfiles volume update`: `--remote-volume-resource-id` has been deprecated (#33217) * [BREAKING CHANGE] `az netappfiles volume create`: `--network-features` default value has changed to `Standard` (#33217) -* `az netappfiles cache`: Add new command group to mange Cache resources (#33217) -* `az netappfiles volume bucket`: Add new command group to mange Bucket resources (#33217) +* `az netappfiles cache`: Add new command group to manage Cache resources (#33217) +* `az netappfiles volume bucket`: Add new command group to manage Bucket resources (#33217) **Network**