From 98c8036ec80f13dbc2bb9731f2e1ae660cda7bac Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 01:04:13 +0000
Subject: [PATCH] NO-JIRA: Bump the azure-github-dependencies group across 1
 directory with 2 updates

Bumps the azure-github-dependencies group with 2 updates in the / directory: [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) and [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go).


Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.21.1 to 1.22.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.21.1...sdk/azcore/v1.22.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.13.1 to 1.14.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](https://github.com/Azure/azure-sdk-for-go/compare/sdk/azidentity/v1.13.1...sdk/azcore/v1.14.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: azure-github-dependencies
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: azure-github-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod                                        |   8 +-
 go.sum                                        |  20 +-
 .../azure-sdk-for-go/sdk/azcore/CHANGELOG.md  |  10 +
 .../sdk/azcore/internal/shared/constants.go   |   2 +-
 .../sdk/azcore/runtime/policy_bearer_token.go |   2 +-
 .../sdk/azidentity/CHANGELOG.md               |  50 ++++
 .../sdk/azidentity/TROUBLESHOOTING.md         |  23 +-
 .../sdk/azidentity/authentication_record.go   |   3 -
 .../sdk/azidentity/azidentity.go              |   5 +-
 .../sdk/azidentity/azure_cli_credential.go    |   5 +-
 .../azure_developer_cli_credential.go         |   5 -
 .../azidentity/azure_pipelines_credential.go  |   2 +-
 .../azidentity/chained_token_credential.go    |   3 -
 .../azure-sdk-for-go/sdk/azidentity/ci.yml    |   4 +-
 .../azidentity/client_assertion_credential.go |   3 -
 .../client_certificate_credential.go          |   3 -
 .../azidentity/client_secret_credential.go    |   3 -
 .../sdk/azidentity/confidential_client.go     |   5 +-
 .../azidentity/default_azure_credential.go    |   3 -
 .../azidentity/developer_credential_util.go   |  51 +++-
 .../sdk/azidentity/device_code_credential.go  |   3 -
 .../sdk/azidentity/environment_credential.go  |   3 -
 .../azure-sdk-for-go/sdk/azidentity/errors.go |  55 +++--
 .../azure-sdk-for-go/sdk/azidentity/go.work   |   6 -
 .../interactive_browser_credential.go         |   3 -
 .../internal/customtokenproxy/transport.go    | 233 ++++++++++++++++++
 .../sdk/azidentity/logging.go                 |   3 -
 .../sdk/azidentity/managed_identity_client.go |   5 -
 .../azidentity/managed_identity_credential.go |   3 -
 .../sdk/azidentity/on_behalf_of_credential.go |   3 -
 .../sdk/azidentity/public_client.go           |   3 -
 .../username_password_credential.go           |   3 -
 .../sdk/azidentity/version.go                 |   5 +-
 .../sdk/azidentity/workload_identity.go       |  25 +-
 .../apps/confidential/confidential.go         |  28 ++-
 .../apps/internal/base/base.go                |  11 +-
 .../base/storage/partitioned_storage.go       |  34 ++-
 .../apps/internal/base/storage/storage.go     |  30 ++-
 .../apps/internal/local/server.go             |  40 ++-
 .../internal/oauth/ops/authority/authority.go |  13 +
 .../oauth/ops/authority/known_metadata.go     |  70 ++++++
 .../internal/oauth/ops/internal/comm/comm.go  |  26 +-
 .../oauth/ops/internal/comm/compress.go       |  33 ---
 .../apps/internal/shared/shared.go            |  26 ++
 .../apps/internal/version/version.go          |   5 +-
 .../apps/managedidentity/managedidentity.go   |   5 +
 .../apps/public/public.go                     |  44 +++-
 vendor/github.com/golang-jwt/jwt/v5/README.md |  11 +-
 .../golang-jwt/jwt/v5/VERSION_HISTORY.md      |   2 +-
 vendor/github.com/golang-jwt/jwt/v5/parser.go |  24 +-
 .../golang-jwt/jwt/v5/parser_option.go        |  12 +-
 vendor/github.com/golang-jwt/jwt/v5/token.go  |   6 +-
 .../github.com/golang-jwt/jwt/v5/validator.go |   8 +-
 vendor/modules.txt                            |  11 +-
 54 files changed, 761 insertions(+), 241 deletions(-)
 delete mode 100644 vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/go.work
 create mode 100644 vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy/transport.go
 create mode 100644 vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/known_metadata.go
 delete mode 100644 vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/compress.go

diff --git a/go.mod b/go.mod
index cbe1978fe..066328ea0 100644
--- a/go.mod
+++ b/go.mod
@@ -5,8 +5,8 @@ go 1.25.7
 toolchain go1.26.3
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
 	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.4.0
 	github.com/onsi/gomega v1.41.0
 	github.com/openshift/hive/apis v0.0.0-20260519181045-ab4b2490385a
@@ -20,7 +20,7 @@ require (
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
@@ -37,7 +37,7 @@ require (
 	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
 	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
 	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
diff --git a/go.sum b/go.sum
index 4643ffa2b..db067ffc0 100644
--- a/go.sum
+++ b/go.sum
@@ -1,16 +1,16 @@
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 h1:jHb/wfvRikGdxMXYV3QG/SzUOPYN9KEUUuC0Yd0/vC0=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1/go.mod h1:pzBXCYn05zvYIrwLgtK8Ap8QcjRg+0i76tMQdWN6wOk=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -81,8 +81,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
index d730a3bc3..ed56ac241 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Release History
 
+## 1.22.0 (2026-06-04)
+
+### Features Added
+
+* Added type `datetime.RFC7231` for date/time values in RFC 1123 format with a fixed GMT timezone.
+
+### Other Changes
+
+* Upgraded dependencies.
+
 ## 1.21.1 (2026-04-16)
 
 ### Bugs Fixed
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
index 8ad391dd2..4f7aa6434 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
@@ -37,5 +37,5 @@ const (
 	Module = "azcore"
 
 	// Version is the semantic version (see http://semver.org) of this module.
-	Version = "v1.21.1"
+	Version = "v1.22.0"
 )
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go
index 547e5a327..f204a19c4 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_bearer_token.go
@@ -182,7 +182,7 @@ func (b *BearerTokenPolicy) handleChallenge(req *policy.Request, res *http.Respo
 
 func checkHTTPSForAuth(req *policy.Request, allowHTTP bool) error {
 	if strings.ToLower(req.Raw().URL.Scheme) != "https" && !allowHTTP {
-		return errorinfo.NonRetriableError(errors.New("authenticated requests are not permitted for non TLS protected (https) endpoints"))
+		return errorinfo.NonRetriableError(errors.New("authorized requests are not permitted for non-TLS protected (https) endpoints"))
 	}
 	return nil
 }
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md
index 4a6349e16..ba360a30e 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md
@@ -1,11 +1,61 @@
 # Release History
 
+## 1.14.0 (2026-06-15)
+
+### Breaking Changes
+
+> These changes affect only code written against a beta version such as v1.14.0-beta.3
+- Removed `WorkloadIdentityCredentialOptions.EnableAzureProxy`.
+  It will return in v1.15.0-beta.1
+
+### Bugs Fixed
+
+- `AzureDeveloperCLICredential` improved reporting of error messages returned from `azd`
+
+### Other Changes
+
+- Returned `azidentity` errors include links to the troubleshooting guide when appropriate
+- This module now requires a minimum Go version of 1.25
+- Upgraded dependencies
+
+## 1.14.0-beta.3 (2026-02-10)
+
+### Breaking Changes
+
+> These changes affect only code written against a beta version such as v1.14.0-beta.2
+- Renamed `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `EnableAzureProxy`
+
+### Other Changes
+
+- Removed extraneous JSON from `AzureDeveloperCLICredential` errors
+
+## 1.14.0-beta.2 (2025-11-10)
+
+### Breaking Changes
+
+> These changes affect only code written against a beta version such as v1.13.0-beta.1
+- `WorkloadIdentityCredential` identity binding mode is disabled by default. To enable it, set
+  `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `true`
+- Removed identity binding mode support from `DefaultAzureCredential`. To use this feature, use
+  `WorkloadIdentityCredential` directly instead and set
+  `WorkloadIdentityCredentialOptions.EnableAzureTokenProxy` to `true`
+
+### Bugs Fixed
+
+- `AzureCLICredential` quoted arguments incorrectly on Windows
+
 ## 1.13.1 (2025-11-10)
 
 ### Bugs Fixed
 
 - `AzureCLICredential` quoted arguments incorrectly on Windows
 
+## 1.14.0-beta.1 (2025-10-07)
+
+### Features Added
+
+- Restored the `WorkloadIdentityCredential` identity binding mode support removed in v1.13.0
+
 ## 1.13.0 (2025-10-07)
 
 ### Features Added
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md
index 517006a42..c69664a84 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md
@@ -83,7 +83,7 @@ azlog.SetEvents(azidentity.EventAuthentication)
 
 | Error |Description| Mitigation |
 |---|---|---|
-|"DefaultAzureCredential failed to acquire a token"|No credential in the `DefaultAzureCredential` chain provided a token|<ul><li>[Enable logging](#enable-and-configure-logging) to get further diagnostic information.</li><li>Consult the troubleshooting guide for underlying credential types for more information.</li><ul><li>[EnvironmentCredential](#troubleshoot-environmentcredential-authentication-issues)</li><li>[ManagedIdentityCredential](#troubleshoot-managedidentitycredential-authentication-issues)</li><li>[AzureCLICredential](#troubleshoot-azureclicredential-authentication-issues)</li></ul>|
+|"DefaultAzureCredential failed to acquire a token"|No credential in the `DefaultAzureCredential` chain provided a token|<ul><li>[Enable logging](#enable-and-configure-logging) to get further diagnostic information.</li><li>Consult the troubleshooting guide for underlying credential types for more information.</li></ul><ul><li>[EnvironmentCredential](#troubleshoot-environmentcredential-authentication-issues)</li><li>[ManagedIdentityCredential](#troubleshoot-managedidentitycredential-authentication-issues)</li><li>[AzureCLICredential](#troubleshoot-azureclicredential-authentication-issues)</li></ul>|
 |Error from the client with a status code of 401 or 403|Authentication succeeded but the authorizing Azure service responded with a 401 (Unauthorized), or 403 (Forbidden) status code|<ul><li>[Enable logging](#enable-and-configure-logging) to determine which credential in the chain returned the authenticating token.</li><li>If an unexpected credential is returning a token, check application configuration such as environment variables.</li><li>Ensure the correct role is assigned to the authenticated identity. For example, a service specific role rather than the subscription Owner role.</li></ul>|
 |"managed identity timed out"|`DefaultAzureCredential` sets a short timeout on its first managed identity authentication attempt to prevent very long timeouts during local development when no managed identity is available. That timeout causes this error in production when an application requests a token before the hosting environment is ready to provide one.|Use [ManagedIdentityCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ManagedIdentityCredential) directly, at least in production. It doesn't set a timeout on its authentication attempts.|
 |invalid AZURE_TOKEN_CREDENTIALS value "..."|AZURE_TOKEN_CREDENTIALS has an unexpected value|Specify a valid value as described in [DefaultAzureCredential documentation](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#DefaultAzureCredential)
@@ -130,7 +130,7 @@ azlog.SetEvents(azidentity.EventAuthentication)
 |The requested identity hasn’t been assigned to this resource.|The IMDS endpoint responded with a status code of 400, indicating the requested identity isn’t assigned to the VM.|If using a user assigned identity, ensure the specified ID is correct.<p/><p/>If using a system assigned identity, make sure it has been enabled as described in [managed identity documentation](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-portal-windows-vm#enable-system-assigned-managed-identity-on-an-existing-vm).|
 |The request failed due to a gateway error.|The request to the IMDS endpoint failed due to a gateway error, 502 or 504 status code.|IMDS doesn't support requests via proxy or gateway. Disable proxies or gateways running on the VM for requests to the IMDS endpoint `http://169.254.169.254`|
 |No response received from the managed identity endpoint.|No response was received for the request to IMDS or the request timed out.|<ul><li>Ensure the VM is configured for managed identity as described in [managed identity documentation](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-portal-windows-vm).</li><li>Verify the IMDS endpoint is reachable on the VM. See [below](#verify-imds-is-available-on-the-vm) for instructions.</li></ul>|
-|Multiple attempts failed to obtain a token from the managed identity endpoint.|The credential has exhausted its retries for a token request.|<ul><li>Refer to the error message for more details on specific failures.<li>Ensure the VM is configured for managed identity as described in [managed identity documentation](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-portal-windows-vm).</li><li>Verify the IMDS endpoint is reachable on the VM. See [below](#verify-imds-is-available-on-the-vm) for instructions.</li></ul>|
+|Multiple attempts failed to obtain a token from the managed identity endpoint.|The credential has exhausted its retries for a token request.|<ul><li>Refer to the error message for more details on specific failures.</li><li>Ensure the VM is configured for managed identity as described in [managed identity documentation](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-portal-windows-vm).</li><li>Verify the IMDS endpoint is reachable on the VM. See [below](#verify-imds-is-available-on-the-vm) for instructions.</li></ul>|
 
 #### Verify IMDS is available on the VM
 
@@ -193,17 +193,26 @@ az account get-access-token --output json --resource https://management.core.win
 
 #### Verify the Azure Developer CLI can obtain tokens
 
-You can manually verify that the Azure Developer CLI is properly authenticated and can obtain tokens. First, use the `config` command to verify the account that is currently logged in to the Azure Developer CLI.
+You can manually verify that the Azure Developer CLI is properly authenticated and can obtain tokens. Execute the command corresponding to your CLI version to verify the account currently logged in.
 
-```sh
-azd config list
-```
+- In Azure Developer CLI versions >= 1.23.0:
+
+    ```sh
+    azd auth status
+    ```
+
+- In Azure Developer CLI versions < 1.23.0:
+
+    ```sh
+    azd config list
+    ```
 
 Once you've verified the Azure Developer CLI is using correct account, you can validate that it's able to obtain tokens for this account.
 
 ```sh
 azd auth token --output json --scope https://management.core.windows.net/.default
 ```
+
 >Note that output of this command will contain a valid access token, and SHOULD NOT BE SHARED to avoid compromising account security.
 
 <a id="azure-pwsh"></a>
@@ -239,7 +248,7 @@ Get-AzAccessToken -ResourceUrl "https://management.core.windows.net"
 
 | Error Message |Description| Mitigation |
 |---|---|---|
-|no client ID/tenant ID/token file specified|Incomplete configuration|In most cases these values are provided via environment variables set by Azure Workload Identity.<ul><li>If your application runs on Azure Kubernetes Service (AKS) or a cluster that has deployed the Azure Workload Identity admission webhook, check pod labels and service account configuration. See the [AKS documentation](https://learn.microsoft.com/azure/aks/workload-identity-deploy-cluster#disable-workload-identity) and [Azure Workload Identity troubleshooting guide](https://azure.github.io/azure-workload-identity/docs/troubleshooting.html) for more details.<li>If your application isn't running on AKS or your cluster hasn't deployed the Workload Identity admission webhook, set these values in `WorkloadIdentityCredentialOptions`
+|no client ID/tenant ID/token file specified|Incomplete configuration|In most cases these values are provided via environment variables set by Azure Workload Identity.<ul><li>If your application runs on Azure Kubernetes Service (AKS) or a cluster that has deployed the Azure Workload Identity admission webhook, check pod labels and service account configuration. See the [AKS documentation](https://learn.microsoft.com/azure/aks/workload-identity-deploy-cluster#disable-workload-identity) and [Azure Workload Identity troubleshooting guide](https://azure.github.io/azure-workload-identity/docs/troubleshooting.html) for more details.</li><li>If your application isn't running on AKS or your cluster hasn't deployed the Workload Identity admission webhook, set these values in `WorkloadIdentityCredentialOptions`</li></ul>
 
 <a id="apc"></a>
 ## Troubleshoot AzurePipelinesCredential authentication issues
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/authentication_record.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/authentication_record.go
index 840a71469..2b89963e6 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/authentication_record.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/authentication_record.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go
index bd196ddd3..e8699c46a 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -154,7 +151,7 @@ func validTenantID(tenantID string) bool {
 		return false
 	}
 	for _, r := range tenantID {
-		if !(alphanumeric(r) || r == '.' || r == '-') {
+		if !alphanumeric(r) && r != '.' && r != '-' {
 			return false
 		}
 	}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go
index 6944152c9..d34a255b3 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -57,7 +54,7 @@ func NewAzureCLICredential(options *AzureCLICredentialOptions) (*AzureCLICredent
 		cp = *options
 	}
 	for _, r := range cp.Subscription {
-		if !(alphanumeric(r) || r == '-' || r == '_' || r == ' ' || r == '.') {
+		if !alphanumeric(r) && r != '-' && r != '_' && r != ' ' && r != '.' {
 			return nil, fmt.Errorf(
 				"%s: Subscription %q contains invalid characters. If this is the name of a subscription, use its ID instead",
 				credNameAzureCLI,
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_developer_cli_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_developer_cli_credential.go
index f97bf95df..76e2d966c 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_developer_cli_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_developer_cli_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -115,8 +112,6 @@ func (c *AzureDeveloperCLICredential) GetToken(ctx context.Context, opts policy.
 				mfaRequired+". Run this command then retry the operation: "+commandNoClaims,
 				nil,
 			)
-		case strings.Contains(msg, "azd auth login"):
-			err = newCredentialUnavailableError(credNameAzureDeveloperCLI, `please run "azd auth login" from a command prompt to authenticate before using this credential`)
 		}
 		err = unavailableIfInDAC(err, c.opts.inDefaultChain)
 		return at, err
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_pipelines_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_pipelines_credential.go
index a4b8ab6f4..3e7f0082e 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_pipelines_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_pipelines_credential.go
@@ -89,7 +89,7 @@ func NewAzurePipelinesCredential(tenantID, clientID, serviceConnectionID, system
 		options = &AzurePipelinesCredentialOptions{}
 	}
 	// these headers are useful to the DevOps team when debugging OIDC error responses
-	options.ClientOptions.Logging.AllowedHeaders = append(options.ClientOptions.Logging.AllowedHeaders, xMsEdgeRef, xVssE2eId)
+	options.Logging.AllowedHeaders = append(options.Logging.AllowedHeaders, xMsEdgeRef, xVssE2eId)
 	caco := ClientAssertionCredentialOptions{
 		AdditionallyAllowedTenants: options.AdditionallyAllowedTenants,
 		Cache:                      options.Cache,
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go
index 82342a025..150305a70 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml
index 51dd97939..7e05ddcec 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml
@@ -29,13 +29,13 @@ extends:
           SubscriptionConfigurations:
             - $(sub-config-identity-test-resources)
       EnableRaceDetector: true
-      Location: westus2
-      RunLiveTests: true
+      Location: westus3
       ServiceDirectory: azidentity
       UsePipelineProxy: false
 
       ${{ if endsWith(variables['Build.DefinitionName'], 'weekly') }}:
         PersistOidcToken: true
+        RunLiveTests: true
         MatrixConfigs:
           - Name: managed_identity_matrix
             GenerateVMJobs: true
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go
index 2307da86f..6be7576be 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go
index 9e6bca1c9..45476f942 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go
index f0890fe1e..cd64d8e28 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/confidential_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/confidential_client.go
index 58c4b585c..6af3b4147 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/confidential_client.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/confidential_client.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -111,7 +108,7 @@ func (c *confidentialClient) GetToken(ctx context.Context, tro policy.TokenReque
 			authFailedErr  *AuthenticationFailedError
 			unavailableErr credentialUnavailable
 		)
-		if !(errors.As(err, &unavailableErr) || errors.As(err, &authFailedErr)) {
+		if !errors.As(err, &unavailableErr) && !errors.As(err, &authFailedErr) {
 			err = newAuthenticationFailedErrorFromMSAL(c.name, err)
 		}
 	} else {
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go
index aaaabc5c2..3751ba9c0 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/developer_credential_util.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/developer_credential_util.go
index cb7dbe2e4..e797baf85 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/developer_credential_util.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/developer_credential_util.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -9,6 +6,7 @@ package azidentity
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"os"
 	"os/exec"
@@ -45,12 +43,15 @@ var shellExec = func(ctx context.Context, credName, command string) ([]byte, err
 		return stdout, nil
 	}
 	if err != nil {
-		msg := stderr.String()
+		msg := strings.Trim(stderr.String(), "\r\n")
 		var exErr *exec.ExitError
 		if errors.As(err, &exErr) && exErr.ExitCode() == 127 || strings.Contains(msg, "' is not recognized") {
 			return nil, newCredentialUnavailableError(credName, "executable not found on path")
 		}
-		if credName == credNameAzurePowerShell {
+		switch credName {
+		case credNameAzureDeveloperCLI:
+			msg = extractAzdError(msg)
+		case credNameAzurePowerShell:
 			if strings.Contains(msg, "Connect-AzAccount") {
 				msg = `Please run "Connect-AzAccount" to set up an account`
 			}
@@ -80,9 +81,47 @@ func unavailableIfInDAC(err error, inDefaultChain bool) error {
 // validScope is for credentials authenticating via external tools. The authority validates scopes for all other credentials.
 func validScope(scope string) bool {
 	for _, r := range scope {
-		if !(alphanumeric(r) || r == '.' || r == '-' || r == '_' || r == '/' || r == ':') {
+		if !alphanumeric(r) && r != '.' && r != '-' && r != '_' && r != '/' && r != ':' {
 			return false
 		}
 	}
 	return true
 }
+
+// extractAzdError extracts a human-readable error message from azd's stderr JSON output.
+// azd writes JSON error messages to stderr. The format depends on the azd version:
+//   - v1.23.7+: {"error":"...","message":"...","suggestion":"..."} (may be preceded by an empty consoleMessage line)
+//   - pre-v1.23.7: {"type":"consoleMessage","data":{"message":"..."}}
+//
+// Prefer the structured "error" format, fall back to legacy consoleMessage.
+func extractAzdError(msg string) string {
+	lines := strings.Split(msg, "\n")
+	fallback := ""
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+
+		var errObj struct {
+			Error string `json:"error"`
+		}
+		if json.Unmarshal([]byte(line), &errObj) == nil && errObj.Error != "" {
+			return errObj.Error
+		}
+
+		if fallback == "" {
+			var obj struct {
+				Data struct {
+					Message string `json:"message"`
+				} `json:"data"`
+			}
+			if json.Unmarshal([]byte(line), &obj) == nil {
+				if m := strings.TrimSpace(obj.Data.Message); m != "" {
+					fallback = m
+				}
+			}
+		}
+	}
+	if fallback != "" {
+		return fallback
+	}
+	return msg
+}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go
index 53ae9767f..88e9215e6 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go
index f04d40ea4..3c59b5e73 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go
index 33cb63be0..9aa9b5b17 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -12,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
@@ -19,6 +17,19 @@ import (
 	msal "github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors"
 )
 
+// tsgAnchors maps credential type names to sections of the troubleshooting
+// guide at https://aka.ms/azsdk/go/identity/troubleshoot
+var tsgAnchors = map[string]string{
+	credNameAzureCLI:          "azure-cli",
+	credNameAzureDeveloperCLI: "azd",
+	credNameAzurePipelines:    "apc",
+	credNameAzurePowerShell:   "azure-pwsh",
+	credNameCert:              "client-cert",
+	credNameManagedIdentity:   "managed-id",
+	credNameSecret:            "client-secret",
+	credNameWorkloadIdentity:  "workload",
+}
+
 // getResponseFromError retrieves the response carried by
 // an AuthenticationFailedError or MSAL CallErr, if any
 func getResponseFromError(err error) *http.Response {
@@ -61,8 +72,19 @@ func newAuthenticationFailedErrorFromMSAL(credType string, err error) error {
 
 // Error implements the error interface. Note that the message contents are not contractual and can change over time.
 func (e *AuthenticationFailedError) Error() string {
+	link := ""
+	if anchor, ok := tsgAnchors[e.credType]; ok {
+		link = "To troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#" + anchor
+	}
 	if e.RawResponse == nil || e.omitResponse {
-		return e.credType + ": " + e.message
+		if link != "" {
+			prefix := " "
+			if !strings.HasSuffix(e.message, ".") {
+				prefix = ". "
+			}
+			link = prefix + link
+		}
+		return e.credType + ": " + e.message + link
 	}
 	msg := &bytes.Buffer{}
 	fmt.Fprintf(msg, "%s authentication failed. %s\n", e.credType, e.message)
@@ -88,29 +110,10 @@ func (e *AuthenticationFailedError) Error() string {
 	default:
 		fmt.Fprint(msg, "Response contained no body")
 	}
-	fmt.Fprintln(msg, "\n--------------------------------------------------------------------------------")
-	var anchor string
-	switch e.credType {
-	case credNameAzureCLI:
-		anchor = "azure-cli"
-	case credNameAzureDeveloperCLI:
-		anchor = "azd"
-	case credNameAzurePipelines:
-		anchor = "apc"
-	case credNameCert:
-		anchor = "client-cert"
-	case credNameAzurePowerShell:
-		anchor = "azure-pwsh"
-	case credNameSecret:
-		anchor = "client-secret"
-	case credNameManagedIdentity:
-		anchor = "managed-id"
-	case credNameWorkloadIdentity:
-		anchor = "workload"
-	}
-	if anchor != "" {
-		fmt.Fprintf(msg, "To troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#%s", anchor)
+	if link != "" {
+		link = "\n" + link
 	}
+	fmt.Fprint(msg, "\n--------------------------------------------------------------------------------"+link)
 	return msg.String()
 }
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/go.work b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/go.work
deleted file mode 100644
index 6dd5b3d64..000000000
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/go.work
+++ /dev/null
@@ -1,6 +0,0 @@
-go 1.23.0
-
-use (
-	.
-	./cache
-)
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go
index ec89de9b5..2d3eb8c08 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy/transport.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy/transport.go
new file mode 100644
index 000000000..6c0fc6244
--- /dev/null
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy/transport.go
@@ -0,0 +1,233 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package customtokenproxy
+
+import (
+	"bytes"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+)
+
+const (
+	AzureKubernetesCAData  = "AZURE_KUBERNETES_CA_DATA"
+	AzureKubernetesCAFile  = "AZURE_KUBERNETES_CA_FILE"
+	AzureKubernetesSNIName = "AZURE_KUBERNETES_SNI_NAME"
+
+	AzureKubernetesTokenProxy = "AZURE_KUBERNETES_TOKEN_PROXY"
+)
+
+func parseAndValidate(endpoint string) (*url.URL, error) {
+	tokenProxy, err := url.Parse(endpoint)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse custom token proxy URL %q: %s", endpoint, err)
+	}
+	if tokenProxy.Scheme != "https" {
+		return nil, fmt.Errorf("custom token endpoint must use https scheme, got %q", tokenProxy.Scheme)
+	}
+	if tokenProxy.User != nil {
+		return nil, fmt.Errorf("custom token endpoint URL %q must not contain user info", tokenProxy)
+	}
+	if tokenProxy.RawQuery != "" {
+		return nil, fmt.Errorf("custom token endpoint URL %q must not contain a query", tokenProxy)
+	}
+	if tokenProxy.EscapedFragment() != "" {
+		return nil, fmt.Errorf("custom token endpoint URL %q must not contain a fragment", tokenProxy)
+	}
+	if tokenProxy.EscapedPath() == "" {
+		// if the path is empty, set it to "/" to avoid stripping the path from req.URL
+		tokenProxy.Path = "/"
+	}
+	return tokenProxy, nil
+}
+
+var (
+	errCustomEndpointEnvSetWithoutTokenProxy = errors.New(
+		"AZURE_KUBERNETES_TOKEN_PROXY is not set but other custom endpoint-related environment variables are present",
+	)
+	errCustomEndpointMultipleCASourcesSet = errors.New(
+		"only one of AZURE_KUBERNETES_CA_FILE and AZURE_KUBERNETES_CA_DATA can be specified",
+	)
+)
+
+func createTransport(sniName string, caPool *x509.CertPool) *http.Transport {
+	var transport *http.Transport
+	if tr, ok := http.DefaultTransport.(*http.Transport); ok {
+		transport = tr.Clone()
+	} else {
+		// this should not happen, but if the user mutates the net/http.DefaultTransport
+		// to something else, we fall back to a sane default
+		transport = &http.Transport{
+			ForceAttemptHTTP2:   true,
+			MaxIdleConns:        100,
+			IdleConnTimeout:     90 * time.Second,
+			TLSHandshakeTimeout: 10 * time.Second,
+		}
+	}
+
+	if transport.TLSClientConfig == nil {
+		transport.TLSClientConfig = &tls.Config{}
+	}
+	transport.TLSClientConfig.ServerName = sniName
+	transport.TLSClientConfig.RootCAs = caPool
+
+	return transport
+}
+
+// Configure configures custom token endpoint mode if the required environment variables are present.
+func Configure(clientOptions *policy.ClientOptions) error {
+	kubernetesTokenProxyStr := os.Getenv(AzureKubernetesTokenProxy)
+
+	kubernetesSNIName := os.Getenv(AzureKubernetesSNIName)
+	kubernetesCAFile := os.Getenv(AzureKubernetesCAFile)
+	kubernetesCAData := os.Getenv(AzureKubernetesCAData)
+
+	if kubernetesTokenProxyStr == "" {
+		// custom token proxy is not set, while other Kubernetes-related environment variables are present,
+		// this is likely a configuration issue so erroring out to avoid misconfiguration
+		if kubernetesSNIName != "" || kubernetesCAFile != "" || kubernetesCAData != "" {
+			return errCustomEndpointEnvSetWithoutTokenProxy
+		}
+
+		return nil
+	}
+	tokenProxy, err := parseAndValidate(kubernetesTokenProxyStr)
+	if err != nil {
+		return err
+	}
+
+	// CAFile and CAData are mutually exclusive, at most one can be set.
+	// If none of CAFile or CAData are set, the default system CA pool will be used.
+	if kubernetesCAFile != "" && kubernetesCAData != "" {
+		return errCustomEndpointMultipleCASourcesSet
+	}
+
+	// preload the transport
+	t := &transport{
+		caFile:     kubernetesCAFile,
+		caData:     []byte(kubernetesCAData),
+		sniName:    kubernetesSNIName,
+		tokenProxy: tokenProxy,
+	}
+	if _, err := t.getTokenTransporter(); err != nil {
+		return err
+	}
+
+	clientOptions.Transport = t
+	return nil
+}
+
+// transport redirects requests to the configured proxy.
+//
+// Lock is not needed for internal caData as this transport is called under confidentialClient's lock.
+type transport struct {
+	caFile     string
+	caData     []byte
+	sniName    string
+	tokenProxy *url.URL
+	transport  *http.Transport
+}
+
+func (t *transport) Do(req *http.Request) (*http.Response, error) {
+	tr, err := t.getTokenTransporter()
+	if err != nil {
+		return nil, err
+	}
+
+	rewriteProxyRequestURL(req, t.tokenProxy)
+
+	resp, err := tr.RoundTrip(req)
+	if err == nil && resp == nil {
+		// transports must handle this rare case.
+		// Returning an error makes the retry policy try the request again
+		err = errors.New("received nil response")
+	}
+	return resp, err
+}
+
+// getTokenTransporter provides the token transport to use for the request.
+//
+// There are a few scenarios need to be handled:
+//  1. no CA overrides, use default transport. The transport is fixed after set.
+//  2. CA data override provided, use a transport with custom CA pool.
+//     This transport is fixed after set.
+//  3. CA file override is provided, use a transport with custom CA pool.
+//     This transport needs to be recreated if the CA file content changes.
+func (t *transport) getTokenTransporter() (*http.Transport, error) {
+	if len(t.caData) == 0 && t.caFile == "" {
+		// no custom CA overrides
+		if t.transport == nil {
+			t.transport = createTransport(t.sniName, nil)
+		}
+		return t.transport, nil
+	}
+
+	if t.caFile == "" {
+		// host provided CA bytes in AZURE_KUBERNETES_CA_DATA and can't change
+		// them now, so we need to create a client only if we haven't done so yet
+		if t.transport != nil {
+			return t.transport, nil
+		}
+
+		caPool := x509.NewCertPool()
+		if !caPool.AppendCertsFromPEM([]byte(t.caData)) {
+			return nil, fmt.Errorf("parse CA data: no valid certificates found")
+		}
+
+		t.transport = createTransport(t.sniName, caPool)
+		return t.transport, nil
+	}
+
+	// host provided the CA bytes in a file whose contents it can change,
+	// so we must read that file and maybe create a new client
+	b, err := os.ReadFile(t.caFile)
+	if err != nil {
+		return nil, fmt.Errorf("read CA file %q: %s", t.caFile, err)
+	}
+	if len(b) == 0 {
+		// this can happen during the middle of CA rotation on the host.
+		if t.transport == nil {
+			// if the transport was never created, error out here to force retrying the call later
+			return nil, fmt.Errorf("CA file %q is empty", t.caFile)
+		}
+		// if the transport was already created, just keep using it
+		return t.transport, nil
+	}
+	if !bytes.Equal(b, t.caData) {
+		// CA has changed, rebuild the transport with new CA pool
+		// invariant: t.transport is nil when t.caData is nil (initial call)
+		caPool := x509.NewCertPool()
+		if !caPool.AppendCertsFromPEM([]byte(b)) {
+			return nil, fmt.Errorf("parse CA file %q: no valid certificates found", t.caFile)
+		}
+		if t.transport != nil {
+			t.transport.CloseIdleConnections()
+		}
+		t.transport = createTransport(t.sniName, caPool)
+		t.caData = b
+	}
+
+	return t.transport, nil
+}
+
+// rewriteProxyRequestURL updates the request URL to target the specified URL.
+// Target is the token proxy URL in custom token endpoint mode.
+//
+// proxyURL should be parsed and validated by parseAndValidate before calling.
+func rewriteProxyRequestURL(req *http.Request, proxyURL *url.URL) {
+	reqRawQuery := req.URL.RawQuery
+	// preserve the original path and append it to the proxy URL's path.
+	// proxyURL path is guaranteed to be non-empty.
+	req.URL = proxyURL.JoinPath(req.URL.EscapedPath())
+	// NOTE: proxyURL doesn't include query, req might include query
+	// we just retain the raw query from req.URL
+	req.URL.RawQuery = reqRawQuery
+}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go
index 1aa1e0fc7..1f67f7b3f 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go
index 0735d1fcb..02f02fec4 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -32,9 +29,7 @@ const (
 	imdsEndpoint             = "http://169.254.169.254/metadata/identity/oauth2/token"
 	miResID                  = "mi_res_id"
 	msiEndpoint              = "MSI_ENDPOINT"
-	msiResID                 = "msi_res_id"
 	msiSecret                = "MSI_SECRET"
-	imdsAPIVersion           = "2018-02-01"
 	azureArcAPIVersion       = "2020-06-01"
 	qpClientID               = "client_id"
 	serviceFabricAPIVersion  = "2019-07-01-preview"
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go
index 11b686ccd..d0a5ecf97 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/on_behalf_of_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/on_behalf_of_credential.go
index 9dcc82f01..aa7f9b7d7 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/on_behalf_of_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/on_behalf_of_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/public_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/public_client.go
index 053d1785f..48cc4f39f 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/public_client.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/public_client.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
index 5791e7d22..86054e3f8 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go
index 041f11658..f45f59697 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -14,5 +11,5 @@ const (
 	module = "github.com/Azure/azure-sdk-for-go/sdk/" + component
 
 	// Version is the semantic version (see http://semver.org) of this module.
-	version = "v1.13.1"
+	version = "v1.14.0"
 )
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go
index 6fecada2f..87399aed3 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go
@@ -1,6 +1,3 @@
-//go:build go1.18
-// +build go1.18
-
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
@@ -16,6 +13,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy"
 )
 
 const credNameWorkloadIdentity = "WorkloadIdentityCredential"
@@ -54,6 +52,15 @@ type WorkloadIdentityCredentialOptions struct {
 	// the application responsible for ensuring the configured authority is valid and trustworthy.
 	DisableInstanceDiscovery bool
 
+	// enableAzureProxy determines whether the credential reads proxy configuration from environment variables. When
+	// this value is true and proxy configuration isn't present or this value is false, the credential will request
+	// tokens directly from Entra ID.
+	//
+	// The proxy feature is designed for applications that deploy to many clusters and clusters that host many
+	// applications. See the Azure Kubernetes Service identity bindings documentation for more information on when
+	// to set this option: https://learn.microsoft.com/azure/aks/identity-bindings-concepts
+	enableAzureProxy bool
+
 	// TenantID of the service principal. Defaults to the value of the environment variable AZURE_TENANT_ID.
 	TenantID string
 
@@ -87,14 +94,22 @@ func NewWorkloadIdentityCredential(options *WorkloadIdentityCredentialOptions) (
 			return nil, errors.New("no tenant ID specified. Check pod configuration or set TenantID in the options")
 		}
 	}
+
 	w := WorkloadIdentityCredential{file: file, mtx: &sync.RWMutex{}}
-	caco := ClientAssertionCredentialOptions{
+	caco := &ClientAssertionCredentialOptions{
 		AdditionallyAllowedTenants: options.AdditionallyAllowedTenants,
 		Cache:                      options.Cache,
 		ClientOptions:              options.ClientOptions,
 		DisableInstanceDiscovery:   options.DisableInstanceDiscovery,
 	}
-	cred, err := NewClientAssertionCredential(tenantID, clientID, w.getAssertion, &caco)
+
+	if options.enableAzureProxy {
+		if err := customtokenproxy.Configure(&caco.ClientOptions); err != nil {
+			return nil, err
+		}
+	}
+
+	cred, err := NewClientAssertionCredential(tenantID, clientID, w.getAssertion, caco)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go
index 29c004320..1b3e599b1 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go
@@ -359,7 +359,7 @@ func New(authority, clientID string, cred Credential, options ...Option) (Client
 
 // authCodeURLOptions contains options for AuthCodeURL
 type authCodeURLOptions struct {
-	claims, loginHint, tenantID, domainHint string
+	claims, loginHint, tenantID, domainHint, prompt string
 }
 
 // AuthCodeURLOption is implemented by options for AuthCodeURL
@@ -369,7 +369,7 @@ type AuthCodeURLOption interface {
 
 // AuthCodeURL creates a URL used to acquire an authorization code. Users need to call CreateAuthorizationCodeURLParameters and pass it in.
 //
-// Options: [WithClaims], [WithDomainHint], [WithLoginHint], [WithTenantID]
+// Options: [WithClaims], [WithDomainHint], [WithLoginHint], [WithTenantID], [WithPrompt]
 func (cca Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string, scopes []string, opts ...AuthCodeURLOption) (string, error) {
 	o := authCodeURLOptions{}
 	if err := options.ApplyOptions(&o, opts); err != nil {
@@ -382,6 +382,7 @@ func (cca Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string,
 	ap.Claims = o.claims
 	ap.LoginHint = o.loginHint
 	ap.DomainHint = o.domainHint
+	ap.Prompt = o.prompt
 	return cca.base.AuthCodeURL(ctx, clientID, redirectURI, scopes, ap)
 }
 
@@ -431,6 +432,29 @@ func WithDomainHint(domain string) interface {
 	}
 }
 
+// WithPrompt adds prompt query parameter in the auth url.
+func WithPrompt(prompt shared.Prompt) interface {
+	AuthCodeURLOption
+	options.CallOption
+} {
+	return struct {
+		AuthCodeURLOption
+		options.CallOption
+	}{
+		CallOption: options.NewCallOption(
+			func(a any) error {
+				switch t := a.(type) {
+				case *authCodeURLOptions:
+					t.prompt = prompt.String()
+				default:
+					return fmt.Errorf("unexpected options type %T", a)
+				}
+				return nil
+			},
+		),
+	}
+}
+
 // WithClaims sets additional claims to request for the token, such as those required by conditional access policies.
 // Use this option when Azure AD returned a claims challenge for a prior request. The argument must be decoded.
 // This option is valid for any token acquisition method.
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go
index abf54f7e5..9bd96090e 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go
@@ -302,13 +302,10 @@ func (b Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string, s
 	if authParams.DomainHint != "" {
 		v.Add("domain_hint", authParams.DomainHint)
 	}
-	// There were left over from an implementation that didn't use any of these.  We may
-	// need to add them later, but as of now aren't needed.
-	/*
-		if p.ResponseMode != "" {
-			urlParams.Add("response_mode", p.ResponseMode)
-		}
-	*/
+	// Use form_post response mode for interactive auth to avoid exposing the auth code in the URL
+	if authParams.AuthorizationType == authority.ATInteractive {
+		v.Add("response_mode", "form_post")
+	}
 	baseURL.RawQuery = v.Encode()
 	return baseURL.String(), nil
 }
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go
index ff07d4b5a..5d018e117 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/partitioned_storage.go
@@ -200,7 +200,16 @@ func (m *PartitionedManager) aadMetadataFromCache(ctx context.Context, authority
 func (m *PartitionedManager) aadMetadata(ctx context.Context, authorityInfo authority.Info) (authority.InstanceDiscoveryMetadata, error) {
 	discoveryResponse, err := m.requests.AADInstanceDiscovery(ctx, authorityInfo)
 	if err != nil {
-		return authority.InstanceDiscoveryMetadata{}, err
+		// If it's an invalid_instance error, always propagate
+		if strings.Contains(err.Error(), "invalid_instance") {
+			return authority.InstanceDiscoveryMetadata{}, err
+		}
+		// If the caller canceled the context, propagate
+		if ctx.Err() != nil {
+			return authority.InstanceDiscoveryMetadata{}, err
+		}
+		// For transient errors (network failures, HTTP 500, etc.), cache a fallback entry
+		return m.fallbackMetadata(authorityInfo.Host), nil
 	}
 
 	m.aadCacheMu.Lock()
@@ -220,6 +229,27 @@ func (m *PartitionedManager) aadMetadata(ctx context.Context, authorityInfo auth
 	return m.aadCache[authorityInfo.Host], nil
 }
 
+// fallbackMetadata returns a cached fallback metadata entry for the given host.
+// It first checks the known metadata provider for pre-baked alias data, then
+// falls back to a self-entry. Acquires aadCacheMu.
+func (m *PartitionedManager) fallbackMetadata(host string) authority.InstanceDiscoveryMetadata {
+	m.aadCacheMu.Lock()
+	defer m.aadCacheMu.Unlock()
+	if known, ok := authority.GetKnownMetadata(host); ok {
+		for _, alias := range known.Aliases {
+			m.aadCache[alias] = known
+		}
+		return known
+	}
+	fallback := authority.InstanceDiscoveryMetadata{
+		PreferredNetwork: host,
+		PreferredCache:   host,
+		Aliases:          []string{host},
+	}
+	m.aadCache[host] = fallback
+	return fallback
+}
+
 func (m *PartitionedManager) readAccessToken(envAliases []string, realm, clientID, userAssertionHash string, scopes []string, partitionKey, tokenType, authnSchemeKeyID string) (AccessToken, error) {
 	m.contractMu.RLock()
 	defer m.contractMu.RUnlock()
@@ -306,7 +336,7 @@ func (m *PartitionedManager) writeRefreshToken(refreshToken accesstokens.Refresh
 	m.contractMu.Lock()
 	defer m.contractMu.Unlock()
 	key := refreshToken.Key()
-	if m.contract.AccessTokensPartition[partitionKey] == nil {
+	if m.contract.RefreshTokensPartition[partitionKey] == nil {
 		m.contract.RefreshTokensPartition[partitionKey] = make(map[string]accesstokens.RefreshToken)
 	}
 	m.contract.RefreshTokensPartition[partitionKey][key] = refreshToken
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/storage.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/storage.go
index 825d8a0f6..8225e860a 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/storage.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/storage/storage.go
@@ -276,7 +276,16 @@ func (m *Manager) aadMetadata(ctx context.Context, authorityInfo authority.Info)
 	defer m.aadCacheMu.Unlock()
 	discoveryResponse, err := m.requests.AADInstanceDiscovery(ctx, authorityInfo)
 	if err != nil {
-		return authority.InstanceDiscoveryMetadata{}, err
+		// If it's an invalid_instance error, always propagate
+		if strings.Contains(err.Error(), "invalid_instance") {
+			return authority.InstanceDiscoveryMetadata{}, err
+		}
+		// If the caller canceled the context, propagate
+		if ctx.Err() != nil {
+			return authority.InstanceDiscoveryMetadata{}, err
+		}
+		// For transient errors (network failures, HTTP 500, etc.), cache a fallback entry
+		return m.fallbackMetadata(authorityInfo.Host), nil
 	}
 
 	for _, metadataEntry := range discoveryResponse.Metadata {
@@ -293,6 +302,25 @@ func (m *Manager) aadMetadata(ctx context.Context, authorityInfo authority.Info)
 	return m.aadCache[authorityInfo.Host], nil
 }
 
+// fallbackMetadata returns a cached fallback metadata entry for the given host.
+// It first checks the known metadata provider for pre-baked alias data, then
+// falls back to a self-entry. The caller must hold m.aadCacheMu.
+func (m *Manager) fallbackMetadata(host string) authority.InstanceDiscoveryMetadata {
+	if known, ok := authority.GetKnownMetadata(host); ok {
+		for _, alias := range known.Aliases {
+			m.aadCache[alias] = known
+		}
+		return known
+	}
+	fallback := authority.InstanceDiscoveryMetadata{
+		PreferredNetwork: host,
+		PreferredCache:   host,
+		Aliases:          []string{host},
+	}
+	m.aadCache[host] = fallback
+	return fallback
+}
+
 func (m *Manager) readAccessToken(homeID string, envAliases []string, realm, clientID string, scopes []string, tokenType, authnSchemeKeyID, extCacheKey string) AccessToken {
 	m.contractMu.RLock()
 
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go
index c6baf2094..1fb012fea 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go
@@ -24,6 +24,7 @@ var okPage = []byte(`
 </head>
 <body>
     <p>Authentication complete. You can return to the application. Feel free to close this browser tab.</p>
+    <p><strong>For your security:</strong> Do not share the contents of this page, the address bar, or take screenshots.</p>
 </body>
 </html>
 `)
@@ -42,6 +43,20 @@ const failPage = `
 </html>
 `
 
+const unsupportedResponseModePage = `
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8" />
+    <title>Authentication Failed</title>
+</head>
+<body>
+    <p>Authentication failed. The response was received via a GET operation, which is not supported.</p>
+    <p>You can return to the application. Feel free to close this browser tab.</p>
+</body>
+</html>
+`
+
 // Result is the result from the redirect.
 type Result struct {
 	// Code is the code sent by the authority server.
@@ -138,11 +153,24 @@ func (s *Server) putResult(r Result) {
 }
 
 func (s *Server) handler(w http.ResponseWriter, r *http.Request) {
-	q := r.URL.Query()
+	// Only accept POST requests (form_post response mode)
+	// GET requests with query parameters are not supported for security reasons
+	if r.Method != http.MethodPost {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		_, _ = w.Write([]byte(unsupportedResponseModePage))
+		s.putResult(Result{Err: fmt.Errorf("response was received via a GET operation, which is not supported")})
+		return
+	}
+
+	// For form_post response mode, parameters come in the POST body
+	if err := r.ParseForm(); err != nil {
+		s.error(w, http.StatusBadRequest, "failed to parse form data: %v", err)
+		return
+	}
 
-	headerErr := q.Get("error")
+	headerErr := r.PostFormValue("error")
 	if headerErr != "" {
-		desc := html.EscapeString(q.Get("error_description"))
+		desc := html.EscapeString(r.PostFormValue("error_description"))
 		escapedHeaderErr := html.EscapeString(headerErr)
 		// Note: It is a little weird we handle some errors by not going to the failPage. If they all should,
 		// change this to s.error() and make s.error() write the failPage instead of an error code.
@@ -152,7 +180,7 @@ func (s *Server) handler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	respState := q.Get("state")
+	respState := r.PostFormValue("state")
 	switch respState {
 	case s.reqState:
 	case "":
@@ -163,9 +191,9 @@ func (s *Server) handler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	code := q.Get("code")
+	code := r.PostFormValue("code")
 	if code == "" {
-		s.error(w, http.StatusInternalServerError, "authorization code missing in query string")
+		s.error(w, http.StatusInternalServerError, "authorization code missing in response")
 		return
 	}
 
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go
index debd465db..db6f8b42e 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go
@@ -20,6 +20,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+
+	msalerrors "github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors"
 )
 
 const (
@@ -61,6 +63,9 @@ var aadTrustedHostList = map[string]bool{
 	"login.microsoft.com":              true,
 	"sts.windows.net":                  true,
 	"login.usgovcloudapi.net":          true,
+	"login.sovcloud-identity.fr":       true, // Bleu (France sovereign cloud)
+	"login.sovcloud-identity.de":       true, // Delos (Germany sovereign cloud)
+	"login.sovcloud-identity.sg":       true, // GovSG (Singapore sovereign cloud)
 }
 
 // TrustedHost checks if an AAD host is trusted/valid.
@@ -607,6 +612,14 @@ func (c Client) AADInstanceDiscovery(ctx context.Context, authorityInfo Info) (I
 
 		endpoint := fmt.Sprintf(aadInstanceDiscoveryEndpoint, discoveryHost)
 		err = c.Comm.JSONCall(ctx, endpoint, http.Header{}, qv, nil, &resp)
+		if err != nil {
+			var callErr msalerrors.CallErr
+			if errors.As(err, &callErr) && callErr.Resp != nil && callErr.Resp.StatusCode == http.StatusBadRequest {
+				if strings.Contains(callErr.Err.Error(), "invalid_instance") {
+					return resp, fmt.Errorf("invalid_instance: the authority host is not valid: %w", err)
+				}
+			}
+		}
 	}
 	return resp, err
 }
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/known_metadata.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/known_metadata.go
new file mode 100644
index 000000000..70e83bd71
--- /dev/null
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/known_metadata.go
@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+package authority
+
+// GetKnownMetadata returns the known instance discovery metadata for the given
+// host, if any. Each call returns a fresh struct with its own Aliases slice,
+// so callers may freely modify the result without affecting future calls.
+func GetKnownMetadata(host string) (InstanceDiscoveryMetadata, bool) {
+	switch host {
+	// Public Cloud
+	case "login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.microsoftonline.com",
+			PreferredCache:   "login.windows.net",
+			Aliases:          []string{"login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"},
+		}, true
+	// China Cloud
+	case "login.partner.microsoftonline.cn", "login.chinacloudapi.cn":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.partner.microsoftonline.cn",
+			PreferredCache:   "login.partner.microsoftonline.cn",
+			Aliases:          []string{"login.partner.microsoftonline.cn", "login.chinacloudapi.cn"},
+		}, true
+	// Germany Cloud (legacy)
+	case "login.microsoftonline.de":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.microsoftonline.de",
+			PreferredCache:   "login.microsoftonline.de",
+			Aliases:          []string{"login.microsoftonline.de"},
+		}, true
+	// US Government Cloud
+	case "login.microsoftonline.us", "login.usgovcloudapi.net":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.microsoftonline.us",
+			PreferredCache:   "login.microsoftonline.us",
+			Aliases:          []string{"login.microsoftonline.us", "login.usgovcloudapi.net"},
+		}, true
+	// US Regional
+	case "login-us.microsoftonline.com":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login-us.microsoftonline.com",
+			PreferredCache:   "login-us.microsoftonline.com",
+			Aliases:          []string{"login-us.microsoftonline.com"},
+		}, true
+	// Bleu (France sovereign cloud)
+	case "login.sovcloud-identity.fr":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.sovcloud-identity.fr",
+			PreferredCache:   "login.sovcloud-identity.fr",
+			Aliases:          []string{"login.sovcloud-identity.fr"},
+		}, true
+	// Delos (Germany sovereign cloud)
+	case "login.sovcloud-identity.de":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.sovcloud-identity.de",
+			PreferredCache:   "login.sovcloud-identity.de",
+			Aliases:          []string{"login.sovcloud-identity.de"},
+		}, true
+	// GovSG (Singapore sovereign cloud)
+	case "login.sovcloud-identity.sg":
+		return InstanceDiscoveryMetadata{
+			PreferredNetwork: "login.sovcloud-identity.sg",
+			PreferredCache:   "login.sovcloud-identity.sg",
+			Aliases:          []string{"login.sovcloud-identity.sg"},
+		}, true
+	default:
+		return InstanceDiscoveryMetadata{}, false
+	}
+}
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go
index 790680366..87e38798a 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go
@@ -35,7 +35,7 @@ type HTTPClient interface {
 	CloseIdleConnections()
 }
 
-// Client provides a wrapper to our *http.Client that handles compression and serialization needs.
+// Client provides a wrapper to our *http.Client that handles serialization needs.
 type Client struct {
 	client HTTPClient
 }
@@ -50,9 +50,9 @@ func New(httpClient HTTPClient) *Client {
 }
 
 // JSONCall connects to the REST endpoint passing the HTTP query values, headers and JSON conversion
-// of body in the HTTP body. It automatically handles compression and decompression with gzip. The response is JSON
-// unmarshalled into resp. resp must be a pointer to a struct. If the body struct contains a field called
-// "AdditionalFields" we use a custom marshal/unmarshal engine.
+// of body in the HTTP body. The response is JSON unmarshalled into resp. resp must be a pointer to
+// a struct. If the body struct contains a field called "AdditionalFields" we use a custom
+// marshal/unmarshal engine.
 func (c *Client) JSONCall(ctx context.Context, endpoint string, headers http.Header, qv url.Values, body, resp interface{}) error {
 	if qv == nil {
 		qv = url.Values{}
@@ -284,25 +284,17 @@ func (c *Client) checkResp(v reflect.Value) error {
 	return nil
 }
 
-// readBody reads the body out of an *http.Response. It supports gzip encoded responses.
+// readBody reads the body out of an *http.Response. Any Content-Encoding negotiated by the
+// underlying http.Transport (typically gzip) is transparently decoded by the standard library
+// before we get here.
 func (c *Client) readBody(resp *http.Response) ([]byte, error) {
-	var reader io.Reader = resp.Body
-	switch resp.Header.Get("Content-Encoding") {
-	case "":
-		// Do nothing
-	case "gzip":
-		reader = gzipDecompress(resp.Body)
-	default:
-		return nil, fmt.Errorf("bug: comm.Client.JSONCall(): content was send with unsupported content-encoding %s", resp.Header.Get("Content-Encoding"))
-	}
-	return io.ReadAll(reader)
+	return io.ReadAll(resp.Body)
 }
 
 var testID string
 
 // addStdHeaders adds the standard headers we use on all calls.
 func addStdHeaders(headers http.Header) http.Header {
-	headers.Set("Accept-Encoding", "gzip")
 	// So that I can have a static id for tests.
 	if testID != "" {
 		headers.Set("client-request-id", testID)
@@ -311,7 +303,7 @@ func addStdHeaders(headers http.Header) http.Header {
 		headers.Set("client-request-id", uuid.New().String())
 		headers.Set("Return-Client-Request-Id", "false")
 	}
-	headers.Set("x-client-sku", "MSAL.Go")
+	headers.Set("x-client-sku", version.SKU)
 	headers.Set("x-client-os", runtime.GOOS)
 	headers.Set("x-client-cpu", runtime.GOARCH)
 	headers.Set("x-client-ver", version.Version)
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/compress.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/compress.go
deleted file mode 100644
index 4d3dbfcf0..000000000
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/compress.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT license.
-
-package comm
-
-import (
-	"compress/gzip"
-	"io"
-)
-
-func gzipDecompress(r io.Reader) io.Reader {
-	gzipReader, _ := gzip.NewReader(r)
-
-	pipeOut, pipeIn := io.Pipe()
-	go func() {
-		// decompression bomb would have to come from Azure services.
-		// If we want to limit, we should do that in comm.do().
-		_, err := io.Copy(pipeIn, gzipReader) //nolint
-		if err != nil {
-			// don't need the error.
-			pipeIn.CloseWithError(err) //nolint
-			gzipReader.Close()
-			return
-		}
-		if err := gzipReader.Close(); err != nil {
-			// don't need the error.
-			pipeIn.CloseWithError(err) //nolint
-			return
-		}
-		pipeIn.Close()
-	}()
-	return pipeOut
-}
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/shared/shared.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/shared/shared.go
index d8ab71356..77376d6ff 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/shared/shared.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/shared/shared.go
@@ -70,3 +70,29 @@ func (acc Account) IsZero() bool {
 
 // DefaultClient is our default shared HTTP client.
 var DefaultClient = &http.Client{}
+
+type Prompt int64
+
+const (
+	PromptNone Prompt = iota
+	PromptLogin
+	PromptSelectAccount
+	PromptConsent
+	PromptCreate
+)
+
+func (p Prompt) String() string {
+	switch p {
+	case PromptNone:
+		return "none"
+	case PromptLogin:
+		return "login"
+	case PromptSelectAccount:
+		return "select_account"
+	case PromptConsent:
+		return "consent"
+	case PromptCreate:
+		return "create"
+	}
+	return ""
+}
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go
index 5e551abc8..40da7d5d1 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go
@@ -4,5 +4,8 @@
 // Package version keeps the version number of the client package.
 package version
 
+// SKU is the product name of this SDK communicated to the server.
+const SKU = "MSAL.Go"
+
 // Version is the version of this client package that is communicated to the server.
-const Version = "1.4.2"
+const Version = "1.7.2"
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go
index ca3de4325..ecb0fbeca 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go
@@ -30,6 +30,8 @@ import (
 	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens"
 	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority"
 	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/shared"
+	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version"
+	"github.com/google/uuid"
 )
 
 // AuthResult contains the results of one token acquisition operation.
@@ -621,6 +623,9 @@ func createIMDSAuthRequest(ctx context.Context, id ID, resource string) (*http.R
 		return nil, fmt.Errorf("error creating http request %s", err)
 	}
 	req.Header.Set(metaHTTPHeaderName, "true")
+	req.Header.Set("x-client-SKU", version.SKU)
+	req.Header.Set("x-client-Ver", version.Version)
+	req.Header.Set("x-ms-client-request-id", uuid.New().String())
 	return req, nil
 }
 
diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go
index 797c086cb..97c615452 100644
--- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go
+++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go
@@ -149,7 +149,7 @@ func New(clientID string, options ...Option) (Client, error) {
 
 // authCodeURLOptions contains options for AuthCodeURL
 type authCodeURLOptions struct {
-	claims, loginHint, tenantID, domainHint string
+	claims, loginHint, tenantID, domainHint, prompt string
 }
 
 // AuthCodeURLOption is implemented by options for AuthCodeURL
@@ -159,7 +159,7 @@ type AuthCodeURLOption interface {
 
 // AuthCodeURL creates a URL used to acquire an authorization code.
 //
-// Options: [WithClaims], [WithDomainHint], [WithLoginHint], [WithTenantID]
+// Options: [WithClaims], [WithDomainHint], [WithLoginHint], [WithTenantID], [WithPrompt]
 func (pca Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string, scopes []string, opts ...AuthCodeURLOption) (string, error) {
 	o := authCodeURLOptions{}
 	if err := options.ApplyOptions(&o, opts); err != nil {
@@ -172,6 +172,7 @@ func (pca Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string,
 	ap.Claims = o.claims
 	ap.LoginHint = o.loginHint
 	ap.DomainHint = o.domainHint
+	ap.Prompt = o.prompt
 	return pca.base.AuthCodeURL(ctx, clientID, redirectURI, scopes, ap)
 }
 
@@ -526,9 +527,9 @@ func (pca Client) RemoveAccount(ctx context.Context, account Account) error {
 
 // interactiveAuthOptions contains the optional parameters used to acquire an access token for interactive auth code flow.
 type interactiveAuthOptions struct {
-	claims, domainHint, loginHint, redirectURI, tenantID string
-	openURL                                              func(url string) error
-	authnScheme                                          AuthenticationScheme
+	claims, domainHint, loginHint, redirectURI, tenantID, prompt string
+	openURL                                                      func(url string) error
+	authnScheme                                                  AuthenticationScheme
 }
 
 // AcquireInteractiveOption is implemented by options for AcquireTokenInteractive
@@ -590,6 +591,33 @@ func WithDomainHint(domain string) interface {
 	}
 }
 
+// WithPrompt adds the IdP prompt query parameter in the auth url.
+func WithPrompt(prompt shared.Prompt) interface {
+	AcquireInteractiveOption
+	AuthCodeURLOption
+	options.CallOption
+} {
+	return struct {
+		AcquireInteractiveOption
+		AuthCodeURLOption
+		options.CallOption
+	}{
+		CallOption: options.NewCallOption(
+			func(a any) error {
+				switch t := a.(type) {
+				case *authCodeURLOptions:
+					t.prompt = prompt.String()
+				case *interactiveAuthOptions:
+					t.prompt = prompt.String()
+				default:
+					return fmt.Errorf("unexpected options type %T", a)
+				}
+				return nil
+			},
+		),
+	}
+}
+
 // WithRedirectURI sets a port for the local server used in interactive authentication, for
 // example http://localhost:port. All URI components other than the port are ignored.
 func WithRedirectURI(redirectURI string) interface {
@@ -674,7 +702,11 @@ func (pca Client) AcquireTokenInteractive(ctx context.Context, scopes []string,
 	authParams.LoginHint = o.loginHint
 	authParams.DomainHint = o.domainHint
 	authParams.State = uuid.New().String()
-	authParams.Prompt = "select_account"
+	if o.prompt != "" {
+		authParams.Prompt = o.prompt
+	} else {
+		authParams.Prompt = shared.PromptSelectAccount.String()
+	}
 	if o.authnScheme != nil {
 		authParams.AuthnScheme = o.authnScheme
 	}
diff --git a/vendor/github.com/golang-jwt/jwt/v5/README.md b/vendor/github.com/golang-jwt/jwt/v5/README.md
index 0bb636f22..17e7ea766 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/README.md
+++ b/vendor/github.com/golang-jwt/jwt/v5/README.md
@@ -140,11 +140,12 @@ A common use case would be integrating with different 3rd party signature
 providers, like key management services from various cloud providers or Hardware
 Security Modules (HSMs) or to implement additional standards.
 
-| Extension | Purpose                                                                                                  | Repo                                       |
-| --------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
-| GCP       | Integrates with multiple Google Cloud Platform signing tools (AppEngine, IAM API, Cloud KMS)             | https://github.com/someone1/gcp-jwt-go     |
-| AWS       | Integrates with AWS Key Management Service, KMS                                                          | https://github.com/matelang/jwt-go-aws-kms |
-| JWKS      | Provides support for JWKS ([RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517)) as a `jwt.Keyfunc` | https://github.com/MicahParks/keyfunc      |
+| Extension | Purpose                                                                                                  | Repo                                              |
+| --------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| GCP       | Integrates with multiple Google Cloud Platform signing tools (AppEngine, IAM API, Cloud KMS)             | https://github.com/someone1/gcp-jwt-go            |
+| AWS       | Integrates with AWS Key Management Service, KMS                                                          | https://github.com/matelang/jwt-go-aws-kms        |
+| JWKS      | Provides support for JWKS ([RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517)) as a `jwt.Keyfunc` | https://github.com/MicahParks/keyfunc             |
+| TPM       | Integrates with Trusted Platform Module (TPM)                                                            | https://github.com/salrashid123/golang-jwt-tpm    |
 
 *Disclaimer*: Unless otherwise specified, these integrations are maintained by
 third parties and should not be considered as a primary offer by any of the
diff --git a/vendor/github.com/golang-jwt/jwt/v5/VERSION_HISTORY.md b/vendor/github.com/golang-jwt/jwt/v5/VERSION_HISTORY.md
index b5039e49c..e39ca8efc 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/VERSION_HISTORY.md
+++ b/vendor/github.com/golang-jwt/jwt/v5/VERSION_HISTORY.md
@@ -97,7 +97,7 @@ Backwards compatible API change that was missed in 2.0.0.
 
 There were two major reasons for breaking backwards compatibility with this update.  The first was a refactor required to expand the width of the RSA and HMAC-SHA signing implementations.  There will likely be no required code changes to support this change.
 
-The second update, while unfortunately requiring a small change in integration, is required to open up this library to other signing methods.  Not all keys used for all signing methods have a single standard on-disk representation.  Requiring `[]byte` as the type for all keys proved too limiting.  Additionally, this implementation allows for pre-parsed tokens to be reused, which might matter in an application that parses a high volume of tokens with a small set of keys.  Backwards compatibilty has been maintained for passing `[]byte` to the RSA signing methods, but they will also accept `*rsa.PublicKey` and `*rsa.PrivateKey`.
+The second update, while unfortunately requiring a small change in integration, is required to open up this library to other signing methods.  Not all keys used for all signing methods have a single standard on-disk representation.  Requiring `[]byte` as the type for all keys proved too limiting.  Additionally, this implementation allows for pre-parsed tokens to be reused, which might matter in an application that parses a high volume of tokens with a small set of keys.  Backwards compatibility has been maintained for passing `[]byte` to the RSA signing methods, but they will also accept `*rsa.PublicKey` and `*rsa.PrivateKey`.
 
 It is likely the only integration change required here will be to change `func(t *jwt.Token) ([]byte, error)` to `func(t *jwt.Token) (interface{}, error)` when calling `Parse`.
 
diff --git a/vendor/github.com/golang-jwt/jwt/v5/parser.go b/vendor/github.com/golang-jwt/jwt/v5/parser.go
index 054c7eb6f..5f803965c 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/parser.go
+++ b/vendor/github.com/golang-jwt/jwt/v5/parser.go
@@ -76,13 +76,6 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
 		}
 	}
 
-	// Decode signature
-	token.Signature, err = p.DecodeSegment(parts[2])
-	if err != nil {
-		return token, newError("could not base64 decode signature", ErrTokenMalformed, err)
-	}
-	text := strings.Join(parts[0:2], ".")
-
 	// Lookup key(s)
 	if keyFunc == nil {
 		// keyFunc was not provided.  short circuiting validation
@@ -94,11 +87,14 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
 		return token, newError("error while executing keyfunc", ErrTokenUnverifiable, err)
 	}
 
+	// Join together header and claims in order to verify them with the signature
+	text := strings.Join(parts[0:2], ".")
 	switch have := got.(type) {
 	case VerificationKeySet:
 		if len(have.Keys) == 0 {
 			return token, newError("keyfunc returned empty verification key set", ErrTokenUnverifiable)
 		}
+
 		// Iterate through keys and verify signature, skipping the rest when a match is found.
 		// Return the last error if no match is found.
 		for _, key := range have.Keys {
@@ -131,7 +127,7 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
 	return token, nil
 }
 
-// ParseUnverified parses the token but doesn't validate the signature.
+// ParseUnverified parses the token but does not validate the signature.
 //
 // WARNING: Don't use this method unless you know what you're doing.
 //
@@ -146,7 +142,7 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
 
 	token = &Token{Raw: tokenString}
 
-	// parse Header
+	// Parse Header
 	var headerBytes []byte
 	if headerBytes, err = p.DecodeSegment(parts[0]); err != nil {
 		return token, parts, newError("could not base64 decode header", ErrTokenMalformed, err)
@@ -155,7 +151,7 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
 		return token, parts, newError("could not JSON decode header", ErrTokenMalformed, err)
 	}
 
-	// parse Claims
+	// Parse Claims
 	token.Claims = claims
 
 	claimBytes, err := p.DecodeSegment(parts[1])
@@ -196,6 +192,12 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
 		return token, parts, newError("signing method (alg) is unspecified", ErrTokenUnverifiable)
 	}
 
+	// Parse token signature
+	token.Signature, err = p.DecodeSegment(parts[2])
+	if err != nil {
+		return token, parts, newError("could not base64 decode signature", ErrTokenMalformed, err)
+	}
+
 	return token, parts, nil
 }
 
@@ -216,7 +218,7 @@ func splitToken(token string) ([]string, bool) {
 	parts[1] = claims
 	// One more cut to ensure the signature is the last part of the token and there are no more
 	// delimiters. This avoids an issue where malicious input could contain additional delimiters
-	// causing unecessary overhead parsing tokens.
+	// causing unnecessary overhead parsing tokens.
 	signature, _, unexpected := strings.Cut(remain, tokenDelimiter)
 	if unexpected {
 		return nil, false
diff --git a/vendor/github.com/golang-jwt/jwt/v5/parser_option.go b/vendor/github.com/golang-jwt/jwt/v5/parser_option.go
index 431573557..af42fd3a7 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/parser_option.go
+++ b/vendor/github.com/golang-jwt/jwt/v5/parser_option.go
@@ -3,9 +3,7 @@ package jwt
 import "time"
 
 // ParserOption is used to implement functional-style options that modify the
-// behavior of the parser. To add new options, just create a function (ideally
-// beginning with With or Without) that returns an anonymous function that takes
-// a *Parser type as input and manipulates its configuration accordingly.
+// behavior of the parser.
 type ParserOption func(*Parser)
 
 // WithValidMethods is an option to supply algorithm methods that the parser
@@ -66,6 +64,14 @@ func WithExpirationRequired() ParserOption {
 	}
 }
 
+// WithNotBeforeRequired returns the ParserOption to make nbf claim required.
+// By default nbf claim is optional.
+func WithNotBeforeRequired() ParserOption {
+	return func(p *Parser) {
+		p.validator.requireNbf = true
+	}
+}
+
 // WithAudience configures the validator to require any of the specified
 // audiences in the `aud` claim. Validation will fail if the audience is not
 // listed in the token or the `aud` claim is missing.
diff --git a/vendor/github.com/golang-jwt/jwt/v5/token.go b/vendor/github.com/golang-jwt/jwt/v5/token.go
index 3f7155888..d9f6c9d25 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/token.go
+++ b/vendor/github.com/golang-jwt/jwt/v5/token.go
@@ -32,8 +32,8 @@ type Token struct {
 	Method    SigningMethod  // Method is the signing method used or to be used
 	Header    map[string]any // Header is the first segment of the token in decoded form
 	Claims    Claims         // Claims is the second segment of the token in decoded form
-	Signature []byte         // Signature is the third segment of the token in decoded form.  Populated when you Parse a token
-	Valid     bool           // Valid specifies if the token is valid.  Populated when you Parse/Verify a token
+	Signature []byte         // Signature is the third segment of the token in decoded form.  Populated when you [Parse] or sign a token
+	Valid     bool           // Valid specifies if the token is valid.  Populated when you [Parse] a token
 }
 
 // New creates a new [Token] with the specified signing method and an empty map
@@ -71,6 +71,8 @@ func (t *Token) SignedString(key any) (string, error) {
 		return "", err
 	}
 
+	t.Signature = sig
+
 	return sstr + "." + t.EncodeSegment(sig), nil
 }
 
diff --git a/vendor/github.com/golang-jwt/jwt/v5/validator.go b/vendor/github.com/golang-jwt/jwt/v5/validator.go
index 92b5c057c..c82dfcae6 100644
--- a/vendor/github.com/golang-jwt/jwt/v5/validator.go
+++ b/vendor/github.com/golang-jwt/jwt/v5/validator.go
@@ -44,6 +44,9 @@ type Validator struct {
 	// requireExp specifies whether the exp claim is required
 	requireExp bool
 
+	// requireNbf specifies whether the nbf claim is required
+	requireNbf bool
+
 	// verifyIat specifies whether the iat (Issued At) claim will be verified.
 	// According to https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 this
 	// only specifies the age of the token, but no validation check is
@@ -111,8 +114,9 @@ func (v *Validator) Validate(claims Claims) error {
 	}
 
 	// We always need to check not-before, but usage of the claim itself is
-	// OPTIONAL.
-	if err = v.verifyNotBefore(claims, now, false); err != nil {
+	// OPTIONAL by default. requireNbf overrides this behavior and makes
+	// the nbf claim mandatory.
+	if err = v.verifyNotBefore(claims, now, v.requireNbf); err != nil {
 		errs = append(errs, err)
 	}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 37447b590..2ae4e75ef 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1
+# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
 ## explicit; go 1.25.0
 github.com/Azure/azure-sdk-for-go/sdk/azcore
 github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource
@@ -19,10 +19,11 @@ github.com/Azure/azure-sdk-for-go/sdk/azcore/policy
 github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime
 github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming
 github.com/Azure/azure-sdk-for-go/sdk/azcore/tracing
-# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
-## explicit; go 1.23.0
+# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
+## explicit; go 1.25.0
 github.com/Azure/azure-sdk-for-go/sdk/azidentity
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy
 # github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0
 ## explicit; go 1.24.0
 github.com/Azure/azure-sdk-for-go/sdk/internal/diag
@@ -32,7 +33,7 @@ github.com/Azure/azure-sdk-for-go/sdk/internal/log
 github.com/Azure/azure-sdk-for-go/sdk/internal/poller
 github.com/Azure/azure-sdk-for-go/sdk/internal/temporal
 github.com/Azure/azure-sdk-for-go/sdk/internal/uuid
-# github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0
+# github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2
 ## explicit; go 1.18
 github.com/AzureAD/microsoft-authentication-library-for-go/apps/cache
 github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential
@@ -142,7 +143,7 @@ github.com/gobwas/glob/syntax/ast
 github.com/gobwas/glob/syntax/lexer
 github.com/gobwas/glob/util/runes
 github.com/gobwas/glob/util/strings
-# github.com/golang-jwt/jwt/v5 v5.3.0
+# github.com/golang-jwt/jwt/v5 v5.3.1
 ## explicit; go 1.21
 github.com/golang-jwt/jwt/v5
 # github.com/golang/protobuf v1.5.4