[dependabot]

Bumps the gomod group with 2 updates: github.com/Azure/azure-sdk-for-go/sdk/azidentity and github.com/spf13/pflag.

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.15.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.15.0

1.15.0 (2026-10-14)

Features Added

• ManagedIdentityCredential and DefaultAzureCredential support user-assigned managed identities on Azure Arc when the agent supports them
• WorkloadIdentityCredential supports identity binding mode via WorkloadIdentityCredentialOptions.EnableAzureProxy

Bugs Fixed

• ManagedIdentityCredential verifies the Service Fabric endpoint's certificate against IDENTITY_SERVER_THUMBPRINT and rejects redirects

Other Changes

• On Service Fabric, a custom ClientOptions.Transport must be an *http.Client with a nil Transport or a standard *http.Transport without custom TLS dialing or verification callbacks. Unsupported transports now cause credential construction to fail
• Upgraded dependencies

sdk/azidentity/v1.14.1

1.14.1 (2026-08-27)

Other Changes

• Upgraded dependencies

Commits

• bb7200c Update azcore v1.15.0 release date (#23569)
• d112082 [azopenaiextensions] Pushing release date to Monday (#23565)
• 9522165 [azopenai] 2024-08-01-preview generation (#23554)
• 42922c1 [azeventhubs,azservicebus] Applying retry fix to both eventhubs and servicebu...
• 5df372c Use common OIDC token env vars in post scripts (#23549)
• 1c2a108 BearerTokenPolicy handles CAE claims challenges by default (#23414)
• 8759ee6 [azopenaiextensions] Prepping for release tomorrow (#23551)
• a230ef2 [Search] Remove myself from CODEOWNERS (#23560)
• a743757 Sync eng/common directory with azure-sdk-tools for PR 9106 (#23555)
• 7c2d3a7 Use equality function check for persist oidc token step (#23559)
• Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.9 to 1.0.10

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.10

What's Changed

• fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by @​thaJeztah in spf13/pflag#447
• remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by @​thaJeztah in spf13/pflag#448

New Contributors

• @​thaJeztah made their first contribution in spf13/pflag#447

Full Changelog: spf13/pflag@v1.0.9...v1.0.10

Commits

• 0491e57 Merge pull request #448 from thaJeztah/fix_go_version
• 72abab1 Merge pull request #447 from thaJeztah/fix_deprecation_comment
• 7e4dfb1 Test on Go 1.12
• 18a9d17 move Func, BoolFunc, tests as they require go1.21
• c5b9e98 remove uses of errors.Is, which requires go1.13
• 45a4873 fix deprecation comment for (FlagSet.)ParseErrorsWhitelist
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 44a0b93
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 438c0581-afa1-4333-bb7d-1b451f857ec6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Review (claude-cc-libs) @ fd451c9: minor and patch bumps only (azidentity 1.14.0 to 1.15.0, its indirect MSAL 1.8.0 to 1.10.1, pflag 1.0.9 to 1.0.10), no code changes. CI is green and the branch is CLEAN. OK to merge.

[cristim]

APPROVE @ fd451c9
Second review (claude-cc-libs): this is the same Dependabot diff I reviewed earlier on this PR. It's minor and patch dependency bumps with no code changes, and CI is green at this head. The merge goes through the gated script, pinned to this SHA.

[cristim]

Review verdict: APPROVE at fd451c9

Reviewer: claude-ui-fix-2 (diff, release notes, advisories and CI only; nothing built locally).

• Scope: go.mod and go.sum. azidentity 1.14.0→1.15.0 (minor in v1), its indirect microsoft-authentication-library-for-go 1.8.0→1.10.1, and spf13/pflag 1.0.9→1.0.10 (a patch: a deprecation-comment fix, and dropping errors.Is for old Go).
• Advisories: I queried the GitHub advisory database (ecosystem go) for every module at its new version in go.mod, indirect ones included: none. As a control, the same query returns 6 advisories for google.golang.org/[email protected].
• Retractions: go list -m -retracted on the direct modules at their new versions shows none retracted. This fetched module metadata only; nothing was built.
• Toolchain: no change to the go directive or toolchain line.
• CI: 9 passed, 2 neutral, 1 skipped at this SHA. Up to date with main, CLEAN.

No findings.