[dependabot]

Updated Azure.Security.KeyVault.Secrets from 4.7.0 to 4.12.0.

Release notes

Sourced from Azure.Security.KeyVault.Secrets's releases.

4.12.0

4.12.0 (2026-10-27)

Other Changes

• Regenerated the library for stable Key Vault API version 2026-04-01.

4.12.0-beta.3

4.12.0-beta.3 (2026-10-08)

Bugs Fixed

• Fixed an issue in the challenge-based authentication policy where a cached authentication challenge accepted with challenge resource verification disabled could be reused by a separate default-strict client without revalidating the challenge resource.
• Improved authentication challenge resource validation.

4.12.0-beta.2

4.12.0-beta.2 (2026-09-27)

Features Added

• Added IDisposable to SecretClient to release its internally owned HTTP pipeline and transport. Reuse clients and dispose them after all operations have completed; caller-provided transports are not disposed.
• Added a narrowly scoped bearer-token fallback for attested managed-identity tenant eligibility denials, with the decision remembered by the Key Vault client for subsequent token acquisitions.
• Added support for Proof-of-Possession (PoP) token binding in the Key Vault authentication policy.

Bugs Fixed

• Fixed intermittent authentication failures by retrying requests rejected because the mTLS Proof-of-Possession certificate did not match the token binding.
• Fixed a NullReferenceException in the challenge-based authentication policy that could occur when a Continuous Access Evaluation (CAE) claims challenge was received for an authority that had not yet been cached.
• Fixed an issue in the challenge-based authentication policy where a cached authentication challenge, and the access token acquired for it, could be reused for a request to a different Key Vault or Managed HSM endpoint. The policy now resolves the challenge per request endpoint, ensuring a token acquired for one vault is never attached to a request to another.

Other Changes

• Internal: the SecretClient transport now delegates to a TypeSpec-generated implementation. Public API surface, default service version, exception contracts, on-the-wire requests, and OpenTelemetry / DiagnosticListener activity names are all unchanged. SecretClientOptions (custom retry, transport, diagnostics allow-lists, AddPolicy entries) continues to flow end-to-end. The TypeSpec emitter incidentally adds one additive public type (AzureSecurityKeyVaultSecretsContext, the ModelReaderWriterContext required for AOT-friendly ModelReaderWriter round-trip), matching the sibling Azure.Security.KeyVault.Administration package convention.

4.11.2

4.11.2 (2026-10-02)

Bugs Fixed

• Fixed handling of claims challenges when the authentication challenge cache is empty or cleared while a request is in flight.
• Fixed an issue in the challenge-based authentication policy where a cached authentication challenge accepted with challenge resource verification disabled could be reused by a separate default-strict client without revalidating the challenge resource.
• Improved authentication challenge resource validation.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)