[dependabot]

Bumps azure-keyvault-secrets from 4.11.3 to 4.12.0.

Release notes

Sourced from azure-keyvault-secrets's releases.

azure-keyvault-secrets_4.12.0

4.12.0 (2026-10-27)

Bugs Fixed

• Fixed an issue where cached authentication challenges could bypass challenge resource verification.
• Preserve newer cached authentication challenges installed by concurrent requests when an older request fails. Failed requests now clear only the cache entry they observed or accepted.
• Hardened challenge cache reuse as a follow-up to #48710. Cached challenges are now verified before token use, and stale entries are cleared when challenge parsing or resource verification fails. Request replay and existing CAE scope/tenant precedence are preserved when concurrent requests invalidate the shared cache.
• Preserved redirect header cleanup and header updates when restoring request bodies during authentication.
• Reject request URLs containing backslashes in the authority before authentication.
• Clear the request's cached challenge when a 401 response omits WWW-Authenticate, returning that response without an authentication retry. If no newer challenge remains, the next request rediscovers it, which can add an unauthenticated request even when resource verification is disabled.

Other Changes

• Regenerated the package with stable Key Vault API version 2026-04-01.
• The default service version is now 2026-04-01.
• Python 3.9 is no longer supported. Please use Python 3.10 or later, in accordance with the Azure SDK for Python version support policy.
• Updated the minimum azure-core dependency to 1.37.0 to match the generated client.

Commits

• 9030ffb [Cosmos] Skip resource provisioning for fixed-account live tests (#49576)
• 3135a70 Failed-[AutoPR azure-keyvault-certificates]-generated-from-SDK Generation - P...
• e793ef6 Sync eng/common directory with azure-sdk-tools for PR 17393 (#49713)
• 79b2144 Failed-[AutoPR azure-keyvault-secrets]-generated-from-SDK Generation - Python...
• 5c3272f Increment version for agentserver releases (#49720)
• 4a058d2 [AgentServer] Prepare Responses 2.4.0b2 release (#49718)
• cf17c42 docs: add Python management SDK release rotation runbook (#49680)
• 7c46823 bump genai message attribute length to 4MiB (#49648)
• 1ea3d76 [Monitor] Preserve rate-limited sampler local child span decisions (#49569)
• 4e3292e [Health Deid] Fix CI lint via regeneration, surface live test job errors, add...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)