deps: update terraform non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
azuread (source)	required_provider	minor	~> 3.8.0 → ~> 3.9.0
azurerm (source)	required_provider	minor	~> 4.74.0 → ~> 4.78.0
k8s-monitoring	helm_release	patch	4.1.4 → 4.1.6
kube-prometheus-stack (source)	helm_release	minor	86.2.3 → 86.3.2
sealed-secrets	helm_release	minor	2.18.6 → 2.19.0
traefik (source)	helm_release	minor	40.2.0 → 40.3.0

---

Release Notes

hashicorp/terraform-provider-azuread (azuread)

v3.9.0

Compare Source

ENHANCEMENTS:

• dependencies: update go version to 1.26.4 (#​1874)
• dependencies: update go-azure-helpers to 0.80.0 (#​1872)
• azuread_conditional_access_policy - add support for the conditions.applications.filter property (#​1780)
• azuread_privileged_access_group_assignment_schedule - add additional checks for confirming resource existence (#​1856)
• azuread_privileged_access_group_eligibility_schedule - add additional checks for confirming resource existence (#​1856)

BUG:

• azuread_privileged_access_group_assignment_schedule - fix update functionality preventing RoleAssignmentExists errors (#​1856)
• azuread_privileged_access_group_eligibility_schedule - fix update functionality preventing RoleAssignmentExists errors (#​1856)

hashicorp/terraform-provider-azurerm (azurerm)

v4.78.0

Compare Source

FEATURES:

• New List Resource: azurerm_signalr_service_custom_domain (#​32124)
• New List Resource: azurerm_storage_sync_server_endpoint (#​31988)

ENHANCEMENTS:

• dependencies: go-azure-sdk - update to v0.20260616.1142719 (#​32631)
• Data Source: azurerm_network_manager_connectivity_configuration - export the connected_group_address_overlap, connected_group_private_endpoints_scale, and peering_enforcement properties (#​31562)
• Data Source: azurerm_storage_container - export the url property (#​29036)
• azurerm_kubernetes_cluster - add support KataVmIsolation for workload_runtime (#​32579)
• azurerm_kubernetes_cluster_node_pool - add support KataVmIsolation for workload_runtime (#​32579)
• azurerm_mssql_managed_instance - add support for the storage_iops property (#​32250)
• azurerm_network_manager_connectivity_configuration - add support for the connected_group_address_overlap, connected_group_private_endpoints_scale, and peering_enforcement properties (#​31562)
• azurerm_storage_container - export the url property (#​29036)

BUG FIXES:

• azurerm_cosmosdb_account - fix an issue that prevented diffs on geo_location.zone_redundant from showing (#​32620)
• azurerm_express_route_connection - fix an issue that caused unintentional changes to internet_security_enabled on updates (#​32498)
• azurerm_static_web_app - fix an issue that caused updates to fail once a private endpoint was attached (#​32631)

v4.77.0

Compare Source

FEATURES:

• New List Resource: azurerm_key_vault (#​32408)
• New List Resource: azurerm_web_pubsub_custom_domain (#​32186)

ENHANCEMENTS:

• dependencies: go - update to 1.26.4 (#​32539)
• dependencies: go-azure-sdk - update to v0.20260603.1074745 (#​32503)
• Data Source: azurerm_storage_blob - the storage_account_name and storage_container_name properties have been deprecated in favour of the storage_container_id property (#​32235)
• Data Source: azurerm_storage_table - the storage_account_name property has been deprecated in favour of the storage_account_id property (#​32235)
• azurerm_machine_learning_workspace - add support for the storage_account_access_type property (#​32514)
• azurerm_storage_blob - the storage_account_name and storage_container_name properties have been deprecated in favour of the storage_container_id property (#​32235)
• azurerm_storage_container - the storage_account_name property has been deprecated in favour of the storage_account_id property (#​32235)
• azurerm_storage_object_replication - add support for the metrics_enabled property (#​32204)
• azurerm_storage_queue - the storage_account_name property has been deprecated in favour of the storage_account_id property (#​32235)
• azurerm_storage_table - the storage_account_name property has been deprecated in favour of the storage_account_id property (#​32235)

BUG FIXES:

• azurerm_mssql_managed_instance - fix an issue that caused an error when changing from a GP_* SKU to a BC_* SKU (#​32560)
• azurerm_network_manager_deployment - add a custom poller to work around an API issue on creation (#​32530)
• azurerm_recovery_services_vault_resource_guard_association - normalize resource_guard_id before persisting to state to work around an API issue (#​32554)
• azurerm_subnet - fix an issue that incorrectly caused a validation error when increasing ip_address_pool.number_of_ip_addresses (#​32500)
• azurerm_virtual_network - fix an issue that incorrectly caused a validation error when increasing ip_address_pool.number_of_ip_addresses (#​32500)

v4.76.0

Compare Source

ENHANCEMENTS:

• Action: azurerm_virtual_machine_power - power_action now supports deallocate (#​32492)
• azurerm_key_vault_key - add support for the release_policy block (#​32478)

BUG FIXES:

• azurerm_federated_identity_credential - fix update logic, preventing import errors on updates (#​32522)
• azurerm_netapp_account - the update function now uses the PUT operation to fix a removal issue with the active_directory property (#​32494)
• azurerm_netapp_account - fix drift detection for the active_directory and identity properties (#​32494)
• azurerm_netapp_volume_group_oracle - fix validation for the application_identifier property (#​32499)
• azurerm_oracle_resource_anchor - fix validation for the name property to allow hyphens (#​32481)

v4.75.0

Compare Source

FEATURES:

• provider: adds support for the features.persist_id_on_create_before_polling_for_completion feature (#​32318)
• provider: adds support for the features.skip_import_check_on_create_and_allow_overwriting_existing_resources feature (#​32318)

ENHANCEMENTS:

• dependencies: azurerm_cdn_frontdoor - update API version to 2025-12-01 (#​32461)
• dependencies: cognitive - update API version to 2026-03-01 (#​32427)
• dependencies: recoveryservices/vaults - update to API Version 2025-08-01 (#​31163)
• Data Source: azurerm_orchestrated_virtual_machine_scale_set - export the sku_profile block (#​30260)
• azurerm_application_gateway - add support for certificate_chain_validation_enabled, sni_validation_enabled, and sni_name properties to backend_http_settings (#​31206)
• azurerm_data_factory_linked_service_mysql - add support for the driver_version property (#​32076)
• azurerm_data_protection_backup_instance_data_lake_storage - add FriendlyName on Create to align with other backup instance resources (#​32351)
• azurerm_mongo_cluster - the storage_size_in_gb property now allows values of up to 32768 (#​32428)
• azurerm_mssql_managed_instance_transparent_data_encryption - support versionless key_vault_key_id (#​32399)
• azurerm_orchestrated_virtual_machine_scale_set - add support for the virtual_machine_size block (#​30260)
• azurerm_redhat_openshift_cluster - update API version to 2025-07-25 (#​32029)
• azurerm_windows_function_app - add support for 7.6 to the site_config.application_stack.powershell_core_version property (#​32448)
• azurerm_windows_function_app_slot - add support for 7.6 to the site_config.application_stack.powershell_core_version property (#​32448)

BUG FIXES:

• Data Source: azurerm_virtual_network_gateway - fixed issue returning correct value for deprecated enable_bgp property (#​32422)
• azurerm_api_management_backend - the proxy.username property is now optional (#​32433)
• azurerm_cosmosdb_sql_container - fix Read function to ensure the resource is able to track drift (#​32443)
• azurerm_site_recovery_vmware_replicated_vm - fixes a bug where test_subnet_name not set correctly (#​32407)

grafana/helm-charts (k8s-monitoring)

v4.1.6

Compare Source

Capture all telemetry data from your Kubernetes cluster.

Source commit: grafana/k8s-monitoring-helm@c11527f

Tag on source: https://github.com/grafana/k8s-monitoring-helm/releases/tag/k8s-monitoring-4.1.6

v4.1.5

Compare Source

Capture all telemetry data from your Kubernetes cluster.

Source commit: grafana/k8s-monitoring-helm@c651117

Tag on source: https://github.com/grafana/k8s-monitoring-helm/releases/tag/k8s-monitoring-4.1.5

prometheus-community/helm-charts (kube-prometheus-stack)

v86.3.2

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7008

Full Changelog: prometheus-community/helm-charts@prometheus-operator-admission-webhook-0.42.1...kube-prometheus-stack-86.3.2

v86.3.1

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [CI] Update github-workflow dependency updates to v7 by @​renovate[bot] in #​7007
• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​7006

Full Changelog: prometheus-community/helm-charts@kube-prometheus-stack-86.3.0...kube-prometheus-stack-86.3.1

v86.3.0

Compare Source

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

What's Changed

• [kube-prometheus-stack] Update kube-prometheus-stack dependency non-major updates by @​renovate[bot] in #​6990

Full Changelog: prometheus-community/helm-charts@prometheus-29.13.0...kube-prometheus-stack-86.3.0

traefik/traefik-helm-chart (traefik)

v40.3.0

Compare Source

🚀 Features

• feat(provider): ✨ support qps and burst on kubernetesGateway #​1869 by @​darkweaver87
• feat(logs): ✨ support accesslog query parameters defaultmode #​1868 by @​darkweaver87
• feat(hub): 🚀 support traefik hub v3.20.4 #​1876 by @​jspdown
• feat(proxy): 🚀 support traefik v3.7.4 #​1880 by @​darkweaver87
• feat(CRDs): update Traefik Hub CRDs to v1.31.0 #​1881 by @​darkweaver87

🐛 Bug fixes

• fix(hub): 🐛 guard nil hub.token in hub-license template #​1875 by @​darkweaver87

📦 Others

• chore(deps): update mikepenz/release-changelog-builder-action action to v6.2.2 #​1857 by @​renovate-with-github-actions[bot]
• chore(deps): update actions/create-github-app-token action to v3.2.0 #​1858 by @​renovate-with-github-actions[bot]
• chore(deps): support traefik v3.7.3 & hub v3.20.3 #​1867 by @​bpsoraggi
• chore(deps): update actions/checkout action to v6.0.3 #​1870 by @​renovate-with-github-actions[bot]
• chore(deps): update renovatebot/github-action action to v46.1.15 #​1871 by @​renovate-with-github-actions[bot]
• chore(deps): update dependency helm to v3.21.0 #​1873 by @​renovate-with-github-actions[bot]
• ci(test): fix helm-unittest invocation for helm v4 #​1879 by @​darkweaver87
• chore(ci): track proxy & hub max-version annotations with renovate #​1877 by @​jspdown
• chore(deps): update dependency helm to v4 #​1874 by @​renovate-with-github-actions[bot]
• chore(release): 🚀 publish 40.3.0 #​1882 by @​darkweaver87

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.4 (default)
• Traefik Hub: v3.19.3 -> v3.20.4

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • Between 05:00 AM and 07:59 AM, Monday through Thursday (* 5-7 * * 1-4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.