build(deps): Bump the all-updates group in /terraform with 2 updates

[dependabot]

Updates the requirements on cloudflare/cloudflare and hashicorp/azurerm to permit the latest version.
Updates cloudflare/cloudflare to 5.24.0

Release notes

Sourced from cloudflare/cloudflare's releases.

v5.24.0

Changelog

5.24.0 (2026-08-20)

BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• hostname_tls_setting: the cloudflare_hostname_tls_setting data source now requires hostname as an input parameter instead of returning it as a computed attribute. The computed id attribute has been removed; use setting_id instead. (ece27fe)
• image_variant: the computed variant nested attribute has been removed. The API no longer returns this wrapper object; the id, options, and never_require_signed_urls fields remain available at the top level. Remove any references to cloudflare_image_variant.<name>.variant from your configurations. (738bd28)
• organization: the computed meta.flags nested attribute has been renamed to meta.tenant_flags. Two new computed sub-attributes (enterprise_capability, member_management) have been added. Update any references from .meta.flags to .meta.tenant_flags. (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: the allow_code_mode attribute is now deprecated and no longer computed with a default of true. Use the new code_mode attribute ("off", "opt_in", "default_on", "enforced") instead. Configurations that relied on the computed default must explicitly set code_mode or allow_code_mode. (ece27fe)
• zero_trust_access_policy: the session_duration attribute is no longer computed with a default of "24h". It is now optional-only. Existing configurations that omitted session_duration and relied on the provider default will see a plan diff; explicitly set session_duration = "24h" to preserve the previous behavior. (ae4f5a1)
• zero_trust_organization: the allowed_authenticators enum value ssh_piv_key has been renamed to piv_key, and a new value ssh_fido2_key has been added. Configurations using "ssh_piv_key" must be updated to "piv_key". (ece27fe)
• zero_trust_resource_library_application: the id attribute type changed from String to Int64. The computed intel_id attribute has been removed. The hostnames, ip_subnets, port_protocols, support_domains, and supported attributes changed from List to Set (element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)
• zero_trust_resource_library_category: the id attribute type changed from String to Int64 on both the data source and list data source. (ece27fe)
• zero_trust_tunnel_cloudflared: the computed is_pending_reconnect attribute has been removed from connections. The upstream API no longer returns this field. Remove any references to connections[*].is_pending_reconnect from your configurations. (ece27fe)
• zero_trust_tunnel_warp_connector: the computed is_pending_reconnect attribute has been removed from connections, matching the zero_trust_tunnel_cloudflared change above. (ece27fe)

New Resources

• cloudflare_ct_alerting: onboard new Terraform resource for Certificate Transparency alerting (ece27fe)
• cloudflare_precursor: onboard new Terraform resource for Precursor (ece27fe)

New Data Sources

• cloudflare_hostname_tls_settings: add list data source for hostname TLS settings (ece27fe)

Features

• bump Go SDK version to v7.9.0 (79c7d4f)
• ai_gateway: add log_classification attribute and unified billing mode (ece27fe)
• ai_search_instance: add discover_options for link-following web crawler configuration (ece27fe)
• ai_search_namespace: add public_endpoint_params with MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)
• cloud_connector_rules: add oci_storage cloud provider type (ece27fe)
• d1_database: add us location restriction value (ece27fe)
• load_balancer_pool: add health_sources attribute for regional health steering (ece27fe)
• ruleset: add vary parameter to set_cache_settings action (e9cdc20)
• waiting_room: add Latvian (lv-LV) language support (ece27fe)
• worker: add preview_url_suffix and url computed attributes to subdomain block (ece27fe)
• worker_version: add messaging binding type (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: add code_mode attribute for granular Code Mode policy control (ece27fe)
• zero_trust_access_ai_controls_mcp_server: add authentication_status computed attribute (ece27fe)
• zero_trust_access_application: add worker destination types for Access (118fe39)
• zero_trust_access_custom_page: add contract_version, warnings, and new type values (login, interstitial) (ece27fe)
• zero_trust_access_service_token: add enabled attribute to control service token activation (ece27fe)

... (truncated)

Changelog

Sourced from cloudflare/cloudflare's changelog.

5.24.0 (2026-08-20)

Full Changelog: v5.23.0...v5.24.0

BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• hostname_tls_setting: the cloudflare_hostname_tls_setting data source now requires hostname as an input parameter instead of returning it as a computed attribute. The computed id attribute has been removed; use setting_id instead. (ece27fe)
• image_variant: the computed variant nested attribute has been removed. The API no longer returns this wrapper object; the id, options, and never_require_signed_urls fields remain available at the top level. Remove any references to cloudflare_image_variant.<name>.variant from your configurations. (738bd28)
• organization: the computed meta.flags nested attribute has been renamed to meta.tenant_flags. Two new computed sub-attributes (enterprise_capability, member_management) have been added. Update any references from .meta.flags to .meta.tenant_flags. (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: the allow_code_mode attribute is now deprecated and no longer computed with a default of true. Use the new code_mode attribute ("off", "opt_in", "default_on", "enforced") instead. Configurations that relied on the computed default must explicitly set code_mode or allow_code_mode. (ece27fe)
• zero_trust_access_policy: the session_duration attribute is no longer computed with a default of "24h". It is now optional-only. Existing configurations that omitted session_duration and relied on the provider default will see a plan diff; explicitly set session_duration = "24h" to preserve the previous behavior. (ae4f5a1)
• zero_trust_organization: the allowed_authenticators enum value ssh_piv_key has been renamed to piv_key, and a new value ssh_fido2_key has been added. Configurations using "ssh_piv_key" must be updated to "piv_key". (ece27fe)
• zero_trust_resource_library_application: the id attribute type changed from String to Int64. The computed intel_id attribute has been removed. The hostnames, ip_subnets, port_protocols, support_domains, and supported attributes changed from List to Set (element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)
• zero_trust_resource_library_category: the id attribute type changed from String to Int64 on both the data source and list data source. (ece27fe)
• zero_trust_tunnel_cloudflared: the computed is_pending_reconnect attribute has been removed from connections. The upstream API no longer returns this field. Remove any references to connections[*].is_pending_reconnect from your configurations. (ece27fe)
• zero_trust_tunnel_warp_connector: the computed is_pending_reconnect attribute has been removed from connections, matching the zero_trust_tunnel_cloudflared change above. (ece27fe)

New Resources

• cloudflare_ct_alerting: onboard new Terraform resource for Certificate Transparency alerting (ece27fe)
• cloudflare_precursor: onboard new Terraform resource for Precursor (ece27fe)

New Data Sources

• cloudflare_hostname_tls_settings: add list data source for hostname TLS settings (ece27fe)

Features

• bump Go SDK version to v7.9.0 (79c7d4f)
• ai_gateway: add log_classification attribute and unified billing mode (ece27fe)
• ai_search_instance: add discover_options for link-following web crawler configuration (ece27fe)
• ai_search_namespace: add public_endpoint_params with MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)
• cloud_connector_rules: add oci_storage cloud provider type (ece27fe)
• d1_database: add us location restriction value (ece27fe)
• load_balancer_pool: add health_sources attribute for regional health steering (ece27fe)
• ruleset: add vary parameter to set_cache_settings action (e9cdc20)
• waiting_room: add Latvian (lv-LV) language support (ece27fe)
• worker: add preview_url_suffix and url computed attributes to subdomain block (ece27fe)
• worker_version: add messaging binding type (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: add code_mode attribute for granular Code Mode policy control (ece27fe)
• zero_trust_access_ai_controls_mcp_server: add authentication_status computed attribute (ece27fe)
• zero_trust_access_application: add worker destination types for Access (118fe39)
• zero_trust_access_custom_page: add contract_version, warnings, and new type values (login, interstitial) (ece27fe)
• zero_trust_access_service_token: add enabled attribute to control service token activation (ece27fe)
• zero_trust_dlp_*_entry: add computed deprecated attribute to all DLP entry resources and data sources (ece27fe)

... (truncated)

Commits

• 4f360d5 Merge pull request #7328 from cloudflare/release-tf-v5.24.0
• 46ac907 fix(account_subscription): replace zone_id with account_id in example
• 014430c fix: remove enabled from source service token schema; fix logpush field_names...
• bbcfa79 fix: resolve unit test schema/model parity failures
• ca0a171 test(r2_bucket): skip storage_class update tests when using API token
• f644d51 fix: MCP portal drift, worker subdomain test checks, and references drift
• 53461b8 fix: resolve acceptance test regressions for v5.24.0
• 61f170d fix(zero_trust_access_ai_controls_mcp_portal): remove no_refresh from server_id
• af76997 fix: add Version: 500 to ct_alerting and precursor resource schemas
• 4afdca3 chore(release): 5.24.0
• Additional commits viewable in compare view

Updates hashicorp/azurerm to 5.3.0

Release notes

Sourced from hashicorp/azurerm's releases.

v5.3.0

5.3.0 (August 27, 2026)

FEATURES:

• New Data Source: azurerm_playwright_workspace (#31954)
• New List Resource: azurerm_cognitive_deployment (#33149)
• New List Resource: azurerm_playwright_workspace (#31954)
• New Resource: azurerm_playwright_workspace (#31954)

ENHANCEMENTS:

• dependencies: go-azure-helpers - update version to 0.82.0 (#33142)
• dependencies: sql - update API version to 2025-01-01 (#33201)
• Data Source: azurerm_role_definition - export the role_definition_resource_id property (#33126)
• azurerm_cognitive_deployment - add Resource Identity support (#33149)
• azurerm_federated_identity_credential - add additional polling to account for Azure's eventual consistency (#32935)
• azurerm_kubernetes_cluster - add support for the oms_agent.retina_flow_logs_enabled property (#33222)
• azurerm_managed_application - add support for the identity block (#30725)
• azurerm_private_endpoint - extend validation for the private_service_connection.subresource_names property to allow names containing spaces (#32887)
• azurerm_search_service - allow in-place downgrades of the sku property between Basic and Standard tiers (#33069)
• azurerm_site_recovery_replicated_vm - add update support to the managed_disk block without requiring resource recreation (#33140)
• azurerm_user_assigned_identity - add additional polling to account for Azure's eventual consistency (#33142)

BUG FIXES:

• Data Source: azurerm_app_configuration_key - now correctly sets tags into state (#33182)
• azurerm_eventhub_namespace - prevent network_rulesets.x.default_action being set to Deny if ip_rule or virtual_network_rule is not specified (#33216)

Changelog

Sourced from hashicorp/azurerm's changelog.

5.3.0 (August 27, 2026)

FEATURES:

• New Data Source: azurerm_playwright_workspace (#31954)
• New List Resource: azurerm_cognitive_deployment (#33149)
• New List Resource: azurerm_playwright_workspace (#31954)
• New Resource: azurerm_playwright_workspace (#31954)

ENHANCEMENTS:

• dependencies: go-azure-helpers - update version to 0.82.0 (#33142)
• dependencies: sql - update API version to 2025-01-01 (#33201)
• Data Source: azurerm_role_definition - export the role_definition_resource_id property (#33126)
• azurerm_cognitive_deployment - add Resource Identity support (#33149)
• azurerm_federated_identity_credential - add additional polling to account for Azure's eventual consistency (#32935)
• azurerm_kubernetes_cluster - add support for the oms_agent.retina_flow_logs_enabled property (#33222)
• azurerm_managed_application - add support for the identity block (#30725)
• azurerm_private_endpoint - extend validation for the private_service_connection.subresource_names property to allow names containing spaces (#32887)
• azurerm_search_service - allow in-place downgrades of the sku property between Basic and Standard tiers (#33069)
• azurerm_site_recovery_replicated_vm - add update support to the managed_disk block without requiring resource recreation (#33140)
• azurerm_user_assigned_identity - add additional polling to account for Azure's eventual consistency (#33142)

BUG FIXES:

• Data Source: azurerm_app_configuration_key - now correctly sets tags into state (#33182)
• azurerm_eventhub_namespace - prevent network_rulesets.x.default_action being set to Deny if ip_rule or virtual_network_rule is not specified (#33216)

5.2.0 (August 20, 2026)

FEATURES:

• New List Resource: azurerm_user_assigned_identity (#32667)

ENHANCEMENTS:

• dependencies: go - update to 1.26.6 (#33141)
• dependencies: go-azure-sdk - update to v0.20260811.1225050 (#33079)
• azurerm_cdn_frontdoor_batch_rule_set - allow / as an input to rule.conditions.request_path.values (#33023)
• azurerm_databricks_workspace - remove a redundant key vault existence check (#33136)
• azurerm_databricks_workspace_root_dbfs_customer_managed_key - remove a redundant key vault existence check (#33136)
• azurerm_logic_app_standard - add support for v10.0 to site_config.dotnet_framework_version (#33116)
• azurerm_mongo_cluster - administrator_password is no longer required when create_mode is Default to support Entra ID-only authentication (#32092)
• azurerm_redhat_openshift_cluster - add support for the network_profile.load_balancer_profile block (#32473)
• azurerm_redhat_openshift_cluster - add support for the platform_workload_identity_profile block (#32473)
• azurerm_role_assignment - the condition, condition_version, and description properties can now be updated in-place (#32714)
• azurerm_snapshot - create_option now supports CopyStart (#32834)

BUG FIXES:

... (truncated)

Commits

• 9215c42 CHANGELOG.md for 5.3.0 (#33184)
• 8f8a2f8 azurerm_eventhub_namespace - prevent network_rulesets.x.default_action b...
• 8e22f4a azurerm_kubernetes_cluster - Add oms_agent.retina_flow_logs_enabled suppo...
• 8b19cbe Tests: fix tests and expand identity test generator (#33235)
• 508192c pollers - remove EC-like StateChangeConf in favour of EC poller 5/5 (#33227)
• 032b5b5 pollers - remove EC-like StateChangeConf in favour of EC poller 4/5 (#33226)
• 6025e1f pollers - remove EC-like StateChangeConf in favour of EC poller 3/5 (#33225)
• 821b7af machinelearning: fix flattenIdentity comparing TenantId to the literal string...
• 53b39b5 linters - AZS004 complete enum lists to PossibleValuesFor<Enum>() 1/4 - servi...
• 77d2a6b fix: missing import (#33234)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Dependabot Auto-Merge Policy

Auto-merge is currently blocked by policy for this pull request.

• Reason: Dependabot metadata is unavailable, so auto-merge is blocked. Manual review required.
• Policy code: metadata_unavailable
• Update type: unknown
• Dependencies: cloudflare/cloudflare, hashicorp/azurerm

Next action: manual review and merge is required.

This comment is maintained automatically by the dependabot-policy action.

[github-actions]

🏗️ Terraform Plan

🌍 Environment: dev

✅ Validate — Passed

❌ Plan — Failed. Check the workflow logs for details.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud