openshift · cloud-team-rebase-bot · Oct 2, 2025 · Mar 20, 2026 · Mar 24, 2026 · Mar 24, 2026
diff --git a/.codespellignore b/.codespellignore
@@ -7,3 +7,4 @@ shouldnot
 decorder
 overriden
 wit
+ist
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependabot-code-gen.yml b/.github/workflows/dependabot-code-gen.yml
@@ -20,20 +20,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
       with:
         egress-policy: audit
     - name: Get Go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
-    - name: Get Go version
-      id: vars
-      run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - name: Get Go version
+      id: vars
+      run: echo "go_version=$(make go-version)" >> "$GITHUB_OUTPUT"
+    - name: Set up Go
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version: ${{ steps.vars.outputs.go_version }}
+      id: go
-    - name: Get Go version
-      id: vars
-      run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - name: Get Go version
+      id: vars
+      run: echo "go_version=$(make go-version)" >> "$GITHUB_OUTPUT"
+    - name: Set up Go
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version: ${{ steps.vars.outputs.go_version }}
+      id: go
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # tag=v5.0.4
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # tag=v5.0.5
       name: Restore go cache
       with:
         path: |

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 

diff --git a/.github/workflows/pr-golangci-lint.yaml b/.github/workflows/pr-golangci-lint.yaml
@@ -25,7 +25,7 @@ jobs:
         run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
         with:
           go-version: ${{ steps.vars.outputs.go_version }}
 

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
@@ -63,14 +63,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/weekly-security-scan.yaml b/.github/workflows/weekly-security-scan.yaml
@@ -14,7 +14,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [ main, release-1.22, release-1.21 ]
+        branch: [ main, release-1.23, release-1.22 ]
     name: Trivy
     runs-on: ubuntu-latest
     steps:
@@ -26,7 +26,7 @@ jobs:
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # tag=v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Run verify security target

diff --git a/.golangci.yml b/.golangci.yml
@@ -160,7 +160,7 @@ linters:
               - jsontags          # Ensures proper JSON tag formatting
               - nofloats          # Prevents float type usage
               - nomaps            # Restricts map usage
-              - nonullable        # Prevents usage of the nullable marker 
+              - nonullable        # Prevents usage of the nullable marker
               - nophase           # Prevents Phase field usage
               - notimestamp       # Prevents TimeStamp field usage
           lintersConfig: {}
@@ -340,6 +340,10 @@ linters:
         - staticcheck
         path: .*\.go$
         text: 'SA1019: "sigs.k8s.io/cluster-api/util/deprecated/.*" is deprecated: This package is deprecated and is going to be removed when support for v1beta1 will be dropped.'
+      # Ignore GetEventRecorderFor deprecation (CAPI itself still uses it).
+      - linters:
+          - staticcheck
+        text: 'SA1019: (env|mgr|testEnv).GetEventRecorderFor is deprecated'
       # Ignore CAPZ v1beta1 deprecations (SharedGallery, VMState) still used for backward compatibility.
       - linters:
           - staticcheck

diff --git a/AGENTS.md b/AGENTS.md
@@ -117,6 +117,8 @@ make kind-reset
 
 **tilt-settings.yaml** is required with Azure credentials (see docs/book/src/developers/development.md for details).
 
+`make tilt-up` runs `check-az-cli`; if `az` is missing, it warns and tells you to install the Azure CLI and retry `make tilt-up` (needed for Tilt flows that call `az`, e.g. VNet peering with AKS as management cluster). Use `VERBOSE=1 make check-az-cli` to print the detected binary path.
+
 ### E2E Testing
 
 ```bash
@@ -201,7 +203,7 @@ make generate-go  # Regenerates mocks in azure/services/*/mock_*/
 - `main.go`: Entry point, registers controllers and webhooks
 - `Makefile`: All build/test/dev targets
 - `Tiltfile`: Local development with Tilt
-- `go.mod`: Go dependencies (uses Go 1.24+)
+- `go.mod`: Go dependencies (uses Go 1.25+)
 - `config/`: Kustomize configurations for CRDs, RBAC, webhooks, manager
 - `templates/`: Cluster template flavors for different scenarios
 - `test/e2e/`: E2E test suites and data files

diff --git a/CHANGELOG/v1.22.2.md b/CHANGELOG/v1.22.2.md
@@ -0,0 +1,43 @@
+## Changes by Kind
+
+### Other (Cleanup or Flake)
+
+- Bump CAPI to v1.11.7 ([#6174](https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/6174), [@mboersma](https://github.com/mboersma))
+
+## Dependencies
+
+### Added
+- sigs.k8s.io/structured-merge-diff/v6: v6.3.2
+
+### Changed
+- cel.dev/expr: v0.24.0 → v0.25.1
+- github.com/cloudflare/circl: [v1.6.1 → v1.6.3](https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3)
+- github.com/cncf/xds/go: [0feb691 → ee656c7](https://github.com/cncf/xds/compare/0feb691...ee656c7)
+- github.com/envoyproxy/go-control-plane/envoy: [v1.35.0 → v1.36.0](https://github.com/envoyproxy/go-control-plane/compare/envoy/v1.35.0...envoy/v1.36.0)
+- github.com/envoyproxy/go-control-plane: [75eaa19 → v0.14.0](https://github.com/envoyproxy/go-control-plane/compare/75eaa19...v0.14.0)
+- github.com/envoyproxy/protoc-gen-validate: [v1.2.1 → v1.3.0](https://github.com/envoyproxy/protoc-gen-validate/compare/v1.2.1...v1.3.0)
+- github.com/grpc-ecosystem/grpc-gateway/v2: [v2.27.3 → v2.27.7](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.3...v2.27.7)
+- go.opentelemetry.io/contrib/detectors/gcp: v1.38.0 → v1.39.0
+- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.60.0 → v0.65.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.22.0 → v1.40.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/metric: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/sdk/metric: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/sdk: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel/trace: v1.39.0 → v1.40.0
+- go.opentelemetry.io/otel: v1.39.0 → v1.40.0
+- golang.org/x/oauth2: v0.32.0 → v0.34.0
+- google.golang.org/genproto/googleapis/api: ff82c1b → 8636f87
+- google.golang.org/genproto/googleapis/rpc: ff82c1b → 8636f87
+- google.golang.org/grpc: v1.77.0 → v1.79.3
+- google.golang.org/protobuf: v1.36.10 → v1.36.11
+- sigs.k8s.io/cluster-api/test: v1.11.6 → v1.11.7
+- sigs.k8s.io/cluster-api: v1.11.6 → v1.11.7
+
+### Removed
+_Nothing has changed._
+
+## Details
+<!-- markdown-link-check-disable-next-line -->
+https://github.com/kubernetes-sigs/cluster-api-provider-azure/compare/v1.22.1...v1.22.2
diff --git a/CHANGELOG/v1.22.4.md b/CHANGELOG/v1.22.4.md
@@ -0,0 +1,63 @@
+## Changes by Kind
+
+### Other (Cleanup or Flake)
+
+- Bump CAPI to v1.11.10 ([#6249](https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/6249), [@mboersma](https://github.com/mboersma))
+
+## Dependencies
+
+### Added
+- github.com/moby/moby/api: [v1.54.1](https://github.com/moby/moby/tree/api/v1.54.1)
+- github.com/moby/moby/client: [v0.4.0](https://github.com/moby/moby/tree/client/v0.4.0)
+- github.com/russross/blackfriday: [v1.6.0](https://github.com/russross/blackfriday/tree/v1.6.0)
+- github.com/santhosh-tekuri/jsonschema/v5: [v5.3.1](https://github.com/santhosh-tekuri/jsonschema/tree/v5.3.1)
+- pgregory.net/rapid: v1.2.0
+
+### Changed
+- github.com/Azure/go-ansiterm: [306776e → faa5f7b](https://github.com/Azure/go-ansiterm/compare/306776e...faa5f7b)
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: [v1.30.0 → v1.31.0](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/compare/detectors/gcp/v1.30.0...detectors/gcp/v1.31.0)
+- github.com/Microsoft/go-winio: [v0.5.0 → v0.6.2](https://github.com/Microsoft/go-winio/compare/v0.5.0...v0.6.2)
+- github.com/creack/pty: [v1.1.18 → v1.1.24](https://github.com/creack/pty/compare/v1.1.18...v1.1.24)
+- github.com/docker/go-connections: [v0.5.0 → v0.6.0](https://github.com/docker/go-connections/compare/v0.5.0...v0.6.0)
+- github.com/docker/go-units: [v0.4.0 → v0.5.0](https://github.com/docker/go-units/compare/v0.4.0...v0.5.0)
+- github.com/emicklei/go-restful/v3: [v3.12.2 → v3.13.0](https://github.com/emicklei/go-restful/compare/v3.12.2...v3.13.0)
+- github.com/grpc-ecosystem/grpc-gateway/v2: [v2.27.7 → v2.28.0](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.7...v2.28.0)
+- github.com/moby/term: [v0.5.0 → v0.5.2](https://github.com/moby/term/compare/v0.5.0...v0.5.2)
+- github.com/opencontainers/image-spec: [v1.0.2 → v1.1.1](https://github.com/opencontainers/image-spec/compare/v1.0.2...v1.1.1)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/metric: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk/metric: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel/trace: v1.40.0 → v1.43.0
+- go.opentelemetry.io/otel: v1.40.0 → v1.43.0
+- go.opentelemetry.io/proto/otlp: v1.9.0 → v1.10.0
+- golang.org/x/crypto: v0.47.0 → v0.49.0
+- golang.org/x/mod: v0.32.0 → v0.33.0
+- golang.org/x/net: v0.49.0 → v0.52.0
+- golang.org/x/oauth2: v0.34.0 → v0.35.0
+- golang.org/x/sync: v0.19.0 → v0.20.0
+- golang.org/x/sys: v0.40.0 → v0.42.0
+- golang.org/x/telemetry: 8fff8a5 → e7419c6
+- golang.org/x/term: v0.39.0 → v0.41.0
+- golang.org/x/text: v0.33.0 → v0.35.0
+- golang.org/x/tools: v0.40.0 → v0.42.0
+- gonum.org/v1/gonum: v0.16.0 → v0.17.0
+- google.golang.org/genproto/googleapis/api: 8636f87 → 9d38bb4
+- google.golang.org/genproto/googleapis/rpc: 8636f87 → 9d38bb4
+- google.golang.org/grpc: v1.79.3 → v1.80.0
+- gotest.tools/v3: v3.4.0 → v3.5.2
+- sigs.k8s.io/cluster-api/test: v1.11.7 → v1.11.10
+- sigs.k8s.io/cluster-api: v1.11.7 → v1.11.10
+
+### Removed
+- github.com/containerd/log: [v0.1.0](https://github.com/containerd/log/tree/v0.1.0)
+- github.com/docker/docker: [v28.3.3+incompatible](https://github.com/docker/docker/tree/v28.3.3)
+- github.com/moby/sys/atomicwriter: [v0.1.0](https://github.com/moby/sys/tree/atomicwriter/v0.1.0)
+- github.com/moby/sys/sequential: [v0.6.0](https://github.com/moby/sys/tree/sequential/v0.6.0)
+- github.com/morikuni/aec: [v1.0.0](https://github.com/morikuni/aec/tree/v1.0.0)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.40.0
+
+## Details
+<!-- markdown-link-check-disable-next-line -->
+https://github.com/kubernetes-sigs/cluster-api-provider-azure/compare/v1.22.2...v1.22.4
diff --git a/CHANGELOG/v1.23.1.md b/CHANGELOG/v1.23.1.md
@@ -0,0 +1,57 @@
+## Changes by Kind
+
+### Other (Cleanup or Flake)
+
+- Bump CAPI to v1.12.7 ([#6250](https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/6250), [@mboersma](https://github.com/mboersma))
+
+## Dependencies
+
+### Added
+- github.com/moby/moby/api: [v1.54.1](https://github.com/moby/moby/tree/api/v1.54.1)
+- github.com/moby/moby/client: [v0.4.0](https://github.com/moby/moby/tree/client/v0.4.0)
+- github.com/russross/blackfriday: [v1.6.0](https://github.com/russross/blackfriday/tree/v1.6.0)
+- github.com/santhosh-tekuri/jsonschema/v5: [v5.3.1](https://github.com/santhosh-tekuri/jsonschema/tree/v5.3.1)
+- pgregory.net/rapid: v1.2.0
+
+### Changed
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: [v1.30.0 → v1.31.0](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/compare/detectors/gcp/v1.30.0...detectors/gcp/v1.31.0)
+- github.com/Microsoft/go-winio: [v0.5.0 → v0.6.2](https://github.com/Microsoft/go-winio/compare/v0.5.0...v0.6.2)
+- github.com/coredns/corefile-migration: [v1.0.30 → v1.0.31](https://github.com/coredns/corefile-migration/compare/v1.0.30...v1.0.31)
+- github.com/creack/pty: [v1.1.18 → v1.1.24](https://github.com/creack/pty/compare/v1.1.18...v1.1.24)
+- github.com/docker/go-units: [v0.4.0 → v0.5.0](https://github.com/docker/go-units/compare/v0.4.0...v0.5.0)
+- github.com/opencontainers/image-spec: [v1.0.2 → v1.1.1](https://github.com/opencontainers/image-spec/compare/v1.0.2...v1.1.1)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel/metric: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk/metric: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel/sdk: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel/trace: v1.41.0 → v1.43.0
+- go.opentelemetry.io/otel: v1.41.0 → v1.43.0
+- go.opentelemetry.io/proto/otlp: v1.9.0 → v1.10.0
+- golang.org/x/crypto: v0.48.0 → v0.49.0
+- golang.org/x/net: v0.50.0 → v0.52.0
+- golang.org/x/sync: v0.19.0 → v0.20.0
+- golang.org/x/sys: v0.41.0 → v0.42.0
+- golang.org/x/telemetry: bd525da → e7419c6
+- golang.org/x/term: v0.40.0 → v0.41.0
+- golang.org/x/text: v0.34.0 → v0.35.0
+- golang.org/x/tools: v0.41.0 → v0.42.0
+- gonum.org/v1/gonum: v0.16.0 → v0.17.0
+- google.golang.org/genproto/googleapis/api: 4cfbd41 → 9d38bb4
+- google.golang.org/genproto/googleapis/rpc: 4cfbd41 → 9d38bb4
+- google.golang.org/grpc: v1.79.1 → v1.80.0
+- gotest.tools/v3: v3.4.0 → v3.5.2
+- sigs.k8s.io/cluster-api/test: v1.12.4 → v1.12.7
+- sigs.k8s.io/cluster-api: v1.12.4 → v1.12.7
+
+### Removed
+- github.com/containerd/log: [v0.1.0](https://github.com/containerd/log/tree/v0.1.0)
+- github.com/docker/docker: [v28.5.2+incompatible](https://github.com/docker/docker/tree/v28.5.2)
+- github.com/moby/sys/atomicwriter: [v0.1.0](https://github.com/moby/sys/tree/atomicwriter/v0.1.0)
+- github.com/moby/sys/sequential: [v0.6.0](https://github.com/moby/sys/tree/sequential/v0.6.0)
+- github.com/morikuni/aec: [v1.0.0](https://github.com/morikuni/aec/tree/v1.0.0)
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.40.0
+
+## Details
+<!-- markdown-link-check-disable-next-line -->
+https://github.com/kubernetes-sigs/cluster-api-provider-azure/compare/v1.23.0...v1.23.1
-Original file line number
+Diff line change
@@ Expand Up / @@ -7,3 +7,4 @@ shouldnot @@
     decorder
     overriden
     wit
+    ist