Update azure-sdk-for-js monorepo

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@azure/identity (source)	4.2.1 -> 4.13.0
@azure/keyvault-secrets (source)	4.8.0 -> 4.10.0

---

Release Notes

Azure/azure-sdk-for-js (@​azure/identity)

v4.13.0

Compare Source

v4.11.1

Compare Source

v4.11.0

Compare Source

v4.10.2

Compare Source

v4.10.1

Compare Source

v4.10.0

Compare Source

v4.9.1

Compare Source

v4.9.0

Compare Source

v4.8.0

Compare Source

v4.7.0

Compare Source

v4.6.0

Compare Source

v4.5.0

Compare Source

v4.4.1

Compare Source

v4.4.0

Compare Source

v4.3.0

Compare Source

4.3.0 (2025-03-18)

Features Added

Client-side Encryption (Preview) #​28760

Add support for Client-Side Encryption. Read more here: docs

Example of using Client-Side Encryption:

 const credentials = new DefaultAzureCredential();
 const keyResolver = new AzureKeyVaultEncryptionKeyResolver(credentials);
 const cosmosClient = new CosmosClient({connectionString: "<ConnectionString>", clientEncryptionOptions: { keyEncryptionKeyResolver: keyResolver }});
 const database = cosmosClient.database("my-database");
 const metadata: EncryptionKeyWrapMetadata = {
     type: EncryptionKeyResolverName.AzureKeyVault, 
     name: "akvKey", 
     value: "https://<my-key-vault>.vault.azure.net/keys/<key>/<version>",
     algorithm: KeyEncryptionAlgorithm.RSA_OAEP
 };

 await database.createClientEncryptionKey(
     "my-key",
     EncryptionAlgorithm.AEAD_AES_256_CBC_HMAC_SHA256,
     metadata);

 const path1 : ClientEncryptionIncludedPath = {
   path: "/property1",
   clientEncryptionKeyId: "my-key",
   encryptionType: EncryptionType.DETERMINISTIC,
   encryptionAlgorithm: EncryptionAlgorithm.AEAD_AES_256_CBC_HMAC_SHA256,
 };
 const path2 : ClientEncryptionIncludedPath = {
   path: "/property2",
   clientEncryptionKeyId: "my-key",
   encryptionType: EncryptionType.DETERMINISTIC,
   encryptionAlgorithm: EncryptionAlgorithm.AEAD_AES_256_CBC_HMAC_SHA256,
 };
 const paths = [path1, path2];
 const clientEncryptionPolicy = {
     includedPaths: [path],
     policyFormatVersion: 2,
 };
 const containerDefinition = {
     id: "my-container",
     partitionKey: {
       paths: ["/id"],
     },
     clientEncryptionPolicy: clientEncryptionPolicy,
 };
 await database.containers.createIfNotExists(containerDefinition);

New Query Pipeline

Introduced enableQueryControl flag to enhance query pipeline, giving users more control over their query execution.

By default, value of enableQueryControl is set as false keeping query pipeline older behavior as default, as explained below:

Previously, the SDK guaranteed that each fetchNext call would return maxItemCount number of results, provided those many results existed in the backend. While this behavior ensured a predictable output, the SDK may query backend partitions multiple times in a single fetchNext iteration. This can sometimes lead to higher RU consumption with no user control, especially when results are scattered across partitions. Also queries could run for extended periods as the SDK worked to fulfil the maxItemCount guarantee.

When enableQueryControl is set to true, Each fetchNext call will now query up to maxDegreeOfParallelism physical partitions. If no results are found, the SDK will return empty pages instead of continuing to search all partitions. Returning fewer or empty results in each iteration consumes less RUs and hands control back to the users, allowing them to decide whether to continue fetching more data. This approach provides more granular control over RU consumption.

Eg. usage of this flag to enable new query pipeline:

const options : FeedOptions = {
  enableQueryControl: true, // Flag to enable new query pipeline. Default value is false
  maxItemCount: 100,
  maxDegreeOfParallelism: 10,
  forceQueryPlan: true,
}
const queryIterator = container.items.query("query text", options);
const res = await queryIterator.fetchNext();

Partition merge support

This feature adds support for Partition merge (preview) feature. Requests from SDK will not be blocked, when the feature is enabled on the CosmosDB account.
Read more about merge here: docs

RU Bucketing (Preview)

Read more about RU Bucketing here: https://aka.ms/cosmsodb-bucketing

Partial hierarchical partition key support in Change Feed #​27059

This feature adds support for partial hierarchical partition key in Change Feed allowing the SDK to work seamlessly with partial Hierarchical partition keys, returning accurate change feed results regardless of which partition key components are provided in the iterator.

Eg. Container has partition key ["/name", "/zip", "/state"], change feed will work if, only value of name and zip is provided eg: ["john", "11011"]

Index Metrics V2 support

This feature adds support for V2 version of index metrics that returns the response in JSON format.

Example output of older version

Index Utilization Information
  Utilized Single Indexes
    Index Spec: /Item/?
    Index Impact Score: High
    ---
    Index Spec: /Price/?
    Index Impact Score: High
    ---
  Potential Single Indexes
  Utilized Composite Indexes
  Potential Composite Indexes
    Index Spec: /Item ASC, /Price ASC
    Index Impact Score: High
    ---

Example output of version V2

{"UtilizedIndexes":{"SingleIndexes":[{"IndexSpec":"/Item/?"},{"IndexSpec":"/Price/?"}],"CompositeIndexes":[]},"PotentialIndexes":{"SingleIndexes":[],"CompositeIndexes":[{"IndexSpecs":["/Item ASC","/Price ASC"],"IndexImpactScore":"High"}]}}

Add connectionString in CosmosClientOptions

ConnectionString can now be configured in CosmosClientOptions along with other configurations for client initialization.
Eg. usage:

const options = {
  connectionString: "<ConnectionString>",
  consistencyLevel: ConsistencyLevel.Strong
}

Bugs Fixed

• Fixed issue for incorrect ParallelizeCrossPartitionQuery header value. It was set to true if maxDegreeOfParallelism was set to 0 or 1 in FeedOptions while executing a query. #​31232
• Fixed the issue for incorrect results in Changefeed in case of internal TimeoutErrors #​32652
• Fix RequestOptions and SharedOptions #​27336
• Set default values in RetryOptions #​27312

Other Changes

• Deprecate the older changeFeed iterator in favor of the newer getChangeFeedIterator() method. #​32650

---

Configuration

📅 Schedule: Branch creation - "after 7am and before 11am every weekday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hmcts-platform-operations]

Plan Result (sds_ptl - TerraformPlanApply)

Plan: 0 to add, 1 to change, 0 to destroy.

• Update
  • azurerm_user_assigned_identity.this

Change Result (Click me)

  # azurerm_user_assigned_identity.this will be updated in-place
  ~ resource "azurerm_user_assigned_identity" "this" {
        id                  = "/subscriptions/6c4d2513-a873-41b4-afdd-b05a33206631/resourceGroups/sds-alerts-slack-ptl/providers/Microsoft.ManagedIdentity/userAssignedIdentities/sds-alerts-slack-ptl"
        name                = "sds-alerts-slack-ptl"
      ~ tags                = {
          - "application"  = "core" -> null
          - "builtFrom"    = "hmcts/azure-alert-to-slack-function" -> null
          - "businessArea" = "Cross-Cutting" -> null
          - "environment"  = "production" -> null
        }
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[hmcts-platform-operations]

Plan Result (cft_ptl - TerraformPlanApply)

Plan: 0 to add, 1 to change, 0 to destroy.

• Update
  • azurerm_user_assigned_identity.this

Change Result (Click me)

  # azurerm_user_assigned_identity.this will be updated in-place
  ~ resource "azurerm_user_assigned_identity" "this" {
        id                  = "/subscriptions/1baf5470-1c3e-40d3-a6f7-74bfbce4b348/resourceGroups/cft-alerts-slack-ptl/providers/Microsoft.ManagedIdentity/userAssignedIdentities/cft-alerts-slack-ptl"
        name                = "cft-alerts-slack-ptl"
      ~ tags                = {
          - "application"  = "core" -> null
          - "builtFrom"    = "hmcts/azure-alert-to-slack-function" -> null
          - "businessArea" = "CFT" -> null
          - "environment"  = "production" -> null
        }
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[hmcts-platform-operations]

Plan Result (924: cft_ptl - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 3 to change, 1 to destroy.

• Update
  • azurerm_monitor_action_group.action_group
  • azurerm_user_assigned_identity.this
  • azurerm_windows_function_app.this
• Replace
  • module.application_insights.azurerm_monitor_activity_log_alert.main[0]

Change Result (Click me)

  # data.azurerm_function_app_host_keys.host_keys will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_function_app_host_keys" "host_keys" {
      + blobs_extension_key             = (sensitive value)
      + default_function_key            = (sensitive value)
      + durabletask_extension_key       = (sensitive value)
      + event_grid_extension_config_key = (sensitive value)
      + event_grid_extension_key        = (sensitive value)
      + id                              = (known after apply)
      + name                            = "cft-alerts-slack-ptl"
      + primary_key                     = (sensitive value)
      + resource_group_name             = "cft-alerts-slack-ptl"
      + signalr_extension_key           = (sensitive value)
      + webpubsub_extension_key         = (sensitive value)
    }

  # azurerm_monitor_action_group.action_group will be updated in-place
  ~ resource "azurerm_monitor_action_group" "action_group" {
        id                  = "/subscriptions/1baf5470-1c3e-40d3-a6f7-74bfbce4b348/resourceGroups/cft-alerts-slack-ptl/providers/Microsoft.Insights/actionGroups/cft-alerts-slack-warning-alerts"
        name                = "cft-alerts-slack-warning-alerts"
        tags                = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "CFT"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (4 unchanged attributes hidden)

      ~ azure_function_receiver {
          ~ http_trigger_url         = (sensitive value)
            name                     = "slack-alerts"
            # (3 unchanged attributes hidden)
        }
    }

  # azurerm_user_assigned_identity.this will be updated in-place
  ~ resource "azurerm_user_assigned_identity" "this" {
        id                  = "/subscriptions/1baf5470-1c3e-40d3-a6f7-74bfbce4b348/resourceGroups/cft-alerts-slack-ptl/providers/Microsoft.ManagedIdentity/userAssignedIdentities/cft-alerts-slack-ptl"
        name                = "cft-alerts-slack-ptl"
      ~ tags                = {
          - "application"  = "core" -> null
          - "builtFrom"    = "hmcts/azure-alert-to-slack-function" -> null
          - "businessArea" = "CFT" -> null
          - "environment"  = "production" -> null
        }
        # (5 unchanged attributes hidden)
    }

  # azurerm_windows_function_app.this will be updated in-place
  ~ resource "azurerm_windows_function_app" "this" {
      # Warning: this attribute value will no longer be marked as sensitive
      # after applying this change. The value is unchanged.
      ~ app_settings                                   = (sensitive value)
        id                                             = "/subscriptions/1baf5470-1c3e-40d3-a6f7-74bfbce4b348/resourceGroups/cft-alerts-slack-ptl/providers/Microsoft.Web/sites/cft-alerts-slack-ptl"
        name                                           = "cft-alerts-slack-ptl"
        tags                                           = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "CFT"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (33 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.application_insights.azurerm_monitor_activity_log_alert.main[0] must be replaced
-/+ resource "azurerm_monitor_activity_log_alert" "main" {
      ~ id                  = "/subscriptions/1baf5470-1c3e-40d3-a6f7-74bfbce4b348/resourceGroups/cft-alerts-slack-ptl/providers/Microsoft.Insights/activityLogAlerts/Application Insights daily cap reached - cft-alerts-ptl" -> (known after apply)
      ~ name                = "Application Insights daily cap reached - cft-alerts-ptl" -> "Application-Insights-daily-cap-reached-cft-alerts-ptl" # forces replacement
        tags                = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "CFT"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (5 unchanged attributes hidden)

      ~ criteria {
          - levels                  = [] -> null
          - resource_groups         = [] -> null
          - resource_ids            = [] -> null
          - resource_providers      = [] -> null
          - resource_types          = [] -> null
          - statuses                = [] -> null
          - sub_statuses            = [] -> null
            # (13 unchanged attributes hidden)

          ~ resource_health (known after apply)

          ~ service_health (known after apply)
        }

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 3 to change, 1 to destroy.

[hmcts-platform-operations]

Plan Result (924: sds_ptl - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 3 to change, 1 to destroy.

• Update
  • azurerm_monitor_action_group.action_group
  • azurerm_user_assigned_identity.this
  • azurerm_windows_function_app.this
• Replace
  • module.application_insights.azurerm_monitor_activity_log_alert.main[0]

Change Result (Click me)

  # data.azurerm_function_app_host_keys.host_keys will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_function_app_host_keys" "host_keys" {
      + blobs_extension_key             = (sensitive value)
      + default_function_key            = (sensitive value)
      + durabletask_extension_key       = (sensitive value)
      + event_grid_extension_config_key = (sensitive value)
      + event_grid_extension_key        = (sensitive value)
      + id                              = (known after apply)
      + name                            = "sds-alerts-slack-ptl"
      + primary_key                     = (sensitive value)
      + resource_group_name             = "sds-alerts-slack-ptl"
      + signalr_extension_key           = (sensitive value)
      + webpubsub_extension_key         = (sensitive value)
    }

  # azurerm_monitor_action_group.action_group will be updated in-place
  ~ resource "azurerm_monitor_action_group" "action_group" {
        id                  = "/subscriptions/6c4d2513-a873-41b4-afdd-b05a33206631/resourceGroups/sds-alerts-slack-ptl/providers/Microsoft.Insights/actionGroups/sds-alerts-slack-warning-alerts"
        name                = "sds-alerts-slack-warning-alerts"
        tags                = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "Cross-Cutting"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (4 unchanged attributes hidden)

      ~ azure_function_receiver {
          ~ http_trigger_url         = (sensitive value)
            name                     = "slack-alerts"
            # (3 unchanged attributes hidden)
        }
    }

  # azurerm_user_assigned_identity.this will be updated in-place
  ~ resource "azurerm_user_assigned_identity" "this" {
        id                  = "/subscriptions/6c4d2513-a873-41b4-afdd-b05a33206631/resourceGroups/sds-alerts-slack-ptl/providers/Microsoft.ManagedIdentity/userAssignedIdentities/sds-alerts-slack-ptl"
        name                = "sds-alerts-slack-ptl"
      ~ tags                = {
          - "application"  = "core" -> null
          - "builtFrom"    = "hmcts/azure-alert-to-slack-function" -> null
          - "businessArea" = "Cross-Cutting" -> null
          - "environment"  = "production" -> null
        }
        # (5 unchanged attributes hidden)
    }

  # azurerm_windows_function_app.this will be updated in-place
  ~ resource "azurerm_windows_function_app" "this" {
      # Warning: this attribute value will no longer be marked as sensitive
      # after applying this change. The value is unchanged.
      ~ app_settings                                   = (sensitive value)
        id                                             = "/subscriptions/6c4d2513-a873-41b4-afdd-b05a33206631/resourceGroups/sds-alerts-slack-ptl/providers/Microsoft.Web/sites/sds-alerts-slack-ptl"
        name                                           = "sds-alerts-slack-ptl"
        tags                                           = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "Cross-Cutting"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (33 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.application_insights.azurerm_monitor_activity_log_alert.main[0] must be replaced
-/+ resource "azurerm_monitor_activity_log_alert" "main" {
      ~ id                  = "/subscriptions/6c4d2513-a873-41b4-afdd-b05a33206631/resourceGroups/sds-alerts-slack-ptl/providers/Microsoft.Insights/activityLogAlerts/Application Insights daily cap reached - sds-alerts-ptl" -> (known after apply)
      ~ name                = "Application Insights daily cap reached - sds-alerts-ptl" -> "Application-Insights-daily-cap-reached-sds-alerts-ptl" # forces replacement
        tags                = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-alert-to-slack-function"
            "businessArea" = "Cross-Cutting"
            "criticality"  = "High"
            "environment"  = "production"
        }
        # (5 unchanged attributes hidden)

      ~ criteria {
          - levels                  = [] -> null
          - resource_groups         = [] -> null
          - resource_ids            = [] -> null
          - resource_providers      = [] -> null
          - resource_types          = [] -> null
          - statuses                = [] -> null
          - sub_statuses            = [] -> null
            # (13 unchanged attributes hidden)

          ~ resource_health (known after apply)

          ~ service_health (known after apply)
        }

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 3 to change, 1 to destroy.