Merge remote-tracking branch 'upstream/dev' into announce-deprecation-of-network-resource-provisioning-from-any-flexible-server-commands

Author: nachoalonsoportillo

.gitattributes

@@ -16,6 +16,10 @@ build_scripts/windows/scripts/az eol=lf
 # sh scripts should be LF
 *.sh eol=lf
 
+# Git hook scripts (no extension) should be LF to work on macOS/Linux
+.githooks/pre-commit eol=lf
+.githooks/pre-push eol=lf
+
 # Generated latest index assets should always use LF to avoid cross-platform churn
 src/azure-cli-core/azure/cli/core/commandIndex.latest.json text eol=lf
 src/azure-cli-core/azure/cli/core/helpIndex.latest.json text eol=lf

.github/CODEOWNERS

@@ -16,6 +16,7 @@
 /src/azure-cli-core/ @necusjz @DanielMicrosoft @ReaNAiveD @yonzhan @bebound @jiasli
 /src/azure-cli-core/azure/cli/core/_profile.py @isra-fel @notyashhh @xuming-ms @teresaritorto
 /src/azure-cli-core/azure/cli/core/auth/ @isra-fel @notyashhh @xuming-ms @teresaritorto
+/src/azure-cli-core/azure/cli/core/cloud.py @isra-fel @notyashhh @xuming-ms @teresaritorto
 /src/azure-cli-core/azure/cli/core/extension/ @VeryEarly @Pan-Qi @jsntcy @necusjz
 /src/azure-cli-core/azure/cli/core/style.py @NoriZC @yanzhudd @teresaritorto
 /src/azure-cli-core/azure/cli/core/aaz/ @VeryEarly @Pan-Qi @jsntcy @necusjz

.github/policies/resourceManagement.yml

@@ -109,6 +109,174 @@ configuration:
       - removeLabel:
           label: no-recent-activity
       description: '[Resolve Workflow] Issue Addressed Label Applied'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-identity-squad
+      then:
+      - requestReview:
+          reviewer: act-identity-squad
+      - mentionUsers:
+          mentionees:
+          - act-identity-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-identity-squad'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-observability-squad
+      then:
+      - requestReview:
+          reviewer: act-observability-squad
+      - mentionUsers:
+          mentionees:
+          - act-observability-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-observability-squad'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-codegen-extensibility-squad
+      then:
+      - requestReview:
+          reviewer: act-codegen-extensibility-squad
+      - mentionUsers:
+          mentionees:
+          - act-codegen-extensibility-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-codegen-extensibility-squad'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-quality-productivity-squad
+      then:
+      - requestReview:
+          reviewer: act-quality-productivity-squad
+      - mentionUsers:
+          mentionees:
+          - act-quality-productivity-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-quality-productivity-squad'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-platform-engineering-squad
+      then:
+      - requestReview:
+          reviewer: act-platform-engineering-squad
+      - mentionUsers:
+          mentionees:
+          - act-platform-engineering-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-platform-engineering-squad'
+    - if:
+      - payloadType: Pull_Request
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-experience-enablement-squad
+      then:
+      - requestReview:
+          reviewer: act-experience-enablement-squad
+      - mentionUsers:
+          mentionees:
+          - act-experience-enablement-squad
+          replyTemplate: ":bell: Routing this PR to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Request review & mention when PR labeled act-experience-enablement-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-identity-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-identity-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-identity-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-observability-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-observability-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-observability-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-codegen-extensibility-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-codegen-extensibility-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-codegen-extensibility-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-quality-productivity-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-quality-productivity-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-quality-productivity-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-platform-engineering-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-platform-engineering-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-platform-engineering-squad'
+    - if:
+      - payloadType: Issues
+      - isAction:
+          action: Labeled
+      - hasLabel:
+          label: act-experience-enablement-squad
+      then:
+      - mentionUsers:
+          mentionees:
+          - act-experience-enablement-squad
+          replyTemplate: ":bell: Routing this issue to ${mentionees}."
+          assignMentionees: False
+      description: '[Squad Auto-Assign] Mention when issue labeled act-experience-enablement-squad'
     - if:
       - payloadType: Issue_Comment
       - hasLabel:

azure-pipelines.yml

@@ -1094,7 +1094,7 @@ jobs:
   - bash: |
       set -ev
       . env/bin/activate
-      python scripts/generate_latest_indices.py verify
+      azdev latest-index verify --repo .
     displayName: 'Verify generated latest indices'
 
 - job: CheckStyle

doc/assets/batched-ci-pipeline.png

@@ -163,6 +163,27 @@ Style Checks
 azdev style <module> [--pylint] [--pep8]
 ```
 
+Latest Packaged Indices
+-----------------------
+
+Use azdev wrappers around Azure CLI's latest index generation script:
+
+```
+azdev latest-index generate
+azdev latest-index verify
+```
+
+You can pass an explicit Azure CLI checkout path when needed:
+
+```
+azdev latest-index generate --cli /path/to/azure-cli
+azdev latest-index verify --cli /path/to/azure-cli
+```
+
+`azdev latest-index verify` exits non-zero when generated output differs from
+the checked-in `commandIndex.latest.json` or `helpIndex.latest.json`, making it
+CI-friendly.
+
 Submitting Pull Requests
 ------------------------
 

doc/authoring_command_modules/README.md

@@ -1,10 +1,9 @@
 The Scrum Master role of CLI is primarily release-focused, but also includes several ongoing responsibilities:
-- Host the weekly sync meeting every Thursday.
 - Attend office hours held on Tuesday and Friday.
   - Join this [channel](https://teams.microsoft.com/l/chat/19:e4bb31fd84ab4f2f9375ad848e8a80fa@thread.v2/conversations?context=%7B%22contextType%22%3A%22chat%22%7D). If there is any topic related to CLI requested, make sure to join the call. Request product manager to add you to the meeting series.
-- Monitor Batched CI on a regular basis:
+- Monitor [Batched CI](https://dev.azure.com/azclitools/public/_build?definitionId=32&_a=summary&repositoryFilter=12&branchFilter=487%2C487%2C487) on a regular basis:
 
-  ![](https://raw.githubusercontent.com/Azure/azure-cli/refs/heads/dev/doc/assets/batched-ci.png)
+  ![](https://raw.githubusercontent.com/Azure/azure-cli/refs/heads/dev/doc/assets/batched-ci-pipeline.png)
   - Ensure that Batched CI is in a normal state before the release. If there are any failures, coordinate with the corresponding engineer to resolve them.
 
 The Azure CLI release process is highly automated **with some manual intervention steps** and has evolved to use both Azure DevOps and GitHub Actions.

doc/scrum-master's-playbook.md

@@ -278,7 +278,9 @@ def _run_verify(command_text, help_text):
         print('Generated latest index files are out of date:')
         for path in mismatched:
             print(f'  - {path.relative_to(REPO_ROOT)}')
-        print('Run:')
+        print('Run either:')
+        print('  azdev latest-index generate --cli .')
+        print('or:')
         print('  python scripts/generate_latest_indices.py generate')
         return 1
 

scripts/generate_latest_indices.py

@@ -3,6 +3,16 @@
 Release History
 ===============
 
+2.85.0
+++++++
+* Resolve CVE-2026-26007 (#32879)
+* `az *`: Make `--acquire-policy-token` and `--change-reference` global arguments available by default, removing the need for `core.enable_policy_token` configuration (#32883)
+* Resolve CVE-2026-27448 (#33035)
+* Resolve CVE-2026-27459 (#33035)
+* Resolve CVE-2026-32597 (#33034)
+* Resolve CVE-2026-25645 (#33081)
+* Resolve CVE-2026-34073 (#33099)
+
 2.84.0
 ++++++
 * Minor fixes

src/azure-cli-core/HISTORY.rst

@@ -4,14 +4,12 @@
 # --------------------------------------------------------------------------------------------
 # pylint: disable=line-too-long
 
-__version__ = "2.84.0"
+__version__ = "2.85.0"
 
 import os
 import sys
 import json
-import timeit
-import concurrent.futures
-from concurrent.futures import ThreadPoolExecutor
+import time
 
 from knack.cli import CLI
 from knack.commands import CLICommandsLoader
@@ -322,14 +320,14 @@ def _update_command_table_from_modules(args, command_modules=None):
                 except ImportError as e:
                     logger.warning(e)
 
-            start_time = timeit.default_timer()
+            start_time = time.perf_counter()
             logger.debug("Loading command modules...")
             results = self._load_modules(args, command_modules)
 
             count, cumulative_group_count, cumulative_command_count = \
                 self._process_results_with_timing(results)
 
-            total_elapsed_time = timeit.default_timer() - start_time
+            total_elapsed_time = time.perf_counter() - start_time
             # Summary line
             logger.debug(self.item_format_string,
                          "Total ({})".format(count), total_elapsed_time,
@@ -404,7 +402,7 @@ def _filter_modname(extensions):
                     # Add to the map. This needs to happen before we load commands as registering a command
                     # from an extension requires this map to be up-to-date.
                     # self._mod_to_ext_map[ext_mod] = ext_name
-                    start_time = timeit.default_timer()
+                    start_time = time.perf_counter()
                     extension_command_table, extension_group_table, extension_command_loader = \
                         _load_extension_command_loader(self, args, ext_mod)
                     import_extension_breaking_changes(ext_mod)
@@ -427,7 +425,7 @@ def _filter_modname(extensions):
                     self.command_table.update(extension_command_table)
                     self.command_group_table.update(extension_group_table)
 
-                    elapsed_time = timeit.default_timer() - start_time
+                    elapsed_time = time.perf_counter() - start_time
                     logger.debug(self.item_ext_format_string, ext_name, elapsed_time,
                                  len(extension_group_table), len(extension_command_table),
                                  ext_dir)
@@ -667,6 +665,8 @@ def load_arguments(self, command=None):
 
     def _load_modules(self, args, command_modules):
         """Load command modules using ThreadPoolExecutor with timeout protection."""
+        import concurrent.futures
+        from concurrent.futures import ThreadPoolExecutor
         from azure.cli.core.commands import BLOCKED_MODS
 
         results = []
@@ -708,10 +708,10 @@ def _load_single_module(self, mod, args):
         from azure.cli.core.commands import _load_module_command_loader
         import traceback
         try:
-            start_time = timeit.default_timer()
+            start_time = time.perf_counter()
             module_command_table, module_group_table, command_loader = _load_module_command_loader(self, args, mod)
             import_module_breaking_changes(mod)
-            elapsed_time = timeit.default_timer() - start_time
+            elapsed_time = time.perf_counter() - start_time
             return ModuleLoadResult(mod, module_command_table, module_group_table, elapsed_time, command_loader=command_loader)
         except Exception as ex:  # pylint: disable=broad-except
             tb_str = traceback.format_exc()
@@ -1227,7 +1227,7 @@ def update(self, command_table):
 
         :param command_table: The command table built by azure.cli.core.MainCommandsLoader.load_command_table
         """
-        start_time = timeit.default_timer()
+        start_time = time.perf_counter()
         self.INDEX[self._COMMAND_INDEX_VERSION] = __version__
         self.INDEX[self._COMMAND_INDEX_CLOUD_PROFILE] = self.cloud_profile
         from collections import defaultdict
@@ -1242,7 +1242,7 @@ def update(self, command_table):
             if module_name not in index[top_command]:
                 index[top_command].append(module_name)
 
-        elapsed_time = timeit.default_timer() - start_time
+        elapsed_time = time.perf_counter() - start_time
         self.INDEX[self._COMMAND_INDEX] = index
 
         self.update_extension_index(command_table)