chore(deps): bump the azure group across 1 directory with 7 updates

[dependabot]

Updates the requirements on azure-ai-agents, azure-identity, azure-cosmos, azure-ai-evaluation, azure-monitor-opentelemetry, azure-monitor-opentelemetry-exporter and azure-ai-projects to permit the latest version.
Updates azure-ai-agents from 1.2.0b5 to 1.2.0b6

Commits

• b8789d4 Fix missing await in telemetry wrapper methods for async Agent calls (#43606)
• 1edf91c skip tests in 3.14 (#43608)
• 56d46a8 [AutoRelease] t2-containerservice-2025-10-24-62327(can only be merged by SDK ...
• 9187477 [AutoRelease] t2-appcontainers-2025-10-09-42434(can only be merged by SDK own...
• f3f8cf3 [AutoRelease] t2-network-2025-09-23-00572(can only be merged by SDK owner) (#...
• 13fa29a [AutoRelease] t2-cognitiveservices-2025-10-10-76953(can only be merged by SDK...
• dce2b54 bump used proxy version (#43599)
• eae8a80 Added Samples for User Agents (#43561)
• 4022775 Silence Non-Blocking 1ESPT Error (#43585)
• bf7269d [Batch] Beta Data Plane SDK 15.1.0b1 (replacing 15.0.0b3) (#43590)
• Additional commits viewable in compare view

Updates azure-identity to 1.25.3

Release notes

Sourced from azure-identity's releases.

azure-identity_1.25.3

1.25.3 (2026-03-12)

Bugs Fixed

• Fixed an issue where an expired token could skip refresh when a recent token request was made, due to the retry delay taking precedence over expiration. (#45496)

Other Changes

• Bumped minimum dependency on msal to >=1.35.1.

Commits

• a989ea4 [Identity] Prep patch release
• 7972883 [Identity] Adjust refresh logic (#45496)
• 04764a9 add psscript to convert apiview json files to md (#45589)
• 50e0165 Sync eng/common directory with azure-sdk-tools for PR 14461 (#45646)
• 5333117 Add Bo to /sdk/ai/azure-ai-projects owner list (#45664)
• 775d694 Doc and automation updates for .github sync directory changes (#45630)
• c6e48b5 [Core] Prepare release (#45656)
• ae769c4 Fix custom Memory Stores LRO poller operation (#45662)
• 6074492 Add asset id none check in dt (#45618)
• e1a986a Bump tar from 7.5.10 to 7.5.11 in /eng/common/tsp-client (#45640)
• Additional commits viewable in compare view

Updates azure-cosmos to 4.15.0

Commits

• 54c81b9 [Groundedness] Check for intermediate (#45305)
• 145e110 [WIP] Revert changes to archetype-python-release.yml regarding py2docfx (#45295)
• 9d848cf recording (#45291)
• c62f73f Updates to package README.md (#45289)
• c0fade1 Fix beta subclient, such that all its members shows up in API ref-docs. Also ...
• 3682bda Sample test recording along with new LLM instruction (#45274)
• ef0ab33 Change depends to import_all in cosmos emulator ChecksOverride (#45284)
• 3479c73 [VoiceLive] Relocate azure-ai-voicelive to its own service directory (#45254)
• fc6c21a Redact credential token in default client logs controlled by env variable AZU...
• 6829ccb Fix apistub token path (#45271)
• Additional commits viewable in compare view

Updates azure-ai-evaluation to 1.16.5

Release notes

Sourced from azure-ai-evaluation's releases.

azure-ai-evaluation_1.16.5

1.16.5 (2026-04-08)

Bugs Fixed

• Fixed Jinja2 Server-Side Template Injection (SSTI) vulnerability by replacing unsandboxed jinja2.Template with jinja2.sandbox.SandboxedEnvironment across all template rendering paths (CWE-1336).
• Fixed sensitive_data_leakage risk category producing 0% attack success rate (false negatives) in the Foundry execution path. Agent-specific tool context (e.g., document_client_smode, email_client_smode) was stored in SeedObjective.metadata but never propagated to the target callback, so the agent could not access the sensitive data it was supposed to leak. Context is now delivered via prepended_conversation SeedPrompts and extracted from conversation history metadata, enabling the ACA runtime to build FunctionTool injections.
• Fixed multi-turn and crescendo red team strategies producing output items identical to their baseline counterparts. The Foundry execution path was writing all strategies' conversations to a single shared JSONL file, causing each strategy to read all conversations and mislabel them. Now writes per-strategy JSONL files using PyRIT's scenario result grouping.

Commits

• 0cfe8b7 Set CHANGELOG date to 2026-04-08, add Jinja2 SSTI entry, bump version to 1.16.5
• c0ae104 Fix sensitive_data_leakage tool context not reaching agent callback in Foundr...
• f447b23 Fix multi-turn/crescendo results showing single-turn baseline content (#46156)
• ec21a83 Fix Jinja2 SSTI vulnerability by using SandboxedEnvironment (#46160)
• 6f992d6 Add properties in Evaluation Result - Custom Evaluator extra fields. (#46077)
• a1ce738 Fix CHANGELOG spacing for 1.16.3 section
• 79769d4 Clean up CHANGELOG: remove empty sections, set release date 2026-04-01
• 490d3ed Fix evaluator token metrics not persisted in red teaming results (#46021)
• 1d3c3c1 Fix/redteam partial results (#45996)
• fc6bf76 Fix ASR scoring: use score-based threshold instead of passed field (#46000)
• Additional commits viewable in compare view

Updates azure-monitor-opentelemetry to 1.8.7

Release notes

Sourced from azure-monitor-opentelemetry's releases.

azure-monitor-opentelemetry_1.8.7

1.8.7 (2026-03-20)

Features Added

• Add Browser SDK loader feature (#42904)

Other Changes

• Change import path for LoggingHandler to accommodate upstream breaking changes (#45539)
• Remove internal import from sample file (#45619)

Commits

• 77b2899 Distro release 1.8.7 (#45801)
• 4b5be11 Change import path for LoggingHandler to accommodate upstream breaking change...
• 9950092 Increment package version after release of azure-monitor-opentelemetry-export...
• d563649 Exporter release 1.0.0b49 (#45558)
• 63f2acb Change import path for LoggingHandler to accommodate upstream breaking chan...
• 706371c Added a 256kb custom properties truncation limit on specific GenAI attributes...
• d88c947 Modify imports in sample file (#45619)
• ccbf8d4 Exempt specific GenAI attributes values from custom properties truncation (#4...
• 8b30817 Fix attributes override in Rate Limited Sampler (#45592)
• 5088eec [Monitor] Generate exporter with TypeSpec (#44442)
• Additional commits viewable in compare view

Updates azure-monitor-opentelemetry-exporter to 1.0.0b51

Release notes

Sourced from azure-monitor-opentelemetry-exporter's releases.

azure-monitor-opentelemetry-exporter_1.0.0b51

1.0.0b51 (2026-04-07)

Bugs Fixed

• Added credential authentication support for customer sdkstats (#46143)

Commits

• fc2b705 Exporter release 1.0.0b51 (#46155)
• 83a443d Added credential authentication support for customer sdkstats (#46143)
• ce4549d Increment package version after release of azure-monitor-opentelemetry-export...
• 24212d1 Exporter release 1.0.0b50 (#46054)
• 087778f Revert custom properties limit to 8kb (#46066)
• d8bed7e [monitor-opentelemetry] Fix duplicate auth policy in live metrics exporter (#...
• de23b45 Suppress internal sdkstats HTTP pipeline logs from appearing in user's traces...
• ce28bf7 Modify logic to ensure that the cloud_RoleInstance gets populated with the k8...
• 5fe509b Remove deprecated events package and methods (#45684)
• faf2a72 Increment package version after release of azure-monitor-opentelemetry (#45811)
• Additional commits viewable in compare view

Updates azure-ai-projects from 2.0.0b2 to 2.0.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions