chore(deps): bump the terraform-providers group across 1 directory with 5 updates

[dependabot]

Bumps the terraform-providers group with 5 updates in the /src directory:

Package	From	To
grafana/grafana	4.45.2	4.46.0
hashicorp/random	3.9.0	3.9.1
hashicorp/time	0.14.1	0.14.2
hashicorp/vault	5.11.0	5.12.0
stackitcloud/stackit	0.114.0	0.115.0

Updates grafana/grafana from 4.45.2 to 4.46.0

Release notes

Sourced from grafana/grafana's releases.

v4.46.0

Bug Fixes

• k6: handle null project folder uid (#2944) by @​eamonryan
• grafana_message_template: read back disable_provenance from the API instead of hardcoding false (#2958) by @​petergreen86

Documentation

• alerting: mark alert enrichment as generally available (#2951) by @​fayzal-g

Features

• slo: add source_datasource_uid to grafana_slo query blocks (#2904) by @​elainevuong

Full Changelog: v4.45.2...v4.46.0

Commits

• 744a9fa fix(grafana_message_template): read back disable_provenance from the API inst...
• 4aa5643 chore: update provider schema and issue templates (#2954)
• 290859a feat(slo): add source_datasource_uid to grafana_slo query blocks (#2904)
• b06be7e chore: update provider schema and issue templates (#2952)
• bca0e7c docs(alerting): mark alert enrichment as generally available (#2951)
• 265c4a3 fix(k6): handle null project folder uid (#2944)
• See full diff in compare view

Updates hashicorp/random from 3.9.0 to 3.9.1

Release notes

Sourced from hashicorp/random's releases.

v3.9.1

3.9.1 (September 11, 2026)

NOTES:

• Upgrade the Go toolchain to 1.26.8. (#812)
• Update golang.org/x/mod to v0.40.0 and google.golang.org/protobuf to v1.36.12. (#814)

Changelog

Sourced from hashicorp/random's changelog.

3.9.1 (September 11, 2026)

NOTES:

• Upgrade the Go toolchain to 1.26.8. (#812)
• Update golang.org/x/mod to v0.40.0 and google.golang.org/protobuf to v1.36.12. (#814)

Commits

• b59b179 chore: prepare release v3.9.1 (#815)
• c0e9393 update security dependencies (#814)
• 92cfaa6 build(deps): Bump github/issue-labeler (#809)
• bd86728 suppress unused openpgp vulnerability (#813)
• c3e8475 update Go version to 1.26.8 (#812)
• 1cd0254 build(deps): Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#811)
• 98adb9d build(deps): Bump golang.org/x/crypto from 0.55.0 to 0.56.0 (#810)
• cfc1bea [documentation] replace references to strings with "password" where appropria...
• 3612216 build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#808)
• e1092b0 build(deps): Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#807)
• Additional commits viewable in compare view

Updates hashicorp/time from 0.14.1 to 0.14.2

Release notes

Sourced from hashicorp/time's releases.

v0.14.2

0.14.2 (September 11, 2026)

NOTES:

• Upgrade the Go toolchain to 1.26.8. (#511)
• Update golang.org/x/crypto to v0.56.0, golang.org/x/mod to v0.40.0, and google.golang.org/protobuf to v1.36.12. (#512)

Changelog

Sourced from hashicorp/time's changelog.

0.14.2 (September 11, 2026)

NOTES:

• Upgrade the Go toolchain to 1.26.8. (#511)
• Update golang.org/x/crypto to v0.56.0, golang.org/x/mod to v0.40.0, and google.golang.org/protobuf to v1.36.12. (#512)

Commits

• c6ce8a2 chore: prepare release v0.14.2 (#513)
• ba7b5be update security dependencies (#512)
• 603e223 build(deps): Bump github/issue-labeler (#509)
• 042cd51 update Go version to 1.26.8 (#511)
• 657a35a build(deps): Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#510)
• 0f64acd build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#508)
• See full diff in compare view

Updates hashicorp/vault from 5.11.0 to 5.12.0

Release notes

Sourced from hashicorp/vault's releases.

v5.12.0

5.12.0 (September 17, 2026)

FEATURES:

• New Resources: Add support for PKI External CA DNS-01 challenge providers with vault_pki_external_ca_secret_backend_dns_provider_aws_route53, vault_pki_external_ca_secret_backend_dns_provider_azure, vault_pki_external_ca_secret_backend_dns_provider_gcp, and vault_pki_external_ca_secret_backend_dns_provider_rfc2136 resources. Also adds default_nameserver to vault_pki_external_ca_secret_backend_acme_account and dns_provider_name/dns_provider_type to vault_pki_external_ca_secret_backend_role. Requires Vault 2.1.0 or later. (#3014)
• New Ephemeral Resource: vault_azure_access_token for fetching Azure OAuth2 access tokens from Vault's Azure secrets engine static role credentials. Requires Vault 2.2.0 or later. (#2974)
• New Resource for tokenization transforms: Add new resources vault_transform_transformation_tokenization and vault_transform_transformation_tokenization_store for tokenization transformations in transform secrets engine and tokenization stores. Uses this endpoint to support creating and updating of tokenization transformations and this endpoint for tokenization stores. Supported parameters include name, mapping_mode, max_ttl, allowed_roles, stores, convergent, deletion_allowed for vault_transform_transformation_tokenization and name, type, driver, connection_string, username, password, supported_transformations, schema, max_open_connections, max_idle_connections, max_connection_lifetime for vault_transform_transformation_tokenization_store. (#3023)
• vault_azure_auth_backend_config: Add auth_type field to explicitly control how Vault authenticates to Azure APIs. Valid values are root_creds, plugin_wif, msi, and aks_wif. When omitted, Vault retains its existing credential-discovery behaviour for backward compatibility (#2999). Requires Vault 2.2.0+.

IMPROVEMENTS:

• vault_cert_auth_backend_role: Add certificate_wo and certificate_wo_version write-only fields to allow ephemeral resource values, to supply the CA certificate. The certificate field is now Computed and ForceNew has been removed enabling in-place updates when the certificate changes instead of resource replacement. (#3011)
• vault_ldap_auth_backend: emit a warning when the auth mount or its config is not found during refresh, so users see an actionable message in terraform plan output rather than a silent state removal. (#2997)
• Update supported Vault version for PKI formats pkcs12_bundle and jks_bundle to require Vault 2.1.0+ (not 2.0.5+) per latest Vault versioning strategy. (#3017#2950)

BUG FIXES:

• vault_mount: Fix spurious ForceNew destroy when importing a kv-v2 mount. Vault returns type=kv+options.version=2 on import; a DiffSuppressFunc now suppresses the kv/kv-v2 alias diff so the next plan is clean. (#3007)
• vault_terraform_cloud_secret_backend: Fix logic gap in Read where execution would fall through to a stray GET <backend>/config call after readMount detected the mount was deleted out-of-band and cleared the resource ID. Add util.Is404 guard to Delete so that terraform destroy succeeds cleanly when the mount has already been removed from Vault. (#3006)

BUILD:

Add support for linux/s390x architecture. (#3028)

DEPENDENCIES:

• Build with Go 1.27.1
• Bumped 20 Go module dependencies (#3036)
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 → v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 → v1.14.1
• github.com/aws/aws-sdk-go-v2 v1.43.5 → v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.36 → v1.33.5
• github.com/aws/aws-sdk-go-v2/credentials v1.19.35 → v1.20.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.36 → v1.20.0
• github.com/aws/aws-sdk-go-v2/service/iam v1.59.0 → v1.64.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.5 → v1.51.0
• github.com/aws/smithy-go v1.27.7 → v1.28.1
• github.com/go-sql-driver/mysql v1.10.0 → v1.10.1
• github.com/hashicorp/vault-plugin-auth-jwt v0.26.3 → v0.27.1
• github.com/moby/moby/client v0.5.1 → v0.6.0
• github.com/stretchr/testify v1.11.1 → v1.12.1
• golang.org/x/crypto v0.55.0 → v0.57.0
• golang.org/x/oauth2 v0.36.0 → v0.37.0
• google.golang.org/api v0.293.0 → v0.298.0
• github.com/hashicorp/consul/api v1.34.4 → v1.34.5
• github.com/hashicorp/vault-plugin-auth-kerberos v0.17.1 → v0.18.0
• github.com/hashicorp/vault-plugin-auth-oci v0.21.3 → v0.22.0
• golang.org/x/net v0.58.0 → v0.59.0

... (truncated)

Changelog

Sourced from hashicorp/vault's changelog.

5.12.0 (September 17, 2026)

FEATURES:

• New Resources: Add support for PKI External CA DNS-01 challenge providers with vault_pki_external_ca_secret_backend_dns_provider_aws_route53, vault_pki_external_ca_secret_backend_dns_provider_azure, vault_pki_external_ca_secret_backend_dns_provider_gcp, and vault_pki_external_ca_secret_backend_dns_provider_rfc2136 resources. Also adds default_nameserver to vault_pki_external_ca_secret_backend_acme_account and dns_provider_name/dns_provider_type to vault_pki_external_ca_secret_backend_role. Requires Vault 2.1.0 or later. (#3014)
• New Ephemeral Resource: vault_azure_access_token for fetching Azure OAuth2 access tokens from Vault's Azure secrets engine static role credentials. Requires Vault 2.2.0 or later. (#2974)
• New Resource for tokenization transforms: Add new resources vault_transform_transformation_tokenization and vault_transform_transformation_tokenization_store for tokenization transformations in transform secrets engine and tokenization stores. Uses this endpoint to support creating and updating of tokenization transformations and this endpoint for tokenization stores. Supported parameters include name, mapping_mode, max_ttl, allowed_roles, stores, convergent, deletion_allowed for vault_transform_transformation_tokenization and name, type, driver, connection_string, username, password, supported_transformations, schema, max_open_connections, max_idle_connections, max_connection_lifetime for vault_transform_transformation_tokenization_store. (#3023)
• vault_azure_auth_backend_config: Add auth_type field to explicitly control how Vault authenticates to Azure APIs. Valid values are root_creds, plugin_wif, msi, and aks_wif. When omitted, Vault retains its existing credential-discovery behaviour for backward compatibility (#2999). Requires Vault 2.2.0+.

IMPROVEMENTS:

• vault_cert_auth_backend_role: Add certificate_wo and certificate_wo_version write-only fields to allow ephemeral resource values, to supply the CA certificate. The certificate field is now Computed and ForceNew has been removed enabling in-place updates when the certificate changes instead of resource replacement. (#3011)
• vault_ldap_auth_backend: emit a warning when the auth mount or its config is not found during refresh, so users see an actionable message in terraform plan output rather than a silent state removal. (#2997)
• Update supported Vault version for PKI formats pkcs12_bundle and jks_bundle to require Vault 2.1.0+ (not 2.0.5+) per latest Vault versioning strategy. (#3017#2950)

BUG FIXES:

• vault_mount: Fix spurious ForceNew destroy when importing a kv-v2 mount. Vault returns type=kv+options.version=2 on import; a DiffSuppressFunc now suppresses the kv/kv-v2 alias diff so the next plan is clean. (#3007)
• vault_terraform_cloud_secret_backend: Fix logic gap in Read where execution would fall through to a stray GET <backend>/config call after readMount detected the mount was deleted out-of-band and cleared the resource ID. Add util.Is404 guard to Delete so that terraform destroy succeeds cleanly when the mount has already been removed from Vault. (#3006)

BUILD:

Add support for linux/s390x architecture. (#3028)

DEPENDENCIES:

• Build with Go 1.27.1
• Bumped 20 Go module dependencies (#3036)
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 → v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 → v1.14.1
• github.com/aws/aws-sdk-go-v2 v1.43.5 → v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.36 → v1.33.5
• github.com/aws/aws-sdk-go-v2/credentials v1.19.35 → v1.20.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.36 → v1.20.0
• github.com/aws/aws-sdk-go-v2/service/iam v1.59.0 → v1.64.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.5 → v1.51.0
• github.com/aws/smithy-go v1.27.7 → v1.28.1
• github.com/go-sql-driver/mysql v1.10.0 → v1.10.1
• github.com/hashicorp/vault-plugin-auth-jwt v0.26.3 → v0.27.1
• github.com/moby/moby/client v0.5.1 → v0.6.0
• github.com/stretchr/testify v1.11.1 → v1.12.1
• golang.org/x/crypto v0.55.0 → v0.57.0
• golang.org/x/oauth2 v0.36.0 → v0.37.0
• google.golang.org/api v0.293.0 → v0.298.0
• github.com/hashicorp/consul/api v1.34.4 → v1.34.5
• github.com/hashicorp/vault-plugin-auth-kerberos v0.17.1 → v0.18.0
• github.com/hashicorp/vault-plugin-auth-oci v0.21.3 → v0.22.0
• golang.org/x/net v0.58.0 → v0.59.0

Commits

• 21dc65a Release v5.12.0 preparation (#3047)
• 670d3bf quick doc change for vault version for agentic workflows (#3048)
• 0c369e3 build(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.0 (#3009)
• c739a33 Add linux/s390x build target for IBM Z / LinuxONE (#3028)
• a02cc5d PKI External CA: Add DNS provider resources and default_nameserver support (#...
• 0595f04 build(deps): bump the gomod-backward-compatible group across 1 directory with...
• 2b0ce47 Add terraform resource for tokenization transformation for transform … (#3023)
• 085afe7 vault_cert_auth_backend_role: add write-only certificate support (#3011)
• f66bd39 Updated the version for okta group fetching vault feature (#3033)
• 34b28a0 Update auth type in Vault Azure Auth Method from aks_wi to aks_wif (#3031)
• Additional commits viewable in compare view

Updates stackitcloud/stackit from 0.114.0 to 0.115.0

Release notes

Sourced from stackitcloud/stackit's releases.

v0.115.0

Changelog

• 6831a53ee7614f7f7f0b51cebeff79c144346f61: Feat/add vpn network config (#1763) (@​SerseusWasTaken)
• 896d23e22678678d1218b4e936fdf09f0a906782: chore(deps): bump github.com/hashicorp/terraform-json (#1739) (@​dependabot[bot])
• 467f6342e362b1972e1146de51b0519ffcb1117c: chore(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 (#1755) (@​dependabot[bot])
• 7fa1becb0c95bc07005c64f931616b496923c864: chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#1734) (@​dependabot[bot])
• b1ea970f56e8905befbe915551abcff275f5418a: chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#1758) (@​dependabot[bot])
• 3cde7e7a8489ae55de5adb1a1e22729f5711d453: chore(deps): bump the stackit group across 1 directory with 3 updates (#1760) (@​dependabot[bot])
• 097343249b8bab4de45cf6a9c986fe0ecfdc0577: chore(deps): bump the stackit group across 1 directory with 42 updates (#1757) (@​dependabot[bot])
• 043cca2181a25f81870c873e7dbd58f5339058da: docs(rabbitmq): update rabbitmq example (#1745) (@​SerseusWasTaken)
• b2c1037372145087591b1f844b6cab888f170ffb: feat(alb): add alt_port (#1762) (@​SerseusWasTaken)
• 32d7806fb235a5da04dc540e603211afb6a23c7e: feat(sfs): make resource pool wait timeouts configurable (#1740) (@​devpie)
• 0cb330012e0f9a0692b0cc94915a08385de12ce8: fix(iaas): prevent server recreation during update when agent is unconfigured (#1756) (@​marceljk)
• bc1e8c6a43a1ab78b95b614b7bff0e9dc50e4ae5: fix(iaas): return after a failing GetServer in the server resource (#1747) (@​devpie)

Commits

• 6831a53 Feat/add vpn network config (#1763)
• 32d7806 feat(sfs): make resource pool wait timeouts configurable (#1740)
• b2c1037 feat(alb): add alt_port (#1762)
• 3cde7e7 chore(deps): bump the stackit group across 1 directory with 3 updates (#1760)
• 0cb3300 fix(iaas): prevent server recreation during update when agent is unconfigured...
• 0973432 chore(deps): bump the stackit group across 1 directory with 42 updates (#1757)
• 896d23e chore(deps): bump github.com/hashicorp/terraform-json (#1739)
• b1ea970 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#1758)
• 7fa1bec chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#1734)
• 467f634 chore(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 (#1755)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions