Bump com.azure.spring:spring-cloud-azure-dependencies from 7.3.0 to 7.4.0

[dependabot]

Bumps com.azure.spring:spring-cloud-azure-dependencies from 7.3.0 to 7.4.0.

Release notes

Sourced from com.azure.spring:spring-cloud-azure-dependencies's releases.

Spring Cloud Azure 7.4.0

• This release is compatible with Spring Boot 4.0.0-4.1.0. (Note: 4.1.x (x>0) should be supported, but they aren't tested with this release.)
• This release is compatible with Spring Cloud 2025.1.0-2025.1.2. (Note: 2025.1.2 (x>2) should be supported, but they aren't tested with this release.)

Spring Cloud Azure Dependencies (BOM)

Dependency Updates

• Upgrade azure-sdk-bom to 1.3.8.

Spring Cloud Azure Autoconfigure

This section includes changes in spring-cloud-azure-autoconfigure module.

Features Added

• Added AzureServiceBusJmsConnectionFactoryFactory to allow applications to customize how ServiceBusJmsConnectionFactory instances are created, including support for custom subclasses (#49676).
• Added support for constructing AadB2cAuthorizationRequestResolver with a custom authorizationRequestBaseUri, aligning Azure AD B2C authorization request resolution with the configurability already available for AAD. (#49674)

Breaking Changes

Bugs Fixed

• Fixed the AAD authentication filter (AadAuthenticationFilter and AadAppRoleStatelessAuthenticationFilter) not validating the tid (tenant ID) claim in JWT tokens against the configured tenant, allowing tokens from other tenants to be accepted. The JWT token validator now validates that the token's tid claim matches the configured tenant ID, preventing cross-tenant authentication bypass. This hardening is only enforced when a specific tenant ID is configured. (#49631)
• Fixed the AAD and B2C OpenID Connect login (oauth2Login) ID token decoders not validating the iss (issuer) and aud (audience) claims. AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory now validate the standard OIDC ID token claims (audience, expiry, issued-at and subject) and the issuer. For single tenant applications the issuer must belong to the configured tenant, and for multi-tenant applications (the common, organizations or consumers endpoints) the issuer must be a trusted Microsoft identity platform issuer consistent with the token's own tid claim. This prevents users from unauthorized tenants from signing in to multi-tenant applications that rely on the issuer/tenant claim for tenant restriction (#49423).
• Fixed the missing bean name in @ConditionalOnMissingBean for LettuceClientConfigurationBuilderCustomizer (#49290).
• Fixed the AAD and B2C resource server JWT decoder not honoring the spring.cloud.azure.active-directory.jwt-connect-timeout, spring.cloud.azure.active-directory.jwt-read-timeout, spring.cloud.azure.active-directory.b2c.jwt-connect-timeout, and spring.cloud.azure.active-directory.b2c.jwt-read-timeout configuration properties (#49329).
• Fixed AAD resource server JWK retrieval not honoring the spring.cloud.azure.active-directory.jwk-set-cache-lifespan and spring.cloud.azure.active-directory.jwk-set-cache-refresh-time configuration properties (#42159).

Other Changes

• Upgrade to Jackson 3 to align with Spring Boot 4 (#49538).

Spring Cloud Azure Service

This section includes changes in spring-cloud-azure-service module.

Bugs Fixed

• Fixed the Service Bus producer, consumer and processor sub-client builders overwriting configuration already set on the underlying ServiceBusClientBuilder through an AzureServiceClientBuilderCustomizer<ServiceBusClientBuilder> (for example the ClientOptions carrying TracingOptions). The customizers are now applied to the underlying builder as the last step, so their configuration is preserved (#49742).

Spring Messaging Azure

This section includes changes in spring-messaging-azure module.

Other Changes

• Upgrade to Jackson 3 to align with Spring Boot 4 (#49538).

Spring Messaging Azure Event Hubs

... (truncated)

Commits

• b25feda Cherry-pick eng hotfix (#49953)
• c04bd48 Prepare for Spring Cloud Azure 7.4.0 release (#49922)
• 157d48e Increment package versions for netapp auto-releases (#49915)
• 717f312 Fix Azurite install failing behind CFSClean's npm registry block (#49918)
• 6f30946 [AutoPR azure-resourcemanager-hybridcompute]-generated-from-SDK Generation - ...
• 17db1d8 [Service Bus] Bound sync acceptNextSession hang and add session-acquire retry...
• 965773c Add shared eval authoring skills (#49906)
• e813812 Add shared eval authoring skills (#49905)
• 0bbde33 Update eval pipeline configuration (#49909)
• 865f1b3 Add authentication to Java DevOps feed (#49887)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)