Latest released azidentity still uses outdated x/crypto

[SimonDreher]

The latest release for azidentity is 1.8.0 (from october) and still uses x/crypto v0.27: https://github.com/Azure/azure-sdk-for-go/blob/sdk/azidentity/v1.8.0/sdk/azidentity/go.mod#L14

Version 0.31 contains a security fix (golang/crypto@b4f1988) and our vulnerability scanning alerts us on that outdated indirect dependency.

You already bumped to 0.31 in https://github.com/Azure/azure-sdk-for-go/blame/main/sdk/azidentity/go.mod, so could you please release a new version of azidentity? Thank you

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[chlowell]

I'm sorry for the wait. We generally don't publish during the holiday period (November and December) to avoid the risk of support incidents while so many of our customers and engineers are out of office. We'll return to our normal cadence in January and azidentity is already scheduled to ship on January 7. In the meantime, can you satisfy your vulnerability scanner by upgrading x/crypto in your go.mod?