v0.22.0

What's Changed

✨ Features

• CIDR format validation on network inputs (#144, closes #136 & #133) — address_space, subnet address_prefix/address_prefixes, and all peering address-space inputs are now validated at plan time with can(cidrhost(...)), across the root module and the subnet/peering submodules. Malformed prefixes (typos, missing mask, non-CIDR strings) now fail fast with a clear, actionable message instead of surfacing as an opaque Azure API error deep in the apply.

🐛 Fixes

• Out-of-band subnet drift is now detected (#145, closes #62) — both subnet resources set ignore_missing_property = false, so when an external controller (an AVNM ManagedOnly routing configuration, or an Azure Policy DeployIfNotExists assignment) removes a module-managed body property such as properties.routeTable or properties.networkSecurityGroup, Terraform now surfaces the change as drift and offers to restore it rather than silently swallowing it.
  • Validated end-to-end against real Azure AVNM: clean idempotency (the flip introduces zero plan noise) → out-of-band routeTable removal detected as a restore diff → suppression confirmed.
  • When you intend an external controller to own a path, pair this with the existing ignore_body_changes escape hatch (shipped in v0.21.0 / TFFR8) to suppress that single path only — every other managed property keeps its drift protection.

🧪 Test reliability

• Example region-picker hardening (#145) — stops spurious LocationNotAvailable e2e failures:
  • Direct-picker examples now exclude Azure canary/EUAP regions (eastus2euap, centraluseuap) via region_name_regex.
  • The IPAM examples' hardcoded allowlist drops 7 access-restricted secondary regions (australiacentral, australiacentral2, brazilsoutheast, germanynorth, norwaywest, switzerlandwest, uaecentral), leaving ~40 generally-available regions.

⚠️ Upgrade notes

• Behavioral change (drift detection): if you have subnets whose routeTable/networkSecurityGroup (or other managed body properties) are currently being changed out-of-band, the next plan after upgrading may show a restore diff that was previously hidden. This is the intended fix. If an external controller is meant to own that property, set ignore_body_changes = ["properties.routeTable"] (per-subnet) — or the module-wide ignore_body_changes.virtual_networks_subnets slot — and leave the corresponding dedicated input unset. See the subnet module README ("Out-of-band changes and drift detection").
• No provider or Terraform version-floor changes in this release (azapi ~> 2.12, Terraform >= 1.9, unchanged from v0.21.0).

Full Changelog: v0.21.0...v0.22.0