Worker.Extensions.CosmosDB is using old Azure.Identity package (v1.4) with vulnerabilities

[Astral100]

Description

This is similar to this issue (Azure/azure-functions-durable-extension#2759), just for a different package.

When using the latest Microsoft.Azure.Functions.Worker.Extensions.CosmosDB package Version="4.7.0", in the .Net 8.0 project, it pulls the old Azure.Identity package version 1.4 into .azurefunctions folder, which is then being reported by our vulnerability scanning tool Wiz:

Is it possible to update Worker.Extensions.CosmosDB package to use the latest identity library please?

Steps to reproduce

Install Microsoft.Azure.Functions.Worker.Extensions.CosmosDB package Version="4.7.0", in the .Net 8.0 Azure Functions project and check the Azure.Identity package version in the .azurefunctions folder

[fabiocav]

This has been resolved with #2378 and released with 4.8 https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Extensions.CosmosDB/4.8.0

@Astral100 thank you for the issue. In the future, please see https://github.com/Azure/azure-functions-dotnet-worker/security/policy#reporting-security-issues for CVE reporting.

Thanks!

[Astral100]

@fabiocav Wonderful, thank you very much for the fast fix!