ci: bump hashicorp/google from 7.36.0 to 7.41.0 in /infra/gcp

[dependabot]

Bumps hashicorp/google from 7.36.0 to 7.41.0.

Release notes

Sourced from hashicorp/google's releases.

v7.41.0

FEATURES:

• New Resource: google_chronicle_environment_group (#28338)
• New Resource: google_compute_router_named_set (#28326)
• New List Resource: google_compute_backend_bucket_signed_url_key (#28357)
• New List Resource: google_compute_backend_service_signed_url_key (#28357)
• New List Resource: google_compute_network_firewall_policy (#28357)
• New List Resource: google_compute_network_firewall_policy_association (#28357)
• New List Resource: google_compute_network_firewall_policy_packet_mirroring_rule (#28357)
• New List Resource: google_compute_preview_feature (#28357)
• New List Resource: google_compute_public_advertised_prefix (#28357)
• New List Resource: google_compute_region_backend_bucket (#28357)
• New List Resource: google_compute_region_network_firewall_policy (#28357)

IMPROVEMENTS:

• accesscontextmanager: added allowed_service_patterns and service_patterns_enforcement_scopes fields to google_access_context_manager_service_perimeter to support VPC Service Controls for non-GCP APIs. (#28349)
• accesscontextmanager: added pscEndpoint to sources in ingress_from and egress_from under resources google_access_context_manager_service_perimeter and variants (#28307)
• backupdr: added backup_blocked_by_vault_access_restriction to data.google_backup_dr_data_source resource (#28361)
• backupdr: added force_update_access_restriction to google_backup_dr_backup_vault resource (#28361)
• backupdr: added update support for access_restriction to google_backup_dr_backup_vault resource (#28361)
• certificatemanager: added in-place update support for the self_managed certificate data (pem_certificate / pem_private_key) on google_certificate_manager_certificate; changing the certificate data is now applied via update instead of forcing recreation (#28337)
• cloudrunv2: added tags field to google_cloud_run_v2_service and google_cloud_run_v2_job resources to allow setting tags for services and jobs at creation time. (#28328)
• cloudsql: added max_custom_on_demand_retention_days to create backup_plan example for sqladmin (#28343)
• compute: added 3500GB and 7000GB SSD partition size to google_compute_instance_template resource (#28352)
• compute: added FLEX_START and RESERVATION_BOUND support to google_compute_instance, google_compute_instance_template, and google_compute_region_instance_template resources (#28365)
• container: added the support for updating node_image_config and image_type fields at the same time (#28283)
• dataproc: added confidential_instance_type to google_dataproc_cluster resource (#28371)
• dataproc: added instance_selection.disk_config field to google_dataproc_cluster resource (#28339)
• discoveryengine: added enable_llm_layout_parsing and enable_get_processed_document fields to google_discovery_engine_data_store resource (#28284)
• sql: added instance_auto_dns_status and write_endpoint_auto_dns_status output fields to psc_auto_connections block in google_sql_database_instance resource (#28331)
• sql: added include_replicas_for_major_version_upgrade field to google_sql_database_instance resource (#28345)
• sql: added switch_transaction_logs_to_cloud_storage_enabled field to google_sql_database_instance resource (#28318)
• vertexai: promoted google_vertex_ai_semantic_governance_policy_engine resource to GA (#28347)
• workbench: added enable_deletion_protection field to google_workbench_instance resource (#28355)
• workbench: added resource_policies field to google_workbench_instance resource (#28354)
• workbench: added support for min_cpu_platform in google_workbench_instance resource (#28369)
• workstations: added instance_metadata field to google_workstations_workstation_config resource (#28342)

BUG FIXES:

• compute: fixed bug where a permadiff on google_compute_reservation_region_commitment.existing_reservations would persist after upgrading (#28353)
• compute: fixed permadiff on keepalive_interval for google_compute_router bgp block when set to default value (#28285)
• resourcemanager: fixed validation of target_service_account and delegates in the google_service_account_access_token, google_service_account_id_token, and google_service_account_jwt data sources, and of name in the google_service_account_key data source, to reject identifiers that contain path separators (#28308)
• securityposture: fixed a bug where the enforce field in google_securityposture_posture was always set, causing failures for list constraints. (#28359)
• vmwareengine: added correct update_mask value to google_vmwareengine_private_cloud updates (#28360)

v7.40.0

DEPRECATIONS:

• storage: the admit-on-second-miss value for google_storage_anywhere_cache.admission_policy is deprecated and will be removed in a future major release. The backend will ignore this attribute and treat it as admit-on-first-miss. (#28210)

NOTES:

... (truncated)

Changelog

Sourced from hashicorp/google's changelog.

7.41.0 (Unreleased)

7.40.0 (July 14, 2026)

DEPRECATIONS:

• storage: the admit-on-second-miss value for google_storage_anywhere_cache.admission_policy is deprecated and will be removed in a future major release. The backend will ignore this attribute and treat it as admit-on-first-miss. (#28210)

NOTES:

• compute: migrated google_compute_instance code related to advanced machine features to use direct HTTP rather than a client library (#28160)

FEATURES:

• New Data Source: google_data_catalog_taxonomy (#28237)
• New Data Source: google_oracle_database_exascale_db_storage_vault (#28260)
• New List Resource: 'google_project' (#28041)
• New List Resource: google_compute_instant_snapshot (#28256)
• New List Resource: google_compute_region_instant_snapshot (#28256)
• New List Resource: google_compute_region_target_http_proxy (#28256)
• New List Resource: google_compute_region_target_tcp_proxy (#28256)
• New List Resource: google_compute_region_url_map (#28256)
• New List Resource: google_compute_rollout_plan (#28256)
• New List Resource: google_compute_target_grpc_proxy (#28256)
• New List Resource: google_compute_target_http_proxy (#28256)
• New List Resource: google_compute_target_ssl_proxy (#28256)
• New List Resource: google_compute_target_tcp_proxy (#28256)
• New List Resource: google_dns_managed_zone (#28257)
• New List Resource: google_oracle_database_exascale_db_storage_vaults (#28260)
• New Resource: google_chronicle_findings_refinement_deployment (#28240)
• New Resource: google_chronicle_soar_domain (#28214)
• New Resource: google_iap_agent_registry_agent_iam_binding (#28231)
• New Resource: google_iap_agent_registry_agent_iam_member (#28231)
• New Resource: google_iap_agent_registry_agent_iam_policy (#28231)
• New Resource: google_iap_agent_registry_endpoint_iam_binding (#28231)
• New Resource: google_iap_agent_registry_endpoint_iam_member (#28231)
• New Resource: google_iap_agent_registry_endpoint_iam_policy (#28231)
• New Resource: google_iap_agent_registry_mcp_server_iam_binding (#28231)
• New Resource: google_iap_agent_registry_mcp_server_iam_member (#28231)
• New Resource: google_iap_agent_registry_mcp_server_iam_policy (#28231)
• New Resource: google_tags_tag_binding_collection (#28180)
• New Resource: google_vector_search_index (#28238)
• New Resource: google_chronicle_environment (#28206)
• New Resource: google_chronicle_data_export (#28239)

IMPROVEMENTS:

• agentregistry: added name field to google_agent_registry_binding resource (#28207)
• agentregistry: added name field to google_agent_registry_service resource (#28207)
• appengine: added app_engine_bundled_services field to google_app_engine_standard_app_version resource (#28213)
• biglakeiceberg: add support for CATALOG_TYPE_FEDERATED with federated_catalog_options to google_biglake_iceberg_catalog (#28241)
• compute: added target_type and target_forwarding_rules to google_compute_region_network_firewall_policy_with_rules resource (#28061)
• compute: added workload_identity_config fields to google_compute_instance and google_compute_instance_template resources (#28266)
• compute: added instance_lifecycle_policy.on_repair.allow_changing_zone field to google_compute_instance_group_manager and google_compute_instance_region_group_manager. (#28174)
• container: added ANY_RESERVATION_THEN_FAIL option to consume_reservation_type field in google_container_cluster and google_container_node_pool resources (#28060)

... (truncated)

Commits

• a6ee676 7.41.0 changelog (#28392)
• ba9a037 Add support for dataproc cluster ConfidentialInstanceType (#18161) (#28371)
• 74d8b38 remove maintenance_version test (#18125) (#28370)
• 83e9d31 Add support for Minimum CPU Platform in Workbench Instance (#17314) (#28369)
• 7122508 refactor: extract flattenServiceAccountKey from Read function (#18241) (#28368)
• 71e38fd Add terraform support for biglake hive table (#18287) (#28367)
• e86f44c Compute: Add support for FLEX_START and RESERVATION_BOUND provisioning model ...
• dbf8d7c build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /tools/go-chan...
• 0ce0481 Migrate metadata files to new API (#18122) (#28362)
• f920ecf Allow updating access restriction in update vault and add backup_bloc… (#1813...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Bump hashicorp/google provider from 7.36.0 to 7.41.0 in GCP infra

Updates the version constraint in versions.tf and refreshes the lock file checksums in .terraform.lock.hcl to target the 7.41.x release series.

^{Macroscope summarized ad9ba62.}

[dependabot]

Superseded by #60.