# What changed in @azure/keyvault-secrets

> 4 changes in @azure/keyvault-secrets 4 from its official release notes, upgrade guides and advisories: 2 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@azure/keyvault-secrets/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @azure/keyvault-secrets 4

### New APIs and options

- Adds an option to request PEM-format output for certificate-backed secrets. (4.11.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/5f1990de5cbea0d9e353e60abe282dc90f18e29e/sdk/keyvault/keyvault-secrets/CHANGELOG.md#4110-2026-04-01)
- Adds a readonly property that returns the identifier of the previous certificate version. (4.11.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/5f1990de5cbea0d9e353e60abe282dc90f18e29e/sdk/keyvault/keyvault-secrets/CHANGELOG.md#4110-2026-04-01)

### Behavior and default changes

- Service API version 2025-07-01 is now the default. (4.11.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/5f1990de5cbea0d9e353e60abe282dc90f18e29e/sdk/keyvault/keyvault-secrets/CHANGELOG.md#4110-2026-04-01)

### Fixes and other changes

- Fixed forwarding of contentType passed to setSecret() and updateSecretProperties() in the service request body. (4.11.2) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/5f1990de5cbea0d9e353e60abe282dc90f18e29e/sdk/keyvault/keyvault-secrets/CHANGELOG.md#4112-2026-04-27)