# What changed in azure-core

> 20 changes in azure-core 1 from its official release notes, upgrade guides and advisories: 4 breaking, 2 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/pypi/azure-core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## azure-core 1

### Breaking changes

- Python 3.9 is no longer supported; applications must use Python 3.10 or later. (1.40.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.40.0)
- Query parameters in URL attributes are now sanitized by default; additional parameters require explicit allowance. (1.40.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.40.0)
- The environment variable for the previously undocumented azure_cloud setting changed from AZURE_CLOUD to AZURE_SDK_CLOUD_CONF. (1.39.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.39.0)
- Continuation tokens generated by previous azure-core versions are incompatible with this version. (1.38.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.0)

### Security

- Persists the insecure-domain change flag across retries after a cross-domain redirect. (1.38.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.3)
- Azure Core is vulnerable to deserialization of untrusted data (1.38.0) — [security advisory](https://github.com/advisories/GHSA-JM66-CG57-JJV5)

### New APIs and options

- Accepts VERBOSE, case-insensitively, as an alias for DEBUG. (1.41.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.41.0)
- Policies and SDK clients can allow specified URL query parameters to remain unredacted in span attributes or logs. (1.40.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.40.0)
- Per-operation http_logging_level overrides are now supported in HttpLoggingPolicy. (1.40.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.40.0)
- Adds a serialization helper that gets an attribute's backcompat name using backcompat attribute access. (1.37.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.37.0)
- Added a registry for custom serializers and deserializers for specific types or conditions. (1.36.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.36.0)

### Performance

- Added caching to tracing implementation detection to prevent potential performance issues from repeated import attempts. (1.36.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.36.0)

### Behavior and default changes

- Invalid values log a warning and use INFO instead of raising errors. (1.41.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.41.0)
- Invalid values log a warning and use the default value instead of raising errors. (1.41.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.41.0)
- Invalid values log a warning and use the default value instead of raising errors. (1.41.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.41.0)
- Adds jitter to token refresh timing to prevent simultaneous refresh attempts across multiple processes and mitigate the thundering herd problem. (1.38.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.3)

### Fixes and other changes

- Preserves a trailing slash in the base URL when the URL template contains only a query string. (1.38.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.3)
- Preserves the leading slash when the URL template starts with /?. (1.38.2) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.2)
- Avoids adding trailing slashes when the URL template contains only query parameters. (1.38.1) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.38.1)
- Fixed repeated import attempts of cchardet and chardet when charset_normalizer is used. (1.36.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-core_1.36.0)