# What changed in hydra-core

> 25 changes in hydra-core 1 from its official release notes, upgrade guides and advisories: 2 breaking, 1 deprecations, 7 security, 4 new APIs and options. Each one cited. Sources checked 2026-11-13. HTML: https://unstale.sh/pypi/hydra-core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## hydra-core 1

### Breaking changes

- Adds a blocklist for security-sensitive _target_ callables. (1.3.4) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4), [security advisory](https://github.com/advisories/GHSA-2CP2-2R3C-7P7R)
- compose() no longer initializes the logging subsystem. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)

### Security

- Hydra legacy target blacklist permits unsafe PyYAML loading (1.3.8) — [security advisory](https://github.com/advisories/GHSA-WF6J-7HVR-GR93)
- Prevents arbitrary code execution through unsafe PyYAML loaders; safe YAML loading and dumping remain supported. (1.3.8) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.8)
- Strengthens checks for configured targets, Python runtime state, process-environment mutation, and logging formatters; these checks are not a complete security boundary. (1.3.7) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7)
- Hydra: Mutable instantiate policy sets allow target blocklist bypass (1.3.7) — [security advisory](https://github.com/advisories/GHSA-MWJ6-RFH8-7QF4)
- Hydra instantiate target blacklist bypasses permit code execution (1.3.6) — [security advisory](https://github.com/advisories/GHSA-RQX7-P7VV-W7HR)
- Authorization for instantiate is hardened against unsafe aliases and callable results. (1.3.6) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6)
- Hydra's target blacklist is now applied to Python logging configuration. (1.3.6) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6), [security advisory](https://github.com/advisories/GHSA-C3WX-C55W-PXJQ)

### Deprecations

- Hydra 1.3 users relying on Hydra 1.1 behavior now receive a warning. (1.3.5) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.5)

### New APIs and options

- Config packages let developers reduce nesting levels. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Intervals can now be cast to ints and floats. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Hydra 1.0 adds plugins enabling remote launching and hyper parameter optimization. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Hydra 1.0 adds config type safety via Structured Configs. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)

### Behavior and default changes

- Hydra 1.0 improves error reporting. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- When HYDRA_FULL_ERROR=1, apps raise the underlying exception. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- The signature allows input configs of Any type. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Interpolation accepts any character between ${ and }. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)

### Tooling

- Hydra 1.0 provides a more powerful command line. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)

### Fixes and other changes

- Command-line overrides of hydra.job.env_set now work correctly. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- instantiate now works correctly when parameters are interpolations into a parent node. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Logging is flushed instead of shut down at job end. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- Tab completion no longer outputs errors in some cases when using --multirun. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- The Nevergrad plugin now handles integer/float choice from spec correctly. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)
- OmegaConf custom resolvers are now propagated to Sweepers properly. (1.0.0) — [release notes](https://github.com/hydra-ecosystem/hydra/releases/tag/v1.0.0)