unstale

pypi / msal

msal

What changed in msal 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

3 breaking4 security2 new APIs and options4 behavior and defaults3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.2 on npm

msal 116 changes

Breaking changes 3

  • The broker is disabled on Intel-based Macs.

    1.39.0release notes

  • decode_id_token is deprecated, and ID tokens are no longer validated.

    1.38.0release notes

  • Support for Python 3.8 was removed.

    1.37.0release notes

Security 4

  • URLs are sanitized.

    1.39.0release notes

  • Regional authority validation now checks the region string format before URL construction and is hardened.

    1.38.0release notes

  • Service Fabric managed identity TLS is pinned.

    1.38.0release notes

  • The username parameter is escaped.

    1.37.0release notes

New APIs and options 2

  • Confidential client flows now support forwarded_client_claims.

    1.38.0release notes

  • Adds support for the User Federated Identity Credential grant type.

    1.37.0release notes

Behavior and default changes 4

  • Azure Arc managed identity requests can forward user-assigned identity selectors.

    1.38.0release notes

  • Region discovery now uses the IMDS /compute JSON endpoint.

    1.38.0release notes

  • MSAL client metadata headers are forwarded through IMDS to ESTS.

    1.37.0release notes

  • macOS broker silent flows use an unsigned redirect URI.

    1.37.0release notes

Fixes and other changes 3

  • Fixes Azure Arc errors returned before the authentication challenge.

    1.39.0release notes

  • Fixes false positives on systemd cgroups v2 hosts.

    1.39.0release notes

  • Fixes compatibility with Service Fabric HTTPAdapter subclasses.

    1.39.0release notes