# What changed in msal

> 16 changes in msal 1 from its official release notes, upgrade guides and advisories: 3 breaking, 4 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/msal/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## msal 1

### Breaking changes

- The broker is disabled on Intel-based Macs. (1.39.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.39.0)
- decode_id_token is deprecated, and ID tokens are no longer validated. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- Support for Python 3.8 was removed. (1.37.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0)

### Security

- URLs are sanitized. (1.39.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.39.0)
- Regional authority validation now checks the region string format before URL construction and is hardened. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- Service Fabric managed identity TLS is pinned. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- The username parameter is escaped. (1.37.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0)

### New APIs and options

- Confidential client flows now support forwarded_client_claims. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- Adds support for the User Federated Identity Credential grant type. (1.37.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0)

### Behavior and default changes

- Azure Arc managed identity requests can forward user-assigned identity selectors. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- Region discovery now uses the IMDS /compute JSON endpoint. (1.38.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.38.0)
- MSAL client metadata headers are forwarded through IMDS to ESTS. (1.37.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0)
- macOS broker silent flows use an unsigned redirect URI. (1.37.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.37.0)

### Fixes and other changes

- Fixes Azure Arc errors returned before the authentication challenge. (1.39.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.39.0)
- Fixes false positives on systemd cgroups v2 hosts. (1.39.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.39.0)
- Fixes compatibility with Service Fabric HTTPAdapter subclasses. (1.39.0) — [release notes](https://github.com/AzureAD/microsoft-authentication-library-for-python/releases/tag/1.39.0)