1.37.0

Breaking Changes

• Removed support for Python 3.8 in #910

New Features

• Add User Federated Identity Credential (user_fic) grant type support in #918

Bug Fixes and Improvements

• Use unsigned redirect URI for macOS broker silent flows in #907
• Escape username parameter in #901
• Forward MSAL client metadata headers through IMDS to ESTS in #902

Dependency Updates

• Update pymsalruntime minimum version to 0.20.6 in #919
• Bump cryptography dependency ceiling to <50 (N+3) in #906

1.36.0

What's Changed

• Fix the PoP flow in the console app by PetarSDimov in #887
• Add ADO CI, SDL, and release pipelines with e2e test enablement by Ryan Auld (@RyAuld) in #890
• Add documentation for Managed Identity v2 Hackathon by Gladwin Johnson (@gladjohn) in #885
• Potential fix for code scanning alert no. 74: Workflow does not contain permissions by Avery-Dunn in #884
• Added withFmi method for cca app by Nilesh Choudhary (@4gust) in #876
• Use cryptographically secure randomness for PKCE, state, and nonce generation by Ashok Kumar Ramakrishnan (@ashok672) in #894
• Fix OIDC issuer domain spoofing in B2C host validation by Nilesh Choudhary (@4gust) in #896

New Contributors

• PetarSDimov made their first contribution in #887
• Gladwin Johnson (@gladjohn) made their first contribution in #885

Full Changelog: 1.35.1...1.36.0

1.35.1

What's Changed

• Instance discovery remains cloud local on known clouds by Bogdan Gavril (@bgavrilMS) in #875

Full Changelog: 1.35.0...1.35.1

1.35.0

What's Changed

• Set Redirect Uri for broker silent flow on Linux platform by xinyuxu1026 in #846
• ROPC deprecation by Ugonna Akali (@Ugonnaak1) in #855
• Update pymsalruntime version range to handle the latest 0.20.0 release by Dharshan BJ (@DharshanBJ) in #858
• Document how to enable sha256 for client credential by Ray Luo (@rayluo) in #833
• Remove the reliance on getfqdn() by Ray Luo (@rayluo) in #859
• Thumbprint for certificate made optional by vi7us in #835
• Support Python 3.14 by Ray Luo (@rayluo) in #861
• Add form_post response mode support for system browser authentication by Ashok Kumar Ramakrishnan (@ashok672) in #868
• Add OIDC issuer validation by Avery-Dunn in #840
• Security: Remove unsafe PowerShell fallback in WSL by Rin (@RinZ27) in #866

Full Changelog: 1.34.0...1.35.0

MSAL Python 1.35.0b1

Highlights

• The managed identity code path no longer has a dependency on the socket.getfqdn(). No API change is needed. Existing MSAL-powered apps will automatically pick up this new behavior.
• This version of MSAL Python will pick up PyMsalRuntime 0.20.*. No API change is needed. Existing MSAL-powered apps will automatically pick up this new behavior.
• The thumbprint name-value pair in the client_credential parameter becomes optional now. See API docs for usage.

What's Changed

• ROPC deprecation by Ugonna Akali (@Ugonnaak1) in #855
• Test case for token response scope differing from token request scope by Ray Luo (@rayluo) in #856
• Update pymsalruntime version range to handle the latest 0.20.0 release by Dharshan BJ (@DharshanBJ) in #858
• Document how to enable sha256 for client credential by Ray Luo (@rayluo) in #833
• Remove the reliance on getfqdn() by Ray Luo (@rayluo) in #859
• Thumbprint for certificate made optional by vi7us in #835
• Support Python 3.14 by Ray Luo (@rayluo) in #861
• Explicitly remove issuer from the OIDC discovery response by Ray Luo (@rayluo) in #863
• Suppress CodeQL warning by Bogdan Gavril (@bgavrilMS) in #867

New Contributors

• Ashok Kumar Ramakrishnan (@ashok672) made their first contribution in #839
• xinyuxu1026 made their first contribution in #846
• Dependabot (@dependabot)[bot] made their first contribution in #849
• vi7us made their first contribution in #835

Full Changelog: 1.34.0...1.35.0b1

MSAL Python 1.34.0

This release includes:

• All the changes in 1.34.0b1, plus bumping the dependency cryptography upper bound, which also drops Python 3.7 support.
• Officially support Python 3.13

What's Changed

• ManagedIdentityClient(..., client_capabilities=["cp1"]).acquire_token_for_client(..., claims_challenge="...") by Ray Luo (@rayluo) in #791
• Update deprecated TokenCache API usage by Paul Van Eck (@pvaneck) in #805
• Enable broker support on Linux for WSL by Dharshan BJ (@DharshanBJ) in #766
• Fix username/password validation in broker test by Emmanuel Ferdman (@emmanuel-ferdman) in #807
• Merge release 1.32.3 back to dev branch by Ray Luo (@rayluo) in #816
• Add dependency management suggestions by Ray Luo (@rayluo) in #819
• Remind developers about http_cache's unstable format by Ray Luo (@rayluo) in #821
• Properly throw MsalServiceError exception by Ray Luo (@rayluo) in #820
• Improve test cases to test header-less response by Ray Luo (@rayluo) in #822
• Upgrade dependency by Ray Luo (@rayluo) in #824
• Linux broker needs a specific redirect_uri by Ray Luo (@rayluo) in #826
• MSAL Python 1.33.0b1 release by Ray Luo (@rayluo) in #827
• Use lowercase environment value during searching by Ray Luo (@rayluo) in #831
• Add claims challenge parameter in initiate_device_flow by Ashok Kumar Ramakrishnan (@ashok672) in #839
• MSAL Python 1.33.0 by Ray Luo (@rayluo) in #841
• Declare support for Python 3.13 by Ray Luo (@rayluo) in #851

New Contributors

• Paul Van Eck (@pvaneck) made their first contribution in #805
• Emmanuel Ferdman (@emmanuel-ferdman) made their first contribution in #807
• Ashok Kumar Ramakrishnan (@ashok672) made their first contribution in #839

Full Changelog: 1.32.3...1.34.0

MSAL Python 1.34.0b1

What's Changed

• Use lowercase environment value during searching by Ray Luo (@rayluo) in #831
• Add claims challenge parameter in initiate_device_flow by Ashok Kumar Ramakrishnan (@ashok672) in #839

New Contributors

• Ashok Kumar Ramakrishnan (@ashok672) made their first contribution in #839

Full Changelog: 1.33.0...1.34.0b1

MSAL Python 1.33.0

Re-shipping beta release 1.33.0b1 as stable 1.33.0

Highlights

• Managed Identity on Service Fabric supports specifying client_capabilities and claims_challenge (#791)
• Broker support on Linux and WSL. (#766)
• A byproduct of this is that broker on all platforms will support Python 3.13. (#823)

MSAL Python 1.33.0b1

Highlights

• Managed Identity on Service Fabric supports specifying client_capabilities and claims_challenge (#791)
• Broker support on Linux and WSL. (#766)
• A byproduct of this is that broker on all platforms will support Python 3.13. (#823)

What's Changed

• ManagedIdentityClient(..., client_capabilities=["cp1"]).acquire_token_for_client(..., claims_challenge="...") by Ray Luo (@rayluo) in #791
• Update deprecated TokenCache API usage by Paul Van Eck (@pvaneck) in #805
• Enable broker support on Linux for WSL by Dharshan BJ (@DharshanBJ) in #766
• Fix username/password validation in broker test by Emmanuel Ferdman (@emmanuel-ferdman) in #807
• Merge release 1.32.3 back to dev branch by Ray Luo (@rayluo) in #816
• Add dependency management suggestions by Ray Luo (@rayluo) in #819
• Remind developers about http_cache's unstable format by Ray Luo (@rayluo) in #821
• Properly throw MsalServiceError exception by Ray Luo (@rayluo) in #820
• Improve test cases to test header-less response by Ray Luo (@rayluo) in #822
• Upgrade dependency by Ray Luo (@rayluo) in #824
• Linux broker needs a specific redirect_uri by Ray Luo (@rayluo) in #826
• MSAL Python 1.33.0b1 release by Ray Luo (@rayluo) in #827

New Contributors

• Paul Van Eck (@pvaneck) made their first contribution in #805
• Emmanuel Ferdman (@emmanuel-ferdman) made their first contribution in #807

Full Changelog: 1.32.3...1.33.0b1

Stable Release plan

We monitor the adoption numbers and will ship a stable version when this beta has similar amount of downloads to its previous beta version(s).

MSAL Python 1.32.3

Fix a regression on Azure Arc / on-prem servers. (#814, #815)