chore(deps-dev): bump msal from 1.36.0 to 1.39.0

[dependabot]

Bumps msal from 1.36.0 to 1.39.0.

Release notes

Sourced from msal's releases.

1.39.0

What's Changed

• Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (part of #886) by @​4gust in AzureAD/microsoft-authentication-library-for-python#945
• Sanitize URLs by @​4gust in AzureAD/microsoft-authentication-library-for-python#956
• Disable broker on Intel-based Macs by @​ashok672 in AzureAD/microsoft-authentication-library-for-python#926
• Fix Azure Arc errors returned before authentication challenge by @​gladjohn in AzureAD/microsoft-authentication-library-for-python#962
• Fix Service Fabric HTTPAdapter subclass compatibility by @​4gust in AzureAD/microsoft-authentication-library-for-python#964
• Bump MSAL version to 1.39.0 by @​4gust in AzureAD/microsoft-authentication-library-for-python#966

Full Changelog: AzureAD/microsoft-authentication-library-for-python@1.38.0...1.39.0

1.38.0

What's Changed

• Fix ESRP client ID typo in release pipeline by @​RyAuld in AzureAD/microsoft-authentication-library-for-python#924
• Add OneBranch pipeline templates for CI and Release by @​RyAuld in AzureAD/microsoft-authentication-library-for-python#925
• Fix benchmark cache path and add forceBenchmarks pipeline variable by @​RyAuld in AzureAD/microsoft-authentication-library-for-python#927
• Validate region string format before use in URL construction by @​bgavrilMS in AzureAD/microsoft-authentication-library-for-python#921
• Fix Python 3.14 test timeout: replace utcnow() and remove tee pipe by @​RyAuld in AzureAD/microsoft-authentication-library-for-python#934
• Remove pytest-azurepipelines plugin to fix Python 3.14 stall by @​RyAuld in AzureAD/microsoft-authentication-library-for-python#936
• Migrate region discovery to IMDS /compute JSON endpoint by @​Robbie-Microsoft in AzureAD/microsoft-authentication-library-for-python#929
• Remove redundant GitHub Actions unit-test job by @​gladjohn with @​Copilot in AzureAD/microsoft-authentication-library-for-python#942
• Add test coverage for past expires_on in Managed Identity by @​gladjohn in AzureAD/microsoft-authentication-library-for-python#940
• Add forwarded_client_claims support to confidential client flows by @​Robbie-Microsoft in AzureAD/microsoft-authentication-library-for-python#937
• Deprecate decode_id_token and stop validating ID tokens (#911) by @​4gust in AzureAD/microsoft-authentication-library-for-python#943
• Add managed identity E2E tests + self-hosted CI stages (MSAL Go #641 parity) by @​gladjohn in AzureAD/microsoft-authentication-library-for-python#948
• Fix cache key hash collision: length-prefix extended cache key components by @​4gust in AzureAD/microsoft-authentication-library-for-python#946
• Allow Azure Arc managed identity requests to forward user-assigned identity selectors by @​gladjohn with @​Copilot in AzureAD/microsoft-authentication-library-for-python#944
• Harden regional authority validation by @​4gust in AzureAD/microsoft-authentication-library-for-python#951
• fix(security): pin Service Fabric managed identity TLS by @​4gust in AzureAD/microsoft-authentication-library-for-python#952
• Add WindowsContainerImage definition by @​Avery-Dunn in AzureAD/microsoft-authentication-library-for-python#953
• Avdunn/pipeline fix by @​Avery-Dunn in AzureAD/microsoft-authentication-library-for-python#954

New Contributors

• @​Robbie-Microsoft made their first contribution in AzureAD/microsoft-authentication-library-for-python#929

Full Changelog: AzureAD/microsoft-authentication-library-for-python@1.37.0...1.38.0

1.37.0

Breaking Changes

• Removed support for Python 3.8 in #910

New Features

• Add User Federated Identity Credential (user_fic) grant type support in #918

Bug Fixes and Improvements

• Use unsigned redirect URI for macOS broker silent flows in #907

... (truncated)

Changelog

Sourced from msal's changelog.

MSAL Python — Release Guide

How to ship a new version of msal to PyPI. Everything happens in Azure DevOps (no GitHub Releases, no Git-tag-triggered automation).

---

Before you start — one-time prerequisites

Confirm these are set up in ADO (IdentityDivision → IDDP project) — the release will fail at runtime if any are missing:

• Pipeline MSAL.Python-Publish (definition 3067) exists
• Service connection MSAL-ESRP-AME exists and is authorized
• Environment MSAL-Python-Release has a required manual approval configured under Approvals and checks
• Key Vault MSALVault contains cert MSAL-ESRP-Release-Signing

Note on TestPyPI: The TestPyPI publish path (publishTarget = test.pypi.org (Preview / RC)) is currently a no-op — the MSAL-Test-Python-Upload service connection has not been created yet, so that stage prints a skip message and uploads nothing. Until it's wired up, use an RC version (e.g. 1.36.0rc1) on the production path for dry runs.

---

Release in 4 steps

1. Bump the version on dev

The package version lives in one file: https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/msal/sku.py.

__version__ = "1.36.0"     # final release
# or
__version__ = "1.36.0rc1"  # RC / dry run

Open a PR, get it merged into dev.

2. Cut the release branch

git checkout dev && git pull
git checkout -b release-1.36.0
git push origin release-1.36.0

Pushing the branch does not publish anything — the pipeline is manual.

... (truncated)

Commits

• 20fd4d9 Bump MSAL version to 1.39.0 (#966)
• 05f5b5c Fix Service Fabric HTTPAdapter subclass compatibility (#964)
• f15f912 Fix Azure Arc pre-challenge errors (#962)
• c11159b Disable broker on Intel-based Macs (#926)
• 9bdb09e Sanitize flagged URLs (#956)
• 1416438 Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (#945)
• b5bf153 Avdunn/pipeline fix (#954)
• f3b6792 Add WindowsContainerImage definition (#953)
• 9ddae0d fix(security): pin Service Fabric managed identity TLS (#952)
• cd69656 Harden regional authority validation (#951)
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud