4.22.1 (2026-07-28)
Bugs Fixed
- Fixed a security issue where the legacy
EventGridPublisherClient(sync and async) could re-send credential headers to a different host when following an HTTP 3xx redirect. ASensitiveHeaderCleanupPolicyis now added to the pipeline to stripAuthorization,aeg-sas-keyandaeg-sas-tokenheaders on cross-host redirects.
Other Changes
- Raised the minimum
azure-coredependency to1.38.3so that credential headers remain stripped across retries following a cross-host redirect (insecure_domain_changeflag persistence). - Increased the minimum supported Python version to 3.10. Python 3.9 and earlier are no longer supported.