Upgrading google-auth 0.10 to 1

Breaking0.10.0 → 1.35.0Security1Platform1New11Fixed11Other2

Full comparison Back to google-auth

Securityrequire protobuf 6.33.5 to address CVE-2026-0994.#17349 ↗

BreakingUpgrade verdict

A platform requirement change and a security fix.

In plain terms

Drop support for Python 3.9.
require protobuf 6.33.5 to address CVE-2026-0994.

Must act 2 items need code or config changes

Requires Python >=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.* from 1.24.0 (none stated before).

Adds setuptools >=40.3.0.

Drops pyasn1.

Installs 6 packages in all (was 5).

Moves cachetools 7.2.8 → 4.2.4. Your build may pick other versions.

What you must change

Security1

require protobuf 6.33.5 to address CVE-2026-0994.

1.35.0GitHub ReleaseOriginalView source

Platform1

Drop support for Python 3.9.

1.4.0GitHub ReleaseOriginalView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

added: export load_credentials_from_file

changed: class Credentials(credentials.Scoped, credentials.Signing, credentials.Credentials) → class Credentials(credentials.Scoped, credentials.Signing, credentials.CredentialsWithQuotaProject)
changed: constructor Credentials(scopes=…, service_account_id=…) → constructor Credentials(scopes=…, default_scopes=…, service_account_id=…, quota_project_id=…)
changed: method Credentials.with_scopes(scopes) → method Credentials.with_scopes(scopes, default_scopes=…)
added: method Credentials.with_quota_project(quota_project_id)

added: class Credentials(external_account.Credentials)
added: class RequestSigner(object)
added: constructor Credentials(audience, subject_token_type, token_url, credential_source=…, service_account_impersonation_url=…, client_id=…, client_secret=…, quota_project_id=…, scopes=…, default_scopes=…)
added: constructor RequestSigner(region_name)
added: method Credentials.retrieve_subject_token(request)
added: method RequestSigner.get_request_options(aws_security_credentials, url, method, request_payload=…, additional_headers=…)
added: static method Credentials.from_file(filename, **kwargs)
added: static method Credentials.from_info(info, **kwargs)

added: export IDTokenCredentials

changed: class Credentials(credentials.Scoped, credentials.Credentials) → class Credentials(credentials.Scoped, credentials.CredentialsWithQuotaProject)
changed: constructor Credentials(service_account_email=…) → constructor Credentials(service_account_email=…, quota_project_id=…, scopes=…, default_scopes=…)
changed: method Credentials.with_scopes(scopes) → method Credentials.with_scopes(scopes, default_scopes=…)
added: class IDTokenCredentials(credentials.CredentialsWithQuotaProject, credentials.Signing)
added: constructor IDTokenCredentials(request, target_audience, token_uri=…, additional_claims=…, service_account_email=…, signer=…, use_metadata_identity_endpoint=…, quota_project_id=…)
added: method Credentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.refresh(request)
added: method IDTokenCredentials.sign_bytes(message)
added: method IDTokenCredentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.with_target_audience(target_audience)
added: property IDTokenCredentials.service_account_email
added: property IDTokenCredentials.signer
added: property IDTokenCredentials.signer_email

removed: constructor Scoped()
removed: method Scoped.has_scopes(scopes)
removed: method Scoped.requires_scopes()
removed: property Scoped.scopes
changed: class Scoped(object) → class Scoped(ReadOnlyScoped)
changed: function with_scopes_if_required(credentials, scopes) → function with_scopes_if_required(credentials, scopes, default_scopes=…)
changed: method Scoped.with_scopes(scopes) → method Scoped.with_scopes(scopes, default_scopes=…)
added: class AnonymousCredentials(Credentials)
added: class CredentialsWithQuotaProject(Credentials)
added: class ReadOnlyScoped(object)
added: constructor ReadOnlyScoped()
added: method AnonymousCredentials.apply(headers, token=…)
added: method AnonymousCredentials.before_request(request, method, url, headers)
added: method AnonymousCredentials.refresh(request)
added: method CredentialsWithQuotaProject.with_quota_project(quota_project_id)
added: method ReadOnlyScoped.has_scopes(scopes)
added: method ReadOnlyScoped.requires_scopes()
added: property AnonymousCredentials.expired
added: property AnonymousCredentials.valid
added: property Credentials.quota_project_id
added: property ReadOnlyScoped.default_scopes
added: property ReadOnlyScoped.scopes

removed: class RSASigner(Signer)
removed: class RSAVerifier(Verifier)
removed: class Signer(object)
removed: class Verifier(object)
removed: constructor RSASigner(private_key, key_id=…)
removed: constructor RSAVerifier(public_key)
removed: function verify_signature(message, signature, certs)
removed: method RSASigner.sign(message)
removed: method RSAVerifier.verify(message, signature)
removed: method Signer.key_id()
removed: method Signer.sign(message)
removed: method Verifier.verify(message, signature)
removed: property RSASigner.key_id
removed: static method RSASigner.from_service_account_file(filename)
removed: static method RSASigner.from_service_account_info(info)
removed: static method RSASigner.from_string(key, key_id=…)
removed: static method RSAVerifier.from_string(public_key)
added: variable RSASigner
added: variable RSAVerifier
added: variable Signer
added: variable Verifier

added: class FromServiceAccountMixin(object)
added: class Signer(object)
added: class Verifier(object)
added: method FromServiceAccountMixin.from_string(key, key_id=…)
added: method Signer.key_id()
added: method Signer.sign(message)
added: method Verifier.verify(message, signature)
added: static method FromServiceAccountMixin.from_service_account_file(filename)
added: static method FromServiceAccountMixin.from_service_account_info(info)

added: class ES256Signer(base.Signer, base.FromServiceAccountMixin)
added: class ES256Verifier(base.Verifier)
added: constructor ES256Signer(private_key, key_id=…)
added: constructor ES256Verifier(public_key)
added: method ES256Signer.sign(message)
added: method ES256Verifier.verify(message, signature)
added: property ES256Signer.key_id
added: static method ES256Signer.from_string(key, key_id=…)
added: static method ES256Verifier.from_string(public_key)

added: variable RSASigner
added: variable RSAVerifier

added: class AccessBoundaryRule(object)
added: class AvailabilityCondition(object)
added: class CredentialAccessBoundary(object)
added: class Credentials(credentials.CredentialsWithQuotaProject)
added: constructor AccessBoundaryRule(available_resource, available_permissions, availability_condition=…)
added: constructor AvailabilityCondition(expression, title=…, description=…)
added: constructor CredentialAccessBoundary(rules=…)
added: constructor Credentials(source_credentials, credential_access_boundary, quota_project_id=…)
added: method AccessBoundaryRule.to_json()
added: method AvailabilityCondition.to_json()
added: method CredentialAccessBoundary.add_rule(rule)
added: method CredentialAccessBoundary.to_json()
added: method Credentials.refresh(request)
added: method Credentials.with_quota_project(quota_project_id)
added: property AccessBoundaryRule.availability_condition
added: property AccessBoundaryRule.available_permissions
added: property AccessBoundaryRule.available_resource
added: property AvailabilityCondition.description
added: property AvailabilityCondition.expression
added: property AvailabilityCondition.title
added: property CredentialAccessBoundary.rules

added: variable AWS_ACCESS_KEY_ID
added: variable AWS_DEFAULT_REGION
added: variable AWS_REGION
added: variable AWS_SECRET_ACCESS_KEY
added: variable AWS_SESSION_TOKEN
added: variable GCE_METADATA_HOST
added: variable GOOGLE_API_USE_CLIENT_CERTIFICATE
added: variable LEGACY_APPENGINE_RUNTIME

added: class ClientCertError(GoogleAuthError)
added: class MutualTLSChannelError(GoogleAuthError)
added: class OAuthError(GoogleAuthError)
added: class ReauthFailError(RefreshError)
added: class UserAccessTokenError(GoogleAuthError)
added: constructor ReauthFailError(message=…)

added: class Credentials(credentials.Scoped, credentials.CredentialsWithQuotaProject)
added: constructor Credentials(audience, subject_token_type, token_url, credential_source, service_account_impersonation_url=…, client_id=…, client_secret=…, quota_project_id=…, scopes=…, default_scopes=…)
added: method Credentials.get_project_id(request)
added: method Credentials.refresh(request)
added: method Credentials.retrieve_subject_token(request)
added: method Credentials.with_quota_project(quota_project_id)
added: method Credentials.with_scopes(scopes, default_scopes=…)
added: property Credentials.info
added: property Credentials.is_user
added: property Credentials.project_number
added: property Credentials.requires_scopes
added: property Credentials.service_account_email

added: class Credentials(external_account.Credentials)
added: constructor Credentials(audience, subject_token_type, token_url, credential_source, service_account_impersonation_url=…, client_id=…, client_secret=…, quota_project_id=…, scopes=…, default_scopes=…)
added: method Credentials.retrieve_subject_token(request)
added: static method Credentials.from_file(filename, **kwargs)
added: static method Credentials.from_info(info, **kwargs)

added: class Credentials(credentials.CredentialsWithQuotaProject, credentials.Signing)
added: class IDTokenCredentials(credentials.CredentialsWithQuotaProject)
added: constructor Credentials(source_credentials, target_principal, target_scopes, delegates=…, lifetime=…, quota_project_id=…, iam_endpoint_override=…)
added: constructor IDTokenCredentials(target_credentials, target_audience=…, include_email=…, quota_project_id=…)
added: method Credentials.refresh(request)
added: method Credentials.sign_bytes(message)
added: method Credentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.from_credentials(target_credentials, target_audience=…)
added: method IDTokenCredentials.refresh(request)
added: method IDTokenCredentials.with_include_email(include_email)
added: method IDTokenCredentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.with_target_audience(target_audience)
added: property Credentials.service_account_email
added: property Credentials.signer
added: property Credentials.signer_email

changed: class Credentials(google.auth.credentials.Signing, google.auth.credentials.Credentials) → class Credentials(google.auth.credentials.Signing, google.auth.credentials.CredentialsWithQuotaProject)
changed: class OnDemandCredentials(google.auth.credentials.Signing, google.auth.credentials.Credentials) → class OnDemandCredentials(google.auth.credentials.Signing, google.auth.credentials.CredentialsWithQuotaProject)
changed: constructor Credentials(signer, issuer, subject, audience, additional_claims=…, token_lifetime=…) → constructor Credentials(signer, issuer, subject, audience, additional_claims=…, token_lifetime=…, quota_project_id=…)
changed: constructor OnDemandCredentials(signer, issuer, subject, additional_claims=…, token_lifetime=…, max_cache_size=…) → constructor OnDemandCredentials(signer, issuer, subject, additional_claims=…, token_lifetime=…, max_cache_size=…, quota_project_id=…)
added: method Credentials.with_quota_project(quota_project_id)
added: method OnDemandCredentials.with_quota_project(quota_project_id)
added: variable es256

changed: constructor AuthMetadataPlugin(credentials, request) → constructor AuthMetadataPlugin(credentials, request, default_host=…)
changed: function secure_authorized_channel(credentials, request, target, ssl_credentials=…, **kwargs) → function secure_authorized_channel(credentials, request, target, ssl_credentials=…, client_cert_callback=…, **kwargs)
added: class SslCredentials
added: constructor SslCredentials()
added: property SslCredentials.is_mtls
added: property SslCredentials.ssl_credentials

added: function default_client_cert_source()
added: function default_client_encrypted_cert_source(cert_path, key_path)
added: function has_default_client_cert_source()

changed: constructor AuthorizedSession(credentials, refresh_status_codes=…, max_refresh_attempts=…, **kwargs) → constructor AuthorizedSession(credentials, refresh_status_codes=…, max_refresh_attempts=…, refresh_timeout=…, auth_request=…, default_host=…)
changed: method AuthorizedSession.request(method, url, data=…, headers=…, **kwargs) → method AuthorizedSession.request(method, url, data=…, headers=…, max_allowed_time=…, timeout=…, **kwargs)
added: class TimeoutGuard(object)
added: constructor TimeoutGuard(timeout, timeout_error_type=…)
added: method AuthorizedSession.close()
added: method AuthorizedSession.configure_mtls_channel(client_cert_callback=…)
added: property AuthorizedSession.is_mtls

changed: constructor AuthorizedHttp(credentials, http=…, refresh_status_codes=…, max_refresh_attempts=…) → constructor AuthorizedHttp(credentials, http=…, refresh_status_codes=…, max_refresh_attempts=…, default_host=…)
added: method AuthorizedHttp.configure_mtls_channel(client_cert_callback=…)

added: class PasswordChallenge(ReauthChallenge)
added: class ReauthChallenge(object)
added: class SecurityKeyChallenge(ReauthChallenge)
added: function get_user_password(text)
added: method PasswordChallenge.obtain_challenge_input(unused_metadata)
added: method ReauthChallenge.obtain_challenge_input(metadata)
added: method SecurityKeyChallenge.obtain_challenge_input(metadata)
added: property PasswordChallenge.is_locally_eligible
added: property PasswordChallenge.name
added: property ReauthChallenge.is_locally_eligible
added: property ReauthChallenge.name
added: property SecurityKeyChallenge.is_locally_eligible
added: property SecurityKeyChallenge.name
added: variable AVAILABLE_CHALLENGES
added: variable REAUTH_ORIGIN

removed: method Credentials.with_scopes(scopes)
changed: class Credentials(credentials.Scoped, credentials.Credentials) → class Credentials(credentials.ReadOnlyScoped, credentials.CredentialsWithQuotaProject)
changed: constructor Credentials(token, refresh_token=…, id_token=…, token_uri=…, client_id=…, client_secret=…, scopes=…) → constructor Credentials(token, refresh_token=…, id_token=…, token_uri=…, client_id=…, client_secret=…, scopes=…, default_scopes=…, quota_project_id=…, expiry=…, rapt_token=…, refresh_handler=…)
added: class UserAccessTokenCredentials(credentials.CredentialsWithQuotaProject)
added: constructor UserAccessTokenCredentials(account=…, quota_project_id=…)
added: method Credentials.to_json(strip=…)
added: method Credentials.with_quota_project(quota_project_id)
added: method UserAccessTokenCredentials.before_request(request, method, url, headers)
added: method UserAccessTokenCredentials.refresh(request)
added: method UserAccessTokenCredentials.with_account(account)
added: method UserAccessTokenCredentials.with_quota_project(quota_project_id)
added: property Credentials.rapt_token
added: property Credentials.refresh_handler
added: property Credentials.scopes
added: static method Credentials.from_authorized_user_file(filename, scopes=…)
added: static method Credentials.from_authorized_user_info(info, scopes=…)

added: function fetch_id_token(request, audience)

added: function get_rapt_token(request, client_id, client_secret, refresh_token, token_uri, scopes=…)
added: function is_interactive()
added: function refresh_grant(request, token_uri, refresh_token, client_id, client_secret, scopes=…, rapt_token=…)
added: variable RUN_CHALLENGE_RETRY_LIMIT

changed: class Credentials(credentials.Signing, credentials.Scoped, credentials.Credentials) → class Credentials(credentials.Signing, credentials.Scoped, credentials.CredentialsWithQuotaProject)
changed: constructor Credentials(signer, service_account_email, token_uri, scopes=…, subject=…, additional_claims=…) → constructor Credentials(signer, service_account_email, token_uri, scopes=…, default_scopes=…, subject=…, project_id=…, quota_project_id=…, additional_claims=…, always_use_jwt_access=…)
changed: method Credentials.with_scopes(scopes) → method Credentials.with_scopes(scopes, default_scopes=…)
added: class IDTokenCredentials(credentials.Signing, credentials.CredentialsWithQuotaProject)
added: constructor IDTokenCredentials(signer, service_account_email, token_uri, target_audience, additional_claims=…, quota_project_id=…)
added: method Credentials.with_always_use_jwt_access(always_use_jwt_access)
added: method Credentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.refresh(request)
added: method IDTokenCredentials.sign_bytes(message)
added: method IDTokenCredentials.with_quota_project(quota_project_id)
added: method IDTokenCredentials.with_target_audience(target_audience)
added: property Credentials.project_id
added: property IDTokenCredentials.service_account_email
added: property IDTokenCredentials.signer
added: property IDTokenCredentials.signer_email
added: static method IDTokenCredentials.from_service_account_file(filename, **kwargs)
added: static method IDTokenCredentials.from_service_account_info(info, **kwargs)

added: class Client(utils.OAuthClientAuthHandler)
added: constructor Client(token_exchange_endpoint, client_authentication=…)
added: method Client.exchange_token(request, grant_type, subject_token, subject_token_type, resource=…, audience=…, scopes=…, requested_token_type=…, actor_token=…, actor_token_type=…, additional_options=…, additional_headers=…)

added: class ClientAuthType(enum.Enum)
added: class ClientAuthentication(object)
added: class OAuthClientAuthHandler(object)
added: constructor ClientAuthentication(client_auth_type, client_id, client_secret=…)
added: constructor OAuthClientAuthHandler(client_authentication=…)
added: field ClientAuthType.basic
added: field ClientAuthType.request_body
added: function handle_error_response(response_body)
added: method OAuthClientAuthHandler.apply_client_authentication_options(headers, request_body=…, bearer_token=…)