FusionFramework #3727 - MSAL v4 Upgrade Release

[odinr]

🎯 Overview

Major MSAL v4 upgrade for the Fusion Framework, bringing enhanced security, improved performance, and better error handling while maintaining full backward compatibility with existing MSAL v2 implementations.

🔥 Key Highlights

• MSAL v4 Upgrade: Seamless migration from MSAL v2 to v4 with zero breaking changes for consumers
• Enhanced Security: Latest Microsoft authentication security improvements and vulnerability fixes
• Telemetry Integration: New provider-level telemetry for MSAL authentication flows
• Performance Improvements: Faster token acquisition and optimized caching mechanisms
• Future-Proof: Access to latest Microsoft authentication features and ongoing support

📦 What's Changed

Major Releases

• @equinor/fusion-framework-module-msal → v6.0.0 - MSAL Browser v4 upgrade with telemetry
• @equinor/fusion-framework-module-msal-node → v2.0.0 - MSAL Node API updates
• @equinor/fusion-framework-react-app → v8.0.0 - React hooks MSAL v4 compatibility

Minor Releases

• @equinor/fusion-framework-module-telemetry → v4.4.0 - Export Measurement classes

Patch Updates (30+)

All framework packages updated for MSAL v4 API compatibility including:

• Framework core, CLI, HTTP module, SignalR module
• React components and hooks
• Legacy interop, Vite plugins
• All 18 cookbooks with improved documentation

⚠️ Breaking Changes

@equinor/fusion-framework-module-msal v6.0.0

Internal API structure changes (marked as major for safety), but public API remains fully compatible:

• Method signatures updated internally to match MSAL v4
• New telemetry integration (optional)
• Previous v2 API calls continue to work unchanged

@equinor/fusion-framework-module-msal-node v2.0.0

• login(options: { scopes: string[] }) → login(options: { request: { scopes: string[] } })
• acquireAccessToken(options: { scopes: string[] }) → acquireAccessToken(options: { request: { scopes: string[] } })

🚀 Migration Guide

No Action Required

Existing code continues to work without changes:

// This still works exactly as before
const framework = await createFramework({
  modules: [enableMSAL()],
});

const token = await framework.modules.auth.acquireToken({
  scopes: ["User.Read"],
});

Optional: Adopt New Features

// New MSAL v4 features available
const token = await framework.modules.auth.acquireToken({
  request: { scopes: ["User.Read"] },
  behavior: "popup",
  silent: true,
});

For MSAL Node Users

Update to new request format:

// Before
await authProvider.login({ scopes: ["user.read"] });

// After
await authProvider.login({ request: { scopes: ["user.read"] } });

🐛 Bug Fixes & Improvements

• Fixed React hooks compatibility with MSAL v4 account properties
• Updated HTTP module token acquisition for MSAL v4 API
• Fixed SignalR module authentication flow
• Improved legacy interop container MSAL v4 compatibility
• Enhanced SPA plugin MSAL client configuration

📚 Documentation Updates

• Comprehensive cookbook README improvements across all 18 examples
• New MSAL v4 authentication guide with practical examples
• Reorganized documentation structure for better discoverability
• Added migration guides and code examples

🔗 Related Links

• Full Changelog
• Issue #3621 - Update module-msal dependency to MSAL Browser v4
• Issue #3634 - Add Telemetry Integration to MSAL Module
• PR #3714 - MSAL v4 upgrade with backward compatibility

🙏 Acknowledgments

Special thanks to @odinr for the comprehensive MSAL v4 upgrade implementation and the entire Fusion Framework team for maintaining this critical infrastructure.

---

🤖 Beep Bopp – Release notes created by Fusion Assistant!