Broadcom released ESXCLI 9.1 with PyPI distribution, support for current Python versions, stricter certificate behavior, and revised logging defaults. Those changes improve maintainability and security, but they also move assumptions that may be embedded in jump hosts and scripts. A client upgrade should therefore be treated as an automation compatibility change, not a transparent workstation update.
Why it matters in production
The inventory starts with every place ESXCLI runs: administrator laptops, hardened jump hosts, scheduled tasks, CI runners, recovery workstations, and vendor appliances. Record Python versions, virtual environments, package source, pinned dependencies, credential storage, certificate thumbprints, target vCenter or ESX endpoints, and how output is parsed. The least visible copy is often the one used during an outage.
SHA-1 thumbprints deserve specific attention because 9.1 rejects them. Replacing the client without preparing trusted certificates or new fingerprints can stop emergency access at exactly the wrong moment. Similarly, a move to PyPI changes package-governance questions: which repository is trusted, whether an internal mirror is required, how versions are pinned, and how a known build is restored on an isolated host.
Logging behavior also changes the evidence path. If file logging is no longer enabled by default, teams that collect or troubleshoot ESXCLI sessions may silently lose expected records. Test exit codes, structured and textual output, certificate failures, proxy behavior, and log collection against representative commands before widening deployment. Keep the previous client available through a controlled rollback path.
Practical takeaway
The practical takeaway is that a safer CLI still needs a migration plan. Find every installation, replace SHA-1 trust, validate Python and packaging, preserve required logs, and run real automation tests. Command-line compatibility becomes operationally important when the scripts using it carry host maintenance, recovery, or security work.