microsoft/semantic-kernel
1
0
Fork 0
mirror of https://github.com/microsoft/semantic-kernel.git synced 2026-10-12 02:19:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,997 Commits 63 Branches 1,077 Tags
copilot/bump-messagepack-version
Commit Graph
4997 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
copilot-swe-agent[bot] 7cd7bb528f Fix MessagePack vulnerability GHSA-hv8m-jj95-wg3x by pinning to 2.5.301 2026-06-15 15:20:59 +00:00
SergeyMenshykhandCopilot 61331d834d Python: Add function_choice_behavior support to Azure AI and OpenAI Assistant agents (#14057) 
### Description

Adds `function_choice_behavior` parameter to Azure AI and OpenAI
Assistant agents, aligning them with the existing Responses agent and
Chat Completion agent APIs.

### Changes

- Add `function_choice_behavior` parameter to
`invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and
`OpenAIAssistantAgent` public APIs
- Add `function_choice_behavior` parameter to internal
`AzureAIAgentThreadActions` and `AssistantThreadActions`
`invoke`/`invoke_stream` methods
- Support `tools` parameter override for SDK-level tools
(CodeInterpreter, FileSearch, etc.)
- Filter kernel functions based on `FunctionChoiceBehavior`
configuration
- Validate that only `Auto` type with auto-invoke enabled is supported
- Fix `_get_tools` in OpenAI path to use passed `kernel` parameter
instead of `agent.kernel`
- Add comprehensive unit tests for both thread actions and public agent
APIs

---------

Co-authored-by: Copilot <[email protected]>
 2026-06-08 16:31:55 +00:00
Evan Mattson 417d62f8b1 Python: Bump Python package version to 1.43.0 for a release (#14052) 
### Motivation and Context

Bump Python package version to 1.43.0 for a release

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Bump Python package version to 1.43.0 for a release

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
python-1.43.0 		2026-06-03 22:25:51 +00:00
semenshi-mandCopilot 32e904c017 .Net: Bump .NET package version to 1.77.0 (#14040) 
- Update VersionPrefix from 1.76.0 to 1.77.0
- Update PackageValidationBaselineVersion from 1.75.0 to 1.76.0

Co-authored-by: Copilot <[email protected]>
dotnet-1.77.0 		2026-05-27 18:59:44 +00:00
Giles OdigweandCopilot d6f832e34a ci: harden Python test coverage workflow (#14026) 
## Summary

Improves the Python test coverage workflow with better input handling
and token management.

## Changes

- Added validation for the PR number file content before use in
environment setup
- Switched to using the built-in github.token instead of a PAT for
artifact download and PR comments
- Added actions: read permission to support artifact download with the
built-in token

## Notes

The workflow_run trigger provides a github.token scoped to the base
repository with the permissions declared in the workflow file. The
pull-requests: write permission allows posting comments on PRs,
including those opened from forks.

Co-authored-by: Copilot <[email protected]>
 2026-05-27 07:43:12 +00:00
SergeyMenshykhandCopilot 3e180c16b3 .Net: Enable default-on server URL validation for OpenAPI plugins (#14029) 
### Motivation and Context

Strengthen the OpenAPI plugin's server URL handling by making validation
active by default.

### Description

- Introduce `ServerUrlValidator` with host classification and DNS
resolution
- Make `RestApiOperationServerUrlValidationOptions` enforce validation
by default instead of opt-in
- Add `AllowPrivateNetworkAccess` opt-out for scenarios that require it
- Remove experimental `AllowedSchemes` property (SKEXP0040)
- Update `RestApiOperationRunner` to apply validation unconditionally
- Add unit tests

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The code follows the [.NET coding
conventions](https://learn.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
- [x] All unit tests pass
- [x] New unit tests added

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-25 19:24:11 +00:00
SergeyMenshykhandCopilot 644eb0a962 Python: [Breaking] Update OpenAPI document parsing options (#14009) 
Update OpenAPI document parsing to gate file and HTTP ref resolution
separately.

### Breaking change

- `RESOLVE_FILES` is no longer enabled by default. Only internal JSON
pointer references are resolved by default.
- Users with multi-file OpenAPI specs must now pass
`enable_file_ref_resolution=True` via
`OpenAPIFunctionExecutionParameters`.
- `enable_external_ref_resolution` has been renamed to
`enable_http_ref_resolution`.

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-18 12:49:00 +00:00
SergeyMenshykhandCopilot 58f4a66858 Python: Improve function call invocation parameter consistency (#14014) 
## Description

This PR improves the consistency of how the function_behavior parameter
is passed through internal invoke_function_call callsites.

### Changes

- Thread function_behavior parameter through all internal
invoke_function_call callsites for consistent parameter handling:
  - Realtime connector (_open_ai_realtime.py)
  - Responses agent (responses_agent_thread_actions.py)
  - Assistant agent (assistant_thread_actions.py)
  - Azure AI agent (agent_thread_actions.py)
  - Bedrock agent (bedrock_agent.py)
- Add defensive logging in kernel.py when function_behavior is not
provided
- Add unit tests covering parameter handling scenarios

### Testing

- All existing tests pass (678 passed, 0 failed)
- 5 new tests added covering the updated parameter handling

Co-authored-by: Copilot <[email protected]>
 2026-05-18 09:55:00 +00:00
Evan Mattson 2fb749e4bb Python: Bump Python pkg version to 1.42.0 for a release. (#14007) 
### Motivation and Context

Bump Python pkg version to 1.42.0 for a release.

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Bump Python pkg version to 1.42.0 for a release.

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
python-1.42.0 		2026-05-14 11:08:02 +09:00
Evan MattsonandCopilot a6c68af594 Python: Improvements for MCP (#14003) 
### Motivation and Context

Improvements for MCP tool calls by adding an optional sampling callback.

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Improvements for MCP tool calls by adding an optional sampling callback.

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-14 00:46:19 +00:00
SergeyMenshykhandCopilot 32abf99e29 Python: Harden HttpPlugin request validation (#13969) 
Improve input validation and request handling in the Python HttpPlugin.

### Changes
- Add explicit opt-in for unrestricted domain access
- Tighten URL validation logic
- Improve redirect handling when domain restrictions are configured
- Add regression tests

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-13 08:48:58 +00:00
SergeyMenshykhandCopilot a7cea9ab64 Python: Stop accessing private Azure SDK attributes in Azure AI Search connector (#13971) 
### Motivation and Context

CI fails with `AttributeError: 'SearchIndexClient' object has no
attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0
(released 2026-04-01). The 12.0.0 release migrated from AutoRest to
TypeSpec code generation, removing private attributes `_endpoint` and
`_credential` from `SearchIndexClient`.

CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0
since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound.

### Description

Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead,
store endpoint and credential as explicit fields on `AzureAISearchStore`
and `AzureAISearchCollection`, and pass them directly when constructing
`SearchClient`.

**Changes:**
- `_get_search_client()` accepts explicit `endpoint` + `credential`
params instead of extracting from `SearchIndexClient` private attrs
- `_resolve_credential()` new helper extracted from
`_get_search_index_client()` for reuse
- `AzureAISearchStore` / `AzureAISearchCollection` store
`search_endpoint` and `search_credential` as fields, thread them through
construction
- Tests updated to assert on public fields instead of private SDK
attributes

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] All unit tests pass with both `azure-search-documents==11.7.0b2`
and `==12.0.0`
- [x] No breaking changes to public API

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-13 08:35:56 +00:00
Roger BarretoandCopilot fdc6e68f58 .Net: Semantic Kernel -> Agent Framework - Migration/Samples Update (AF 1.0 Compatible) (#13852) 
## Description

Updates the SK → Agent Framework migration document, samples, and bridge
code from AF preview (`1.0.0-preview.251009.1`) to GA (`1.0.0`).

### Breaking changes addressed

| Preview API | AF 1.0 GA | Scope |
|---|---|---|
| `AgentThread` | `AgentSession` | Core type rename |
| `GetNewThread()` | `CreateSessionAsync()` | Now async |
| `AgentRunResponse` | `AgentResponse` | Return type rename |
| `AgentRunResponseUpdate` | `AgentResponseUpdate` | Streaming type
rename |
| `CreateAIAgent()` | `AsAIAgent()` | Extension method rename |
| `AssistantClient.CreateAIAgentAsync()` | **Removed** | Redirect to
Responses API |
| `PersistentAgentsClient` | **Obsolete** | Use `AIProjectClient` via
`Microsoft.Agents.AI.Foundry` |
| `Microsoft.Agents.AI.AzureAI` | `Microsoft.Agents.AI.Foundry` |
Package rename |
| `InProcessExecution.StreamAsync` | `RunStreamingAsync` | Workflow API
|
| `AgentRunUpdateEvent` | `AgentResponseUpdateEvent` | Workflow event |
| `AIAgent.Id` (virtual) | `IdCore` (protected virtual) | Override
pattern |

### Additional discoveries
- `using OpenAI.Chat;` required for `ChatClient.AsAIAgent()` extension
to resolve
- `using OpenAI.Responses;` required for `ResponsesClient.AsAIAgent()`
extension to resolve

### What changed

**Package versions** (`dotnet/Directory.Packages.props`)
- AF packages updated to `1.0.0`
- `Microsoft.Agents.AI.AzureAI` → `Microsoft.Agents.AI.Foundry`

**Bridge code** (`dotnet/src/Agents/Abstractions/AIAgent/`)
- `SemanticKernelAIAgent.cs`: New `Core` method overrides
(`CreateSessionCoreAsync`, `RunCoreAsync`, etc.)
- `SemanticKernelAIAgentThread` → `SemanticKernelAIAgentSession`
(extends `AgentSession`)

**31 migration samples** (all compile ✅)
- OpenAI/AzureOpenAI: `AsAIAgent`, `CreateSessionAsync`, `using
OpenAI.Chat;`
- Assistants (8): AF sections rewritten to Responses API
- Responses (8): Direct `ResponsesClient.AsAIAgent()`
- Foundry (4): `AIProjectClient.AsAIAgent()` via
`Microsoft.Agents.AI.Foundry`
- Orchestrations (3): `RunStreamingAsync`, `AgentResponseUpdateEvent`

**Migration document**
(`.github/upgrades/prompts/SemanticKernelToAgentFramework.md`)
- All AF preview API references updated to 1.0 GA patterns

**Unit/integration tests** (~15 files)
- Mechanical renames for `AgentSession`, `AgentResponse`,
`CreateSessionAsync`

### Validation

8 standalone console programs were created and executed against AF 1.0.0
NuGet packages with real API keys, validating all migration patterns
end-to-end:
1. OpenAI Basics (ChatClient → AsAIAgent, CreateSessionAsync,
Run/RunStreaming)
2. OpenAI ToolCall (AIFunctionFactory.Create, tool invocation)
3. OpenAI DI (ServiceProvider registration)
4. OpenAI Responses (ResponsesClient.AsAIAgent)
5. Azure AI Foundry (AIProjectClient.AsAIAgent)
6. Workflows Handoff (HandoffWorkflowBuilder,
InProcessExecution.RunStreamingAsync)
7. Session Lifecycle (Create, Serialize, Deserialize, multi-turn)
8. Assistants Migration Path (Responses API as replacement)

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-12 14:49:47 +00:00
SergeyMenshykhandCopilot 3f0e2d58fa Python: Percent-encode OpenAPI path params & pin azure-search-documents (#13967) 
Apply `urllib.parse.quote(safe='')` to path parameter values before
substitution in `build_path()`, consistent with the .NET implementation
which uses `HttpUtility.UrlEncode`.

### Changes
- `rest_api_operation.py`: encode path parameter values per RFC 3986
- `test_sk_openapi.py`: add tests for encoded path parameters
- `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4,
< 12.0.0`

### Pin azure-search-documents < 12.0.0
Version 12.0.0 removed the internal `_endpoint` attribute from
`SearchIndexClient`, which breaks `AzureAISearchCollection`
initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until
the code is updated to use the new public API.

### Tests
All existing and new `build_path` tests pass.

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-11 22:48:41 +00:00
Roger Barreto 590003243a .Net: Pin SharpCompress 0.48.0 to fix GHSA-6c8g-7p36-r338 (#13977) 
## Summary

Fixes a moderate-severity transitive vulnerability flagged by `dotnet
list package --vulnerable --include-transitive` across 10 projects in
the solution.

| Package | Current (resolved) | Pinned | Severity | Advisory |
|---|---|---|---|---|
| SharpCompress | 0.30.1 | 0.48.0 | Moderate |
[GHSA-6c8g-7p36-r338](https://github.com/advisories/GHSA-6c8g-7p36-r338)
|

## Why a transitive pin

`SharpCompress` is pulled in transitively via `MongoDB.Driver 3.5.2`:

`MongoDB.Driver (v3.5.2) -> SharpCompress (v0.30.1)`

The latest `MongoDB.Driver` (3.8.0) still declares `SharpCompress (>=
0.30.1)` as a floor, so a minor bump of `MongoDB.Driver` does not lift
the resolved `SharpCompress` version. There is no transitive update path
through the direct dependency.

The advisory's vulnerable range is `<= 0.47.4`, so `0.48.0` is the
smallest non-vulnerable release. `1.0.0` was rejected as it is a
major-version jump.

## Changes

This mirrors the existing `Snappier` vulnerability pin pattern already
in the repo (same file locations, same comment style):

1. `dotnet/Directory.Packages.props` -- add `PackageVersion` for
`SharpCompress 0.48.0` next to the `MongoDB.Driver` / `Snappier` entries
with a vulnerability comment.
2. `dotnet/src/VectorData/MongoDB/MongoDB.csproj` -- add direct
`PackageReference Include="SharpCompress"` to override the transitive
resolution.
3. `dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj` -- same.

The pin in the two `Connectors.*` source projects propagates the
override to all downstream consumers (samples, integration tests,
conformance tests, unit tests).

## Verification

| Check | Scope | Result |
|---|---|---|
| `dotnet list SK-dotnet.slnx package --vulnerable --include-transitive`
| Full solution (155 projects) | All clean (was 10 projects flagging) |
| `dotnet build --warnaserror` | `MongoDB.csproj` | Pass |
| `dotnet build --warnaserror` | `CosmosMongoDB.csproj` | Pass |
| `dotnet format --verify-no-changes` (CI-parity Docker
`mcr.microsoft.com/dotnet/sdk:10.0`) | Both csproj | Pass (Formatted 0
of N files) |
| `dotnet test` | `MongoDB.UnitTests` | 37/37 passed |
| `dotnet test` | `CosmosMongoDB.UnitTests` | 28/28 passed |

Conformance test projects skipped (require live emulators, pre-existing
env-dependent suites, not impacted by a transitive pin).
 2026-05-11 16:37:38 +00:00
SergeyMenshykhandCopilot f2b3c931d1 .Net: Version bump 1.76.0 (#13972) 
### Motivation and Context

Bump SK .NET version for the next release.

### Description

- VersionPrefix: 1.75.0  1.76.0
- PackageValidationBaselineVersion: 1.74.0  1.75.0

Co-authored-by: Copilot <[email protected]>
dotnet-1.76.0 		2026-05-08 19:14:20 +00:00
SergeyMenshykhandCopilot 3dd139b2bd .Net: Harden CloudDrivePlugin defaults and add path validation (#13958) 
### Description

- Improve default settings in CloudDrivePlugin
- Add path validation for share-link operations
- Improve path canonicalization
- Add regression tests

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass
- [x] New tests added

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-08 11:27:22 +00:00
SergeyMenshykhandCopilot 446c2eff94 .Net: Improve input validation in OpenAPI plugin (#13962) 
Strengthen input validation for server variable substitution and path
parameter handling in RestApiOperation.

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-08 11:26:50 +00:00
CozmopolitandRoger Barreto b7ae840d65 .Net: feat(connectors): Support ImageContent in tool/function results (#13431) 
### Motivation and Context

Fixes #13430

Currently, when a Semantic Kernel function returns `ImageContent`, it
gets serialized to JSON - losing the binary image data and preventing
multimodal-capable models from processing the image.

This PR enables `ImageContent` preservation in tool/function results,
allowing connectors with multimodal capabilities (Gemini 3+, Anthropic)
to pass images natively to the model. This is essential for agentic
workflows where tools generate or process images that the model needs to
analyze.

### Description

#### FunctionCallsProcessor (shared infrastructure)
- Changed `ProcessFunctionResult()` return type from `string` to
`object`
- Added early return for `ImageContent` to preserve it for
multimodal-capable connectors
- Added `ImageContentNotSupportedErrorMessage` constant for consistent
error messaging

#### Google Gemini Connector (native support)
- Extended `FunctionResponsePart` with `Parts` property for nested
multimodal content
- Added `FunctionResponsePartContent` class with `InlineData` support
- Implemented `CreateImageFunctionResponsePart()` to convert
`ImageContent` to Gemini's native `inlineData` format

#### OpenAI Connector (error handling)
- Added `ImageContent` check with clear error message (API does not
support images in tool results)

#### OpenAI Agents (error handling)
- Added `GetFunctionResultAsString()` helper with `ImageContent` error
handling

#### Amazon Bedrock Agents (error handling)
- Added `GetFunctionResultAsString()` helper with `ImageContent` error
handling

#### New Unit Tests

| Test | File |
|------|------|
| `ItShouldPreserveImageContentWithoutSerialization` |
`FunctionCallsProcessorTests.cs` |
| `FromChatHistoryImageContentInToolResultCreatesInlineDataPart` |
`GeminiRequestTests.cs` |
|
`FromChatHistoryImageContentWithoutDataThrowsInvalidOperationException`
| `GeminiRequestTests.cs` |
|
`FromChatHistoryImageContentWithoutMimeTypeThrowsInvalidOperationException`
| `GeminiRequestTests.cs` |
|
`VerifyAssistantMessageAdapterGetMessageWithImageContentInFunctionResult`
| `AssistantMessageFactoryTests.cs` |

#### Notes

- **No breaking changes**: All changes are to internal APIs. The public
`FunctionResultContent.Result` property is already `object?`.
- **Gemini version detection**: The connector does not check the model
version. If an older Gemini model does not support
`functionResponse.parts`, the API will return an appropriate error.
- **URI-based ImageContent**: Only `ImageContent` with binary data is
supported. URI-based `ImageContent` will throw
`InvalidOperationException`.
- **MistralAI**: Out of scope - has its own `ProcessFunctionResult`
implementation.
- **Related**: Prepares infrastructure for PR #13419 (Anthropic
Connector multimodal support)

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄


[sk-pr-MultimodalToolResults.md](https://github.com/user-attachments/files/24299998/sk-pr-MultimodalToolResults.md)

---------

Co-authored-by: Roger Barreto <[email protected]>
 2026-05-07 21:01:31 +00:00
SergeyMenshykhandCopilot 52d4e5ce85 .Net: Harden gRPC plugin address handling (#13961) 
## Description

Add developer-controlled address configuration and validation for the
gRPC plugin.

### Motivation and Context

The gRPC plugin now supports `GrpcFunctionExecutionParameters` for
configuring address handling, including an optional address override,
allowed base addresses, and scheme restrictions.

### Changes

- Introduced `GrpcFunctionExecutionParameters` class for
developer-controlled gRPC channel configuration
- Added address validation with scheme and allowlist checks in
`GrpcOperationRunner`
- Plumbed execution parameters through all public methods in
`GrpcKernelExtensions`
- Updated and added unit tests

### Type of change

- [x] Bug fix (non-breaking change which fixes an issue)

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-07 18:00:17 +00:00
SergeyMenshykhCopilotCopilot Autofix powered by AI
 		73d3c59902 Update Kiota packages to fix NU1903 vulnerability (#13966) 
## Problem

NuGet audit reports NU1903 for `Microsoft.Kiota.Abstractions` < 1.22.0
([GHSA-7j59-v9qr-6fq9](https://github.com/advisories/GHSA-7j59-v9qr-6fq9))
— the Kiota `RedirectHandler` leaks `Cookie` and `Proxy-Authorization`
headers on cross-host redirects.

The vulnerability is pulled in transitively via `Microsoft.Graph` →
`Microsoft.Graph.Core` 3.2.5 → `Microsoft.Kiota.Abstractions` 1.17.1.

## Fix

- **`Microsoft.Graph`**: 5.94.0 → 5.105.0
- **`Microsoft.Graph.Core`**: added at 3.2.6 (requires
`Kiota.Abstractions` ≥ 1.22.1)
- **`Microsoft.Kiota.Abstractions`**: added at 1.22.2
- **`Microsoft.IdentityModel.JsonWebTokens`**: 8.15.0 → 8.16.0 (required
by Graph.Core 3.2.6)
- **`System.IdentityModel.Tokens.Jwt`**: 8.15.0 → 8.16.0 (required by
Graph.Core 3.2.6)
- Added direct `Microsoft.Graph.Core` `PackageReference` in
`Plugins.MsGraph.csproj` to pin the transitive version

## Verification

All three affected projects report no vulnerable packages after the
change:
- `Plugins.MsGraph`
- `Concepts`
- `Plugins.UnitTests`

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-05-07 17:32:44 +00:00
Copilotandrogerbarreto fb10d92d8c .Net: Bump Snappier to 1.3.1 to fix NU1903 high-severity vulnerability (GHSA-pggp-6c3x-2xmx) (#13960) 
### Motivation and Context

`MongoDB.Driver 3.5.2` transitively introduces `Snappier 1.0.0`, which
carries a high-severity vulnerability (GHSA-pggp-6c3x-2xmx): infinite
loop during SnappyStream decompression of malformed framed input. All
Snappier versions ≤ 1.3.0 are affected; 1.3.1 is the first patched
release. This was blocking the merge queue via NU1903.

### Description

- **`dotnet/Directory.Packages.props`** — Add `PackageVersion` entry
pinning `Snappier` to `1.3.1`.
- **`dotnet/src/VectorData/MongoDB/MongoDB.csproj`** — Add explicit
`PackageReference` for `Snappier` (versionless, resolved via CPM) so
NuGet treats it as a direct dependency at 1.3.1, overriding the
transitive 1.0.0 from `MongoDB.Driver`.
- **`dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj`** — Same
override for the CosmosMongoDB connector.

In NuGet's resolution algorithm, a direct reference at depth 1 wins over
a transitive reference at depth 2, so this cleanly forces 1.3.1 without
changing the `MongoDB.Driver` pin itself.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

Please investigate a solution to snappier vulnerability fix (update
version) and propose a PR with the bump, ideally following the first
immediate a non breaking version bump

<analysis>
**Chronological Review:**
1. User asked to analyze PR #13431 (Gemini multimodal tool results in
microsoft/semantic-kernel) for gaps
2. Initial analysis identified ~11 gaps with broad scope including
OpenAI Assistants, AzureAI, Responses API, MistralAI
3. User invoked ouroboros skill, asked to reassess scoping to Google
package only
4. Reassessment: Google connector bypasses FunctionCallsProcessor; only
validated regression is OpenAI Responses API
5. User invoked ouroboros to seed the observation; created seed file
`pr-13431-followup.seed.yaml`
6. User asked to execute seed + identify pipeline error
7. Implemented 5 file changes; identified pipeline error CS8602 in
GeminiRequestTests.cs:809
8. All builds/tests passed; user asked about string→object impact in
plan mode
9. Investigation revealed `FunctionCallsProcessor` is `internal sealed`,
source-distributed, so blast radius small
10. User confirmed all implemented; ran CI-parity dotnet format via
WSL2+Docker (all pass)
11. User asked to commit and push - committed `de08bce99` and pushed to
Cozmopolit fork
12. User asked to check PR comments - found 2 Copilot bot review
comments
13. User said: add OpenAI test (item 1), reply out-of-scope (item 2)
14. Added OpenAI ChatCompletion test, committed `e9f27d21a`, pushed,
replied to both bot comments
15. User asked PR number (13431)
16. User invoked /auto pr_task - PR was green, no action needed
17. User said merge queue failed, asked to investigate
18. Investigation found: NU1903 Snappier 1.0.0 vulnerability blocking
merge queue; not caused by our PR
19. **Most recent: User asked "Do we have a fix in main for this
already?"**
20. **Investigation confirmed: NO fix in main** - origin/main HEAD
`1a5065e5c` unchanged, `MongoDB.Driver 3.5.2` still pinned, no Snappier
override, no PRs/issues for Snappier or NU1903 in the repo recently
21. **Offered to open a small fix PR pinning Snappier to a patched
version**

**Intent Mapping:**
- User wants PR #13431 fully landed
- User wants to understand whether merge queue failure is in scope
- User now considering whether to fix the Snappier vulnerability
separately

**Technical Inventory:**
- .NET 10.0, semantic-kernel repo
- WSL2 + Docker (mcr.microsoft.com/dotnet/sdk:10.0) for CI parity
- gh CLI for PR/CI operations
- Git remotes: origin=microsoft, roger=rogerbarreto fork,
cozmopolit=Cozmopolit fork (added)
- Branch: `fix/multimodal-tool-results`
- PR head fork: Cozmopolit, maintainerCanModify=true

**Code Archaeology:**
Files changed in commits `de08bce99` + `e9f27d21a`:
- `dotnet/src/Agents/OpenAI/Internal/ResponseThreadActions.cs` — added
GetFunctionResultAsString helper
-
`dotnet/src/Agents/UnitTests/OpenAI/Internal/ResponseThreadActionsTests.cs`
— new (3 tests)
-
`dotnet/src/Connectors/Connectors.Google/Core/Gemini/Models/GeminiRequest.cs`
— extracted s_imageFunctionResponseEnvelope
-
`dotnet/src/Connectors/Connectors.Google.UnitTests/Core/Gemini/GeminiRequestTests.cs`
— CS8602 fix
-
`dotnet/src/InternalUtilities/connectors/AI/FunctionCalling/FunctionCallsProcessor.cs`
— XML-doc tightening
-
`dotnet/src/Connectors/Connectors.OpenAI.UnitTests/Services/OpenAIChatCompletionServiceTests.cs`
— added
ItSendsImageContentNotSupportedErrorWhenToolResultIsImageContentAsync

Identified vulnerable package: `MongoDB.Driver 3.5.2` in
`dotnet/Directory.Packages.props:173` brings in transitive `Snappier
1.0.0`

**Progress Assessment:**
- ✅ All planned implementation completed
- ✅ Both bot review comments replied to
- ✅ All 7 todos done
- ⚠️ PR cannot merge due to environmental Snappier vulnerability (not
our PR's fault)
- 🔲 User considering whether to open a separate Snappier fix PR

**Context Validation:**
- PR state: OPEN, MERGEABLE, CLEAN, APPROVED (markwallace-microsoft)
- HEAD SHA: `e9f27d21a85a8b97ee5f29619b23b82a03e313ff`
- All required CI checks pass on PR head
- Merge queue attempt failed at 2026-05-07T10:01:31, removed by
github-merge-queue[bot] at 10:08:05
- Failed merge_group run: 25489152862

**Recent Commands Analysis:**
Most recent two tool batches:
1. `git fetch origin main; git log origin/main
--since="2026-05-06T15:00:00Z" --oneline` → only `1a5065e5c`
(yesterday's commit)
2. `git show origin/main:dotnet/Directory.Packages.props | grep
Snappier|MongoDB.Driver` → only `MongoDB.Driver 3.5.2`, no Snappier
override
3. `gh search prs/issues --state all "Snappier"` → command failed
(invalid `all` state)
4. `gh api search/issues?q=Snappier+repo:microsoft/semantic-kernel` →
empty results
5. `gh api search/issues?q=NU1903+repo:microsoft/semantic-kernel` → 3
historical results from 2024, all unrelated

Final response: confirmed NO fix in main, offered to open a small fix PR
pinning Snappier.
</analysis>

<summary>
1. Conversation Overview:
   - Primary Objectives:
     - Analyze SK PR #13431 (G...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

Created from Copilot CLI via the copilot delegate command.

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: rogerbarreto <[email protected]>
 2026-05-07 12:56:07 +00:00
SergeyMenshykhandCopilot 1a5065e5cf .Net: Fix DocumentPlugin path validation order (#13956) 
### Motivation and Context

Fix path validation order in DocumentPlugin to canonicalize paths before
validating against AllowedDirectories. Also removes redundant path
transformation from LocalFileSystemConnector.

### Description

- Canonicalize file paths (expand environment variables and resolve to
absolute form) **before** validating against AllowedDirectories in both
`ReadTextAsync` and `AppendTextAsync`
- Remove environment variable expansion from `LocalFileSystemConnector`
the connector should operate on the path it receives, not transform it
- Add regression tests

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass
- [x] New tests added

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-06 15:10:48 +00:00
SergeyMenshykhandCopilot 2a719ca318 .Net: Add deny-by-default AllowedUploadDirectories to CloudDrivePlugin (#13953) 
### Description

Add deny-by-default `AllowedUploadDirectories` to `CloudDrivePlugin`.

- Added `AllowedUploadDirectories` property (defaults to empty =
deny-all)
- `UploadFileAsync` now validates the local file path against the
allowlist before uploading
- Paths are canonicalized with environment variable expansion, UNC
rejection, and directory traversal protection
- Added unit tests for the new behavior

---------

Co-authored-by: Copilot <[email protected]>
 2026-05-05 15:33:11 +00:00
Octopusocto-patchSergeyMenshykhCopilotSergeyMenshykhCopilot
 		006a5d9a9b .Net: fix: fall back to ToString() when logging function results with unregistered types (#13884) 
Fixes #13681

## Problem

When a `KernelFunction` returns a value whose runtime type is not
registered in `AbstractionsJsonContext` (e.g.
`Microsoft.Extensions.AI.TextContent` returned by an MCP tool via
`.AsKernelFunction()`), the function result logging in
AOT/source-generation mode throws `NotSupportedException` during JSON
serialization. The exception is caught but produces an unhelpful log
entry:

```
Function SomePlugin-SomeTool result: Failed to log function result value
System.NotSupportedException: JsonTypeInfo metadata for type 'Microsoft.Extensions.AI.TextContent' was not provided by TypeInfoResolver of type 'Microsoft.SemanticKernel.AbstractionsJsonContext'.
```

## Solution

Add a `ToString()` fallback in the `NotSupportedException` catch block
of `LogFunctionResultValueInternal`. When JSON serialization fails
because the runtime type is absent from the source-generated context,
the logger now calls `resultValue?.Value?.ToString()` to produce useful
output instead of the generic error message.

## Testing

- Added `ItShouldFallBackToToStringWhenJsonSerializationIsNotSupported`
unit test that uses a restricted source-generated
`JsonSerializerContext` (containing only `object` and
`IDictionary<string, object?>`) to simulate the AOT scenario, verifying
that `ToString()` output appears in the log instead of the failure
message.
- All existing `ItShouldLogFunctionResultOfAnyType` test cases are
unchanged.

---------

Co-authored-by: octo-patch <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
Co-authored-by: Copilot <[email protected]>
 2026-05-01 08:31:14 +00:00
Schmitt ChristianClaude Opus 4.6Roger Barreto
 		6e1ab9dee5 .Net: Fix VertexAI global endpoint URI construction (#13620) (#13621) 
The global VertexAI location uses `https://aiplatform.googleapis.com`
rather than the regional `https://{location}-aiplatform.googleapis.com`
pattern. This adds a `GetVertexAIBaseUri` helper to ClientBase that
selects the correct base URI and updates all VertexAI clients (chat
completion, token counter, embeddings) to use it.

Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
 2026-05-01 08:29:20 +00:00
SergeyMenshykhandCopilot a1a701d051 .Net: Fix whitespace formatting in PromptExecutionSettingsExtensions.cs (#13941) 
### Motivation and Context

The `PromptExecutionSettingsExtensions.cs` file had whitespace
formatting errors (WHITESPACE and IDE0055 warnings) on lines 179-188
caused by `else` and `if` being split across separate lines instead of
combined as `else if`.

### Description

Combined split `else` / `if` statements into single `else if` lines in
`PromptExecutionSettingsExtensions.cs`, resolving 10 whitespace
formatting errors and IDE0055 warnings.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Co-authored-by: Copilot <[email protected]>
 2026-04-30 14:58:55 +00:00
Roger Barreto 1369c2e0ce .Net: Add ExtraBody to OpenAIPromptExecutionSettings (#12307) (#13934) 
### Motivation and Context

Closes #12307. Provides .NET parity with the Python fix in #11852 by
adding an escape-hatch `ExtraBody` property to
`OpenAIPromptExecutionSettings`. This allows callers to inject
vendor-specific or preview parameters into the request body without
waiting for SDK modeling. Use cases from the issue include:

- Qwen3 open-source models requiring `enable_thinking: false` for
non-streaming calls
- ChatGLM thinking-mode flags
- Any OpenAI-compatible endpoint exposing fields not modeled by the SDK

### Description

Adds `IDictionary<string, object?>? ExtraBody` to
`OpenAIPromptExecutionSettings` (inherited automatically by
`AzureOpenAIPromptExecutionSettings`), marked
`[Experimental("SKEXP0010")]`.

#### Hybrid key syntax (diverges intentionally from Python to leverage
the OpenAI .NET SDK's `JsonPatch`)

- A plain key is treated as a literal top-level field name. Keys with
dots, brackets, or other special characters are bracket-quoted
automatically and remain literal.
- `ExtraBody["enable_thinking"] = false` → `{ "enable_thinking": false
}`
  - `ExtraBody["weird.key"] = "x"` → `{ "weird.key": "x" }`
- A key starting with `$.` is interpreted as a JSONPath expression and
applied as a deep patch onto the request body.
- `ExtraBody["$.thinking.enabled"] = false` → `{ "thinking": {
"enabled": false } }`
- `ExtraBody["$.tools[0].function.name"] = "x"` → patches into array
elements
- Nested dictionaries are also supported via plain keys:
`ExtraBody["thinking"] = new Dictionary<string,object?> { ["enabled"] =
false }`.

#### Behavior

- **Last-write-wins on collisions** with strongly-typed properties (e.g.
`Temperature`). Documented.
- **`null` values emit JSON `null`**. Field removal is not supported.
- **No input validation, no telemetry emission** of `ExtraBody` contents
(Python parity).
- **Shallow `Clone()`**, `ReadOnlyDictionary` on `Freeze()`.

#### Wiring

- Classic path: `ClientCore.ChatCompletion.cs` and
`AzureClientCore.ChatCompletion.cs` apply patches at the end of
`CreateChatCompletionOptions`.
- `IChatClient` path: new `protected virtual
PrepareChatOptionsForRequest(ChatOptions)` hook on
`PromptExecutionSettings` (mirrors the existing
`PrepareChatHistoryForRequest` pattern). The OpenAI override sets
`ChatOptions.RawRepresentationFactory` and removes the redundant
`AdditionalProperties["extra_body"]` entry produced by `ToChatOptions`'s
round-trip.

#### Files changed

- `SemanticKernel.Abstractions/AI/PromptExecutionSettings.cs` — new hook
+ internal bridge
- `SemanticKernel.Abstractions/AI/PromptExecutionSettingsExtensions.cs`
— invokes the hook on the original derived instance
- `Connectors.OpenAI/Settings/OpenAIPromptExecutionSettings.cs` —
property, Freeze, Clone, `PrepareChatOptionsForRequest` override,
`ApplyExtraBody`/`ApplyExtraBodyEntry` helpers
- `Connectors.OpenAI/Core/ClientCore.ChatCompletion.cs` — apply in
classic path
- `Connectors.AzureOpenAI/Core/AzureClientCore.ChatCompletion.cs` —
apply in Azure classic path
- `samples/Concepts/ChatCompletion/OpenAI_ChatCompletionExtraBody.cs` —
concept sample (flat field + deep patch)

#### Tests (14 new, all passing)

`Connectors.OpenAI.UnitTests` (11): non-streaming flat key, streaming
flat key, collision (last-write-wins), nested dict, `$.` deep patch,
literal dotted key, `null` value, `FromExecutionSettings` round-trip,
Clone shallow, Freeze read-only, `ToChatOptions`
`RawRepresentationFactory` + `AdditionalProperties` cleanup.

`Connectors.AzureOpenAI.UnitTests` (3): flat key, collision, `$.` deep
patch.

#### Regression

- `Connectors.OpenAI.UnitTests`: 485 passed
- `Connectors.AzureOpenAI.UnitTests`: 493 passed
- `SemanticKernel.UnitTests`: 1606 passed (verifies the new hook in
Abstractions has no side effects)

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2026-04-30 14:36:51 +00:00
Barton Milnor Malloryandwestey a68600a73a .Net: Update Step04_AzureAIAgent_CodeInterpreter.cs (#13886) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

Co-authored-by: westey <[email protected]>
 2026-04-30 14:18:08 +00:00
dependabot[bot] 4e4b9456b8 Python: Update pydantic requirement from !=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.13,>=2.0 to >=2.0,!=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.14 in /python (#13864) 
Updates the requirements on
[pydantic](https://github.com/pydantic/pydantic) to permit the latest
version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/releases">pydantic's
releases</a>.</em></p>
<blockquote>
<h2>v2.13.0 2026-04-13</h2>
<h2>v2.13.0 (2026-04-13)</h2>
<p>The highlights of the v2.13 release are available in the <a
href="https://pydantic.dev/articles/pydantic-v2-13-release">blog
post</a>.
Several minor changes (considered non-breaking changes according to our
<a
href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning
policy</a>) are also included in this release. Make sure to look into
them before upgrading.</p>
<p>This release contains the updated <code>pydantic.v1</code> namespace,
matching version 1.10.26 which includes support for Python 3.14.</p>
<h3>What's Changed</h3>
<p>See the beta releases for all changes sinces 2.12.</p>
<h4>Packaging</h4>
<ul>
<li>Add zizmor for GitHub Actions workflow linting by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li>
<li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by
<a href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li>
</ul>
<h4>New Features</h4>
<ul>
<li>Allow default factories of private attributes to take validated
model data by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li>
</ul>
<h4>Changes</h4>
<ul>
<li>Warn when serializing fixed length tuples with too few items by <a
href="https://github.com/arvindsaripalli"><code>@​arvindsaripalli</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li>
</ul>
<h4>Fixes</h4>
<ul>
<li>Change type of <code>Any</code> when synthesizing
<code>_build_sources</code> for <code>BaseSettings.__init__()</code>
signature in the mypy plugin by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li>
<li>Fix model equality when using runtime <code>extra</code>
configuration by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a
href="https://github.com/arvindsaripalli"><code>@​arvindsaripalli</code></a>
made their first contribution in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0">https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/blob/main/HISTORY.md">pydantic's
changelog</a>.</em></p>
<blockquote>
<h2>v2.13.0 (2026-04-13)</h2>
<p><a
href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0">GitHub
release</a></p>
<p>The highlights of the v2.13 release are available in the <a
href="https://pydantic.dev/articles/pydantic-v2-13-release">blog
post</a>.
Several minor changes (considered non-breaking changes according to our
<a
href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning
policy</a>)
are also included in this release. Make sure to look into them before
upgrading.</p>
<p>This release contains the updated <code>pydantic.v1</code> namespace,
matching version 1.10.26 which includes support for Python 3.14.</p>
<h3>What's Changed</h3>
<p>See the beta releases for all changes sinces 2.12.</p>
<h4>New Features</h4>
<ul>
<li>Allow default factories of private attributes to take validated
model data by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li>
</ul>
<h4>Changes</h4>
<ul>
<li>Warn when serializing fixed length tuples with too few items by <a
href="https://github.com/arvindsaripalli"><code>@​arvindsaripalli</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li>
</ul>
<h4>Fixes</h4>
<ul>
<li>Change type of <code>Any</code> when synthesizing
<code>_build_sources</code> for <code>BaseSettings.__init__()</code>
signature in the mypy plugin by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li>
<li>Fix model equality when using runtime <code>extra</code>
configuration by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li>
</ul>
<h4>Packaging</h4>
<ul>
<li>Add zizmor for GitHub Actions workflow linting by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li>
<li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by
<a href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a
href="https://github.com/arvindsaripalli"><code>@​arvindsaripalli</code></a>
made their first contribution in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li>
</ul>
<h2>v2.13.0b3 (2026-03-31)</h2>
<p><a
href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0b3">GitHub
release</a></p>
<h3>What's Changed</h3>
<h4>New Features</h4>
<ul>
<li>Add <code>ascii_only</code> option to <code>StringConstraints</code>
by <a
href="https://github.com/ai-man-codes"><code>@​ai-man-codes</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/12907">#12907</a></li>
<li>Support <code>exclude_if</code> in computed fields by <a
href="https://github.com/andresliszt"><code>@​andresliszt</code></a> in
<a
href="https://redirect.github.com/pydantic/pydantic/pull/12748">#12748</a></li>
<li>Push down constraints in unions involving <code>MISSING</code>
sentinel by <a
href="https://github.com/Viicos"><code>@​Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/12908">#12908</a></li>
</ul>
<h4>Changes</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/pydantic/commit/46bf4fa648af3a1fbf4603a37f210e9d9c618357"><code>46bf4fa</code></a>
Fix Pydantic release workflow (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13067">#13067</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/1b359edab09c623464d23c6fd2503ae5ff276d43"><code>1b359ed</code></a>
Prepare release v2.13.0 (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13065">#13065</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/b1bf19445d8ac144a7a0e82674d2d87eebab6c18"><code>b1bf194</code></a>
Fix model equality when using runtime <code>extra</code> configuration
(<a
href="https://redirect.github.com/pydantic/pydantic/issues/13062">#13062</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/17a35e371bdff348c0690651d324c91fc7c9ff9e"><code>17a35e3</code></a>
Update jiter to v0.14.0 (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13064">#13064</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/feea402b23fa23774669908c4e08a61ba1e4238e"><code>feea402</code></a>
Use <code>simulation</code> mode in Codspeed CI (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13063">#13063</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/671c9b0d4d3f9b2f1b95ca32ac85cb69e824e0bc"><code>671c9b0</code></a>
Add basic benchmarks for model equality (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13061">#13061</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/d17d71e00a35f190b27321aa6f8f2a03139c00b8"><code>d17d71e</code></a>
Bump cryptography from 46.0.6 to 46.0.7 (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13056">#13056</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/919d61ac419af5151b673a90b65c9a12631091cf"><code>919d61a</code></a>
👥 Update Pydantic People (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13059">#13059</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/e7cf5dcb939ea98511e669b647c0273667a1b08a"><code>e7cf5dc</code></a>
Fix people workflow (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13047">#13047</a>)</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/2a806ad09b984fcc43568191aba5d965350995a0"><code>2a806ad</code></a>
Add regression test for <code>MISSING</code> sentinel serialization with
subclasses (<a
href="https://redirect.github.com/pydantic/pydantic/issues/13">#13</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/pydantic/pydantic/compare/v2.0...v2.13.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 10:20:48 +00:00
dependabot[bot] 6cc918e87f Update google-genai requirement from ~=1.51.0 to >=1.51,<1.75 in /python (#13865) 
Updates the requirements on
[google-genai](https://github.com/googleapis/python-genai) to permit the
latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/python-genai/releases">google-genai's
releases</a>.</em></p>
<blockquote>
<h2>v1.74.0</h2>
<h2><a
href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a>
(2026-04-29)</h2>
<h3>Features</h3>
<ul>
<li>[Interactions] Add
FileCitation.{custom_metadata,media_id,page_number} (<a
href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li>
<li>Add <code>output_info</code> to <code>BatchJob</code> (<a
href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li>
<li>Add gemini-3.1-flash-tts-preview model to options (<a
href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li>
<li>Add ImageResizeMode for GenerateVideos (<a
href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li>
<li>Add new Gemini Deep Research agent models (<a
href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li>
<li>Add one_of support to JSONSchema for Agent Platform (<a
href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li>
<li>Add Vertex Dataset input and output options for batch jobs (<a
href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li>
<li><strong>interaction-api:</strong> Add grounding tool usage breakdown
to Interaction Usage. (<a
href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li>
<li>Introduce <code>enterprise</code> to Client constructor and
<code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a
href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li>
<li>Replace the more ambiguous rate field with sample_rate. (<a
href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Catch google-auth wrapped errors (<a
href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li>
<li>Removing Python 3.9 support due to EOL (<a
href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li>
<li><strong>retry:</strong> Retry on httpx.TimeoutException with
HttpRetryOptions (<a
href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>)
(<a
href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li>
<li>Streaming method doesn't handle multi-line SSE (<a
href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li>
<li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>.
(<a
href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Add instruction for custom endpoint (<a
href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li>
<li>Fix broken link for rate limits (<a
href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li>
<li>Regenerate docs for 1.73.1 (<a
href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li>
<li>Remove duplicate line in genai client docstring. (<a
href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li>
<li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a
href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li>
<li>Update doc string to replace <code>Vertex AI</code> with
<code>Gemini Enterprise Agent Platform</code>, update method error
message to replace <code>Vertex AI</code> with <code>Gemini Enterprise
Agent Platform (previously known as Vertex AI)</code>, update converter
error message to replace <code>Vertex AI</code> with <code>Gemini
Enterprise Agent Platform</code> (<a
href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li>
<li>Update Gemini Enterprise Agent Platform home page url (<a
href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li>
<li>Update README.md with correct Pydantic link (<a
href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li>
<li>Update README.md with correct Pydantic link (<a
href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md">google-genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a>
(2026-04-29)</h2>
<h3>Features</h3>
<ul>
<li>[Interactions] Add
FileCitation.{custom_metadata,media_id,page_number} (<a
href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li>
<li>Add <code>output_info</code> to <code>BatchJob</code> (<a
href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li>
<li>Add gemini-3.1-flash-tts-preview model to options (<a
href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li>
<li>Add ImageResizeMode for GenerateVideos (<a
href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li>
<li>Add new Gemini Deep Research agent models (<a
href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li>
<li>Add one_of support to JSONSchema for Agent Platform (<a
href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li>
<li>Add Vertex Dataset input and output options for batch jobs (<a
href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li>
<li><strong>interaction-api:</strong> Add grounding tool usage breakdown
to Interaction Usage. (<a
href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li>
<li>Introduce <code>enterprise</code> to Client constructor and
<code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a
href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li>
<li>Replace the more ambiguous rate field with sample_rate. (<a
href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Catch google-auth wrapped errors (<a
href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li>
<li>Removing Python 3.9 support due to EOL (<a
href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li>
<li><strong>retry:</strong> Retry on httpx.TimeoutException with
HttpRetryOptions (<a
href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>)
(<a
href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li>
<li>Streaming method doesn't handle multi-line SSE (<a
href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li>
<li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>.
(<a
href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Add instruction for custom endpoint (<a
href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li>
<li>Fix broken link for rate limits (<a
href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li>
<li>Regenerate docs for 1.73.1 (<a
href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li>
<li>Remove duplicate line in genai client docstring. (<a
href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li>
<li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a
href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li>
<li>Update doc string to replace <code>Vertex AI</code> with
<code>Gemini Enterprise Agent Platform</code>, update method error
message to replace <code>Vertex AI</code> with <code>Gemini Enterprise
Agent Platform (previously known as Vertex AI)</code>, update converter
error message to replace <code>Vertex AI</code> with <code>Gemini
Enterprise Agent Platform</code> (<a
href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li>
<li>Update Gemini Enterprise Agent Platform home page url (<a
href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li>
<li>Update README.md with correct Pydantic link (<a
href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li>
<li>Update README.md with correct Pydantic link (<a
href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/python-genai/compare/v1.73.0...v1.73.1">1.73.1</a>
(2026-04-14)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Refactor Webhook types in GenAI SDKs for easier useage (<a
href="https://github.com/googleapis/python-genai/commit/3f36ca11b30904c8f82dd3e7e3b59eff3bde6a3b">3f36ca1</a>)</li>
<li>Rename <code>webhooks.retrieve</code> to <code>webhooks.get</code>.
(<a
href="https://github.com/googleapis/python-genai/commit/649f4b06d7bd78a23dd77b06713c6ca5c65321f9">649f4b0</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update python docs for 1.73.0 (<a
href="https://github.com/googleapis/python-genai/commit/acd3767bff513524172ddd7726b147d01c245f1c">acd3767</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/python-genai/commit/860c041810c6b37638ea23370d39c80364b5c99a"><code>860c041</code></a>
chore(main): release 1.74.0 (<a
href="https://redirect.github.com/googleapis/python-genai/issues/2285">#2285</a>)</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/abcaa0d25da63a58c9ef96dac3b692c8396e5f42"><code>abcaa0d</code></a>
chore: Fix usage examples of LocalTokenizer.</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/b7e877129ee75e1fe824e2dc97e951a5ba5690cb"><code>b7e8771</code></a>
chore: Add page number</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/841301ee3901b34899a583939dfc28462d3db9d9"><code>841301e</code></a>
chore: Adjust Webhook update to better reflect modifiable fields</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94"><code>b24fb5a</code></a>
feat(interaction-api): Add grounding tool usage breakdown to Interaction
Usage.</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c"><code>b1c6026</code></a>
docs: Remove duplicate line in genai client docstring.</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e"><code>0598bab</code></a>
fix(retry): retry on httpx.TimeoutException with HttpRetryOptions (<a
href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>)</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247"><code>f8a2e7e</code></a>
fix: Streaming method doesn't handle multi-line SSE</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8"><code>8bc2b10</code></a>
fix: Removing Python 3.9 support due to EOL</li>
<li><a
href="https://github.com/googleapis/python-genai/commit/ab5e3283bed8a3c1502c9486f68848a1d5e821a0"><code>ab5e328</code></a>
chore: internal change</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/python-genai/compare/v1.51.0...v1.74.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 09:27:57 +00:00
dependabot[bot] 479f9443ee Python: Bump google-cloud-aiplatform from 1.114.0 to 1.133.0 in /python (#13577) 
Bumps
[google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform)
from 1.114.0 to 1.133.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/python-aiplatform/releases">google-cloud-aiplatform's
releases</a>.</em></p>
<blockquote>
<h2>v1.133.0</h2>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a>
(2026-01-08)</h2>
<h3>Features</h3>
<ul>
<li>Deprecate tuning public preview SDK in favor of tuning SDK (<a
href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li>
<li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing
either &quot;OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS&quot; or
&quot;OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE&quot; to the
<code>optimize_prompt</code> method (<a
href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li>
<li>GenAI SDK client(memory): Add enable_third_person_memories (<a
href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li>
<li>Support Developer Connect in AE (<a
href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add None check for agent_info in evals.py (<a
href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li>
<li>GenAI client(evals) - Fix TypeError in
_build_generate_content_config (<a
href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li>
<li>Make project_number to project_id mapping fail-open. (<a
href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li>
<li>Replace asyncio.run with create_task in ADK async thread mains. (<a
href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li>
<li>Replace asyncio.run with create_task in ADK async thread mains. (<a
href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li>
<li>Require uri or staging bucket configuration for saving model to
Vertex Experiment. (<a
href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li>
<li>Return embedding metadata if available (<a
href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li>
<li>Update <code>examples_dataframe</code> type to
<code>PandasDataFrame</code> in Prompt Optimizer. (<a
href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li>
</ul>
<h2>v1.132.0</h2>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a>
(2025-12-17)</h2>
<h3>Features</h3>
<ul>
<li>Add Lustre support to the Vertex Training Custom Job API (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>A comment for field <code>restart_job_on_worker_restart</code> in
message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is
changed (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
<li>A comment for field <code>timeout</code> in message
<code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
</ul>
<h2>v1.131.0</h2>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a>
(2025-12-16)</h2>
<h3>Features</h3>
<ul>
<li>Allow list of events to be passed to AdkApp.async_stream_query (<a
href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li>
<li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex
Gen AI Eval Service (<a
href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li>
<li>Updates the ADK template to direct structured JSON logs to standard
output. (<a
href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md">google-cloud-aiplatform's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a>
(2026-01-08)</h2>
<h3>Features</h3>
<ul>
<li>Deprecate tuning public preview SDK in favor of tuning SDK (<a
href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li>
<li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing
either &quot;OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS&quot; or
&quot;OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE&quot; to the
<code>optimize_prompt</code> method (<a
href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li>
<li>GenAI SDK client(memory): Add enable_third_person_memories (<a
href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li>
<li>Support Developer Connect in AE (<a
href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add None check for agent_info in evals.py (<a
href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li>
<li>GenAI client(evals) - Fix TypeError in
_build_generate_content_config (<a
href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li>
<li>Make project_number to project_id mapping fail-open. (<a
href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li>
<li>Replace asyncio.run with create_task in ADK async thread mains. (<a
href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li>
<li>Replace asyncio.run with create_task in ADK async thread mains. (<a
href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li>
<li>Require uri or staging bucket configuration for saving model to
Vertex Experiment. (<a
href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li>
<li>Return embedding metadata if available (<a
href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li>
<li>Update <code>examples_dataframe</code> type to
<code>PandasDataFrame</code> in Prompt Optimizer. (<a
href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a>
(2025-12-17)</h2>
<h3>Features</h3>
<ul>
<li>Add Lustre support to the Vertex Training Custom Job API (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
<li>Add Lustre support to the Vertex Training Custom Job API (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>A comment for field <code>restart_job_on_worker_restart</code> in
message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is
changed (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
<li>A comment for field <code>timeout</code> in message
<code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a
href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a>
(2025-12-16)</h2>
<h3>Features</h3>
<ul>
<li>Allow list of events to be passed to AdkApp.async_stream_query (<a
href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li>
<li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex
Gen AI Eval Service (<a
href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li>
<li>Updates the ADK template to direct structured JSON logs to standard
output. (<a
href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fix RagManagedVertexVectorSearch when using backend_config (<a
href="https://github.com/googleapis/python-aiplatform/commit/df0976ed3195dc8313f4728bc5ecb29dda55d467">df0976e</a>)</li>
<li>GenAI Client(evals) - patch for vulnerability in visualization (<a
href="https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480">8a00d43</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/78f2bdd08bae0696923e61ab73080b5846c67ae0"><code>78f2bdd</code></a>
chore(main): release 1.133.0 (<a
href="https://redirect.github.com/googleapis/python-aiplatform/issues/6211">#6211</a>)</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040"><code>c8c0f0f</code></a>
fix: Add None check for agent_info in evals.py</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/9952b970b73cfe38e68c48b3699ee4e1df0264df"><code>9952b97</code></a>
chore: rollback</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da"><code>83f4076</code></a>
fix: Replace asyncio.run with create_task in ADK async thread
mains.</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/937d5af6b9bdbbe3b50181745c99550f124ad8b4"><code>937d5af</code></a>
Copybara import of the project:</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/aaaf902be02747cd2281196aad6278df0fd11f7e"><code>aaaf902</code></a>
chore: bump google-auth lower bound to 2.47.0 in GenAI and Vertex
SDKs</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390"><code>8c876ef</code></a>
fix: Replace asyncio.run with create_task in ADK async thread
mains.</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0"><code>5448f06</code></a>
fix: Require uri or staging bucket configuration for saving model to
Vertex E...</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0"><code>65717fa</code></a>
feat: GenAI SDK client(memory): Add enable_third_person_memories</li>
<li><a
href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806"><code>be2eaaa</code></a>
fix: GenAI client(evals) - Fix TypeError in
_build_generate_content_config</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/python-aiplatform/compare/v1.114.0...v1.133.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google-cloud-aiplatform&package-manager=uv&previous-version=1.114.0&new-version=1.133.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/semantic-kernel/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 08:58:38 +00:00
dependabot[bot] ff3a1c6c6e Python: Update boto3 requirement from <1.41.0,>=1.36.4 to >=1.36.4,<1.43.0 in /python (#13867) 
Updates the requirements on [boto3](https://github.com/boto/boto3) to
permit the latest version.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/boto/boto3/commit/54a9dc1891d5e38110e5f77fc45fbc7e2e112bfe"><code>54a9dc1</code></a>
Merge branch 'release-1.42.89'</li>
<li><a
href="https://github.com/boto/boto3/commit/730d84cd5a2396ff9bfe8b59b7ee7339aa6bd8c5"><code>730d84c</code></a>
Bumping version to 1.42.89</li>
<li><a
href="https://github.com/boto/boto3/commit/6b657684e661904d387c867ccd8aea796f7092ff"><code>6b65768</code></a>
Add changelog entries from botocore</li>
<li><a
href="https://github.com/boto/boto3/commit/f92a06cca537b03c6cbc71b2ab004674298053dd"><code>f92a06c</code></a>
Merge branch 'release-1.42.88'</li>
<li><a
href="https://github.com/boto/boto3/commit/5da0f6a8b8ed0117747b2f8a4f2ffa2a8e3a5eb6"><code>5da0f6a</code></a>
Merge branch 'release-1.42.88' into develop</li>
<li><a
href="https://github.com/boto/boto3/commit/9bdec29dd7a50a0412772bae77580bb3be674295"><code>9bdec29</code></a>
Bumping version to 1.42.88</li>
<li><a
href="https://github.com/boto/boto3/commit/d880788fea57399dd5e9e2be08691a2b9ec26502"><code>d880788</code></a>
Add changelog entries from botocore</li>
<li><a
href="https://github.com/boto/boto3/commit/39a412231d29b10761a1812efbbf00aa8d17d6a6"><code>39a4122</code></a>
chore: add additional text to CONTRIBUTING.rst (<a
href="https://redirect.github.com/boto/boto3/issues/4749">#4749</a>)</li>
<li><a
href="https://github.com/boto/boto3/commit/8d65320e4df23b56f3dc5b09ad75d95bcc85382b"><code>8d65320</code></a>
Merge branch 'release-1.42.87'</li>
<li><a
href="https://github.com/boto/boto3/commit/fdcbb88dfbc65c8ef6fd3557f7d37c73ec6a09a2"><code>fdcbb88</code></a>
Merge branch 'release-1.42.87' into develop</li>
<li>Additional commits viewable in <a
href="https://github.com/boto/boto3/compare/1.36.4...1.42.89">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 08:58:05 +00:00
dependabot[bot] 293ec8f850 Python: Bump python-multipart from 0.0.22 to 0.0.26 in /python (#13878) 
Bumps [python-multipart](https://github.com/Kludex/python-multipart)
from 0.0.22 to 0.0.26.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/releases">python-multipart's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.0.26</h2>
<h2>What's Changed</h2>
<ul>
<li>Skip preamble before first multipart boundary by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/262">Kludex/python-multipart#262</a></li>
<li>Silently discard epilogue data after the closing boundary by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/259">Kludex/python-multipart#259</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26">https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26</a></p>
<h2>Version 0.0.25</h2>
<h2>What's Changed</h2>
<ul>
<li>Apply Apache-2.0 properly by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/247">Kludex/python-multipart#247</a></li>
<li>Handle multipart headers case-insensitively by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/252">Kludex/python-multipart#252</a></li>
<li>Emit <code>field_end</code> for trailing bare field names on
finalize by <a
href="https://github.com/bysiber"><code>@​bysiber</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/230">Kludex/python-multipart#230</a></li>
<li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config
by <a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/254">Kludex/python-multipart#254</a></li>
<li>Remove custom FormParser classes by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/257">Kludex/python-multipart#257</a></li>
<li>Handle CTE values case-insensitively by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/258">Kludex/python-multipart#258</a></li>
<li>Add MIME content type info to File by <a
href="https://github.com/jhnstrk"><code>@​jhnstrk</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/143">Kludex/python-multipart#143</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25">https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25</a></p>
<h2>Version 0.0.24</h2>
<h2>What's Changed</h2>
<ul>
<li>Validate <code>chunk_size</code> in <code>parse_form()</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/244">Kludex/python-multipart#244</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24">https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24</a></p>
<h2>Version 0.0.23</h2>
<h2>What's Changed</h2>
<ul>
<li>Remove unused <code>trust_x_headers</code> parameter and
<code>X-File-Name</code> fallback by <a
href="https://github.com/jhnstrk"><code>@​jhnstrk</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/196">Kludex/python-multipart#196</a></li>
<li>Return processed length from
<code>QuerystringParser._internal_write</code> by <a
href="https://github.com/bysiber"><code>@​bysiber</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li>
<li>Cleanup metadata dunders from <code>__init__.py</code> by <a
href="https://github.com/Chesars"><code>@​Chesars</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Chesars"><code>@​Chesars</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li>
<li><a href="https://github.com/bysiber"><code>@​bysiber</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23">https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md">python-multipart's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.26 (2026-04-10)</h2>
<ul>
<li>Skip preamble before the first multipart boundary more efficiently
<a
href="https://redirect.github.com/Kludex/python-multipart/pull/262">#262</a>.</li>
<li>Silently discard epilogue data after the closing multipart boundary
<a
href="https://redirect.github.com/Kludex/python-multipart/pull/259">#259</a>.</li>
</ul>
<h2>0.0.25 (2026-04-10)</h2>
<ul>
<li>Add MIME content type info to <code>File</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/143">#143</a>.</li>
<li>Handle CTE values case-insensitively <a
href="https://redirect.github.com/Kludex/python-multipart/pull/258">#258</a>.</li>
<li>Remove custom <code>FormParser</code> classes <a
href="https://redirect.github.com/Kludex/python-multipart/pull/257">#257</a>.</li>
<li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config
<a
href="https://redirect.github.com/Kludex/python-multipart/pull/254">#254</a>.</li>
<li>Emit <code>field_end</code> for trailing bare field names on
finalize <a
href="https://redirect.github.com/Kludex/python-multipart/pull/230">#230</a>.</li>
<li>Handle multipart headers case-insensitively <a
href="https://redirect.github.com/Kludex/python-multipart/pull/252">#252</a>.</li>
<li>Apply Apache-2.0 properly <a
href="https://redirect.github.com/Kludex/python-multipart/pull/247">#247</a>.</li>
</ul>
<h2>0.0.24 (2026-04-05)</h2>
<ul>
<li>Validate <code>chunk_size</code> in <code>parse_form()</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/244">#244</a>.</li>
</ul>
<h2>0.0.23 (2026-04-05)</h2>
<ul>
<li>Remove unused <code>trust_x_headers</code> parameter and
<code>X-File-Name</code> fallback <a
href="https://redirect.github.com/Kludex/python-multipart/pull/196">#196</a>.</li>
<li>Return processed length from
<code>QuerystringParser._internal_write</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/229">#229</a>.</li>
<li>Cleanup metadata dunders from <code>__init__.py</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/227">#227</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/python-multipart/commit/28f47859b4a40c2e11e02dc514b2e9743ceedd2e"><code>28f4785</code></a>
Version 0.0.26 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/263">#263</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/d4452a78bbde94995dd3c0d1b4aff3610a5c472f"><code>d4452a7</code></a>
Silently discard epilogue data after the closing boundary (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/259">#259</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37"><code>6a7b76d</code></a>
Skip preamble before first multipart boundary (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/262">#262</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/4addb60350fc843f77a1502f14247db91930b3bf"><code>4addb60</code></a>
Version 0.0.25 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/261">#261</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/d3a4698e0dc16cbd85f98076b2ebf9b696cd3604"><code>d3a4698</code></a>
Add MIME content type info to File (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/143">#143</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/9a1ecbd074801fcd3911266f3f4442181d10ab92"><code>9a1ecbd</code></a>
Handle CTE values case-insensitively (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/258">#258</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/ef2a0b94f95676ea6a7b77d2252b09f5797cb8ed"><code>ef2a0b9</code></a>
Remove custom FormParser classes (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/257">#257</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/3a757d7cf209e654eb17cf7b7af868eed469f680"><code>3a757d7</code></a>
Ignore local Claude state (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/255">#255</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/55e739617db7c40e2cd04c5ad8c7acf2ed0a1d19"><code>55e7396</code></a>
fuzz: Add cifuzz (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/186">#186</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/d6d1d111e7de9ce3d3f8623fe5f5e4201c0a5fd1"><code>d6d1d11</code></a>
Bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/249">#249</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.26">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-multipart&package-manager=uv&previous-version=0.0.22&new-version=0.0.26)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/semantic-kernel/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 08:57:59 +00:00
dependabot[bot] 4fb5abcc66 Python: Bump nbconvert from 7.17.0 to 7.17.1 in /python (#13906) 
Bumps [nbconvert](https://github.com/jupyter/nbconvert) from 7.17.0 to
7.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/releases">nbconvert's
releases</a>.</em></p>
<blockquote>
<h2>v7.17.1</h2>
<h2>7.17.1</h2>
<p>This is a security release, fixing two CVEs:</p>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li>
<li><a
href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li>
</ul>
<p>(full advisories will be published seven days after release, on
2026-04-14).</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full
Changelog</a>)</p>
<h3>Enhancements made</h3>
<ul>
<li>Allow configureable WebPDF JavaScript processing timeout <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a>
(<a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>, <a
href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li>
</ul>
<h3>Bugs fixed</h3>
<ul>
<li>Fix <code>PermissionError</code> when checking template paths on
shared filesystems <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a>
(<a href="https://github.com/ctcjab"><code>@​ctcjab</code></a>, <a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Tweak webpdf template logic to fix duplicate extension problem <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a>
(<a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>, <a
href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li>
</ul>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>specify python version for pre <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a>
(<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&amp;to=2026-04-08&amp;type=c">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/akhmerov"><code>@​akhmerov</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/Carreau"><code>@​Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/ctcjab"><code>@​ctcjab</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a
href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/Ken-B"><code>@​Ken-B</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/krassowski"><code>@​krassowski</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/mgeier"><code>@​mgeier</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/minrk"><code>@​minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/mpacer"><code>@​mpacer</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/MSeal"><code>@​MSeal</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a
href="https://github.com/SylvainCorlay"><code>@​SylvainCorlay</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/takluyver"><code>@​takluyver</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md">nbconvert's
changelog</a>.</em></p>
<blockquote>
<h2>7.17.1</h2>
<p>This is a security release, fixing two CVEs:</p>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li>
<li><a
href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li>
</ul>
<p>(full advisories will be published seven days after release, on
2026-04-14).</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full
Changelog</a>)</p>
<h3>Enhancements made</h3>
<ul>
<li>Allow configureable WebPDF JavaScript processing timeout <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a>
(<a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>, <a
href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li>
</ul>
<h3>Bugs fixed</h3>
<ul>
<li>Fix <code>PermissionError</code> when checking template paths on
shared filesystems <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a>
(<a href="https://github.com/ctcjab"><code>@​ctcjab</code></a>, <a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Tweak webpdf template logic to fix duplicate extension problem <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a>
(<a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>, <a
href="https://github.com/Carreau"><code>@​Carreau</code></a>)</li>
</ul>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>specify python version for pre <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a>
(<a href="https://github.com/minrk"><code>@​minrk</code></a>, <a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&amp;to=2026-04-08&amp;type=c">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/akhmerov"><code>@​akhmerov</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/bollwyvl"><code>@​bollwyvl</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/Carreau"><code>@​Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/ctcjab"><code>@​ctcjab</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a
href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/Ken-B"><code>@​Ken-B</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/krassowski"><code>@​krassowski</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/mgeier"><code>@​mgeier</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/minrk"><code>@​minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/mpacer"><code>@​mpacer</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/MSeal"><code>@​MSeal</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a
href="https://github.com/SylvainCorlay"><code>@​SylvainCorlay</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/takluyver"><code>@​takluyver</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)
| <a href="https://github.com/timkpaine"><code>@​timkpaine</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&amp;type=Issues">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/commit/78ed30837a607deab7cf0a12dca072bf3f63417a"><code>78ed308</code></a>
Publish 7.17.1</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/f090a64606fde4c7f87cbf478f51b4aa46a425ec"><code>f090a64</code></a>
ruff format</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3"><code>b3b6ec0</code></a>
chore: update pre-commit hooks (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2277">#2277</a>)</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/be4841f7da51c499b1937e41e6e71926dbe0daa3"><code>be4841f</code></a>
ignore silly security lint in tests</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/26d57b295870f5572d9bd0535acee4a120339c10"><code>26d57b2</code></a>
fix type annotation on Lexer</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/0e6b8ccabf2aca6c18fac8c574f22b7155f441fb"><code>0e6b8cc</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/ba5e5cdd737704388251fa55fa9e58f5752fa39d"><code>ba5e5cd</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/1db0c88d865146ce02b6405a8d96753d3d0cd0c2"><code>1db0c88</code></a>
Specify python version for pre (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2276">#2276</a>)</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/7473fc3037a6317bff54380e3a7162d73bf089b3"><code>7473fc3</code></a>
chore: update pre-commit hooks (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2242">#2242</a>)</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/4322f7f290694929f414cefadc942111afad3762"><code>4322f7f</code></a>
Bump the actions group across 1 directory with 2 updates (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2273">#2273</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jupyter/nbconvert/compare/v7.17.0...v7.17.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nbconvert&package-manager=uv&previous-version=7.17.0&new-version=7.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/semantic-kernel/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 08:18:31 +00:00
dependabot[bot]copilot-swe-agent[bot]moonbox3
 		5dad51381a Python: Bump onnxruntime from 1.22.1 to 1.24.3 in /python (#13868) 
Bumps [onnxruntime](https://github.com/microsoft/onnxruntime) from
1.22.1 to 1.24.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/onnxruntime/releases">onnxruntime's
releases</a>.</em></p>
<blockquote>
<h2>ONNX Runtime v1.24.3</h2>
<p>This is a patch release for ONNX Runtime 1.24, containing bug fixes,
security improvements, performance enhancements, and execution provider
updates.</p>
<h2>Security Fixes</h2>
<ul>
<li><strong>Core</strong>: Fixed GatherCopyData integer truncation
leading to heap out-of-bounds read/write. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27444">#27444</a>)</li>
<li><strong>Core</strong>: Fixed RoiAlign heap out-of-bounds read via
unchecked batch_indices. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27543">#27543</a>)</li>
<li><strong>Core</strong>: Prevent heap OOB from maliciously crafted
Lora Adapters. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27518">#27518</a>)</li>
<li><strong>Core</strong>: Fixed out-of-bounds access for Resize
operation. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27419">#27419</a>)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><strong>Core</strong>: Fixed GatherND division by zero when batch
dimensions mismatch. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27090">#27090</a>)</li>
<li><strong>Core</strong>: Fixed validation for external data paths for
models loaded from bytes. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27430">#27430</a>)</li>
<li><strong>Core</strong>: Fixed SkipLayerNorm fusion incorrectly
applied when gamma/beta are not 1D. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27459">#27459</a>)</li>
<li><strong>Core</strong>: Fixed double-free in TRT EP custom op domain
Release functions. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27471">#27471</a>)</li>
<li><strong>Core</strong>: Fixed QMoE CPU Operator. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27360">#27360</a>)</li>
<li><strong>Core</strong>: Fixed MatmulNBits prepacking scales. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27412">#27412</a>)</li>
<li><strong>Python</strong>: Fixed refcount bug in map input conversion
that caused shutdown segfault. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27413">#27413</a>)</li>
<li><strong>NuGet</strong>: Fixed DllImportResolver. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27397">#27397</a>)</li>
<li><strong>NuGet</strong>: Added
<code>OrtEnv.DisableDllImportResolver</code> to prevent fatal error on
resolver conflict. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27535">#27535</a>)</li>
</ul>
<h2>Performance Improvements</h2>
<ul>
<li><strong>Core</strong>: QMoE CPU performance update (up to 4x on
4-bit). (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27364">#27364</a>)</li>
<li><strong>Core</strong>: Fixed O(n²) model load time for TreeEnsemble
with categorical feature chains. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27391">#27391</a>)</li>
</ul>
<h2>Execution Provider Updates</h2>
<ul>
<li><strong>NvTensorRtRtx EP</strong>:
<ul>
<li>Avoid repetitive creation of fp4/fp8 native-custom-op domains. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27192">#27192</a>)</li>
<li>Added missing override specifiers to suppress warnings. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27288">#27288</a>)</li>
<li>DQ→MatMulNBits fusion transformer. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27466">#27466</a>)</li>
</ul>
</li>
<li><strong>WebGPU</strong>:
<ul>
<li>Used embedded WASM module in Blob URL workers when
<code>wasmBinary</code> is provided. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27318">#27318</a>)</li>
<li>Fixed usage of <code>wasmBinary</code> together with a blob URL for
<code>.mjs</code>. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27411">#27411</a>)</li>
<li>Removed the unhelpful &quot;Unknown CPU vendor&quot; warning. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27399">#27399</a>)</li>
<li>Allows new memory info name for WebGPU. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27475">#27475</a>)</li>
</ul>
</li>
<li><strong>MLAS</strong>:
<ul>
<li>Added DynamicQGemm function pointers and ukernel interface. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27403">#27403</a>)</li>
<li>Fixed error where bytes is not assigned for dynamic qgemm pack b
size. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27421">#27421</a>)</li>
</ul>
</li>
<li><strong>VitisAI EP</strong>: Removed
<code>s_kernel_registry_vitisaiep.reset()</code> in
<code>deinitialize_vitisai_ep()</code>. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27295">#27295</a>)</li>
<li><strong>Plugin EPs</strong>: Added &quot;library_path&quot; metadata
entry to <code>OrtEpDevice</code> instances for plugin and provider
bridge EPs. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27522">#27522</a>)</li>
</ul>
<h2>Build and Infrastructure</h2>
<ul>
<li><strong>Pipelines</strong>:
<ul>
<li>Build Windows ARM64X binaries as part of packaging pipeline. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27316">#27316</a>)</li>
<li>Moved JAR testing pipelines to canonical pipeline template. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27480">#27480</a>)</li>
</ul>
</li>
<li><strong>Python</strong>: Enabled Python 3.14 CI and upgraded
dependencies. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27401">#27401</a>)</li>
<li><strong>Build</strong>: Suppressed spurious Array Out of Bounds
warnings produced by GCC 14.2 compiler on Linux builds. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27454">#27454</a>)</li>
<li><strong>Build</strong>: Fixed <code>-Warray-bounds</code> build
error in MLAS on clang 17+. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27499">#27499</a>)</li>
<li><strong>Telemetry</strong>: Added/Updated telemetry events. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27356">#27356</a>)</li>
<li><strong>Config</strong>: Increased <code>kMaxValueLength</code> to
8192. (<a
href="https://redirect.github.com/microsoft/onnxruntime/pull/27521">#27521</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/3a728b75062256951b6e19ce718907cf1a1d4cf0"><code>3a728b7</code></a>
ORT 1.24.3 release cherry pick round 4 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27558">#27558</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/dd6a8546ab88c47db73f139854eb25130ef27c9e"><code>dd6a854</code></a>
ORT 1.24.3 release cherry pick round 3 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27501">#27501</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/15c006bd76d7af722fd71921611583d8834e9338"><code>15c006b</code></a>
ORT 1.24.3 release cherry pick round 2 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27492">#27492</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/ee26608ab699fd98c71df4ddff58720fe7ec54db"><code>ee26608</code></a>
ORT 1.24.3 release cherry pick round 1 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27476">#27476</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/058787ceead760166e3c50a0a4cba8a833a6f53f"><code>058787c</code></a>
ORT 1.24.2 Release cherry pick round 4 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27388">#27388</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/6fc7ee38cdc5755a7e4ab6cdc26c5f73a2d94dd7"><code>6fc7ee3</code></a>
ORT 1.24.2 release cherry pick round 3 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27378">#27378</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/98711820882dc178e995ec24f4587350dbf16360"><code>9871182</code></a>
ORT 1.24.2 release cherry-pick round 2 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27343">#27343</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/f34d11d3e99abb3b1c2236f33e0e1aa30160b922"><code>f34d11d</code></a>
ORT 1.24.2 release cherry pick round 1 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27330">#27330</a>)</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/8ba51c754c3c853e420a38051f76c5d97e78ff89"><code>8ba51c7</code></a>
update version to 1.24.2</li>
<li><a
href="https://github.com/microsoft/onnxruntime/commit/470ae16099a74fe05e31f2530489332c0525edb5"><code>470ae16</code></a>
Patch pools to use older agent version on ARM64 (<a
href="https://redirect.github.com/microsoft/onnxruntime/issues/27232">#27232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/microsoft/onnxruntime/compare/v1.22.1...v1.24.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=onnxruntime&package-manager=pip&previous-version=1.22.1&new-version=1.24.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: moonbox3 <[email protected]>
 2026-04-30 08:18:23 +00:00
dependabot[bot] 790add7a33 Python: Bump authlib from 1.6.9 to 1.6.11 in /python (#13880) 
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.9 to
1.6.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/authlib/authlib/releases">authlib's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.11</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11">https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11</a></p>
<ul>
<li>Fix CSRF issue with starlette client</li>
</ul>
<h2>v1.6.10</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10">https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10</a></p>
<ul>
<li>Fix redirecting to unvalidated <code>redirect_uri</code> on
<code>UnsupportedResponseTypeError</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst">authlib's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.6.11</h2>
<p><strong>Released on Apr 16, 2026</strong></p>
<ul>
<li>Fix CSRF vulnerability in the Starlette OAuth client when a
<code>cache</code> is
configured.</li>
</ul>
<h2>Version 1.6.10</h2>
<p><strong>Released on Apr 13, 2026</strong></p>
<ul>
<li>Fix redirecting to unvalidated <code>redirect_uri</code> on
<code>UnsupportedResponseTypeError</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525"><code>0dc0e5b</code></a>
chore: bump to 1.6.11</li>
<li><a
href="https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5"><code>aa7b8e4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788"><code>401a770</code></a>
fix: CSRF issue with starlette client</li>
<li><a
href="https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab"><code>ef09aeb</code></a>
chore: release 1.6.10</li>
<li><a
href="https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096"><code>3be0846</code></a>
fix: redirecting to unvalidated redirect_uri on
UnsupportedResponseTypeError</li>
<li>See full diff in <a
href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=authlib&package-manager=uv&previous-version=1.6.9&new-version=1.6.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/semantic-kernel/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-30 08:16:18 +00:00
Evan Mattson ea9981ffaf Python: Docs: Add Microsoft Agent Framework successor callout to READMEs (#13932) 
## Motivation and Context

Now that **Microsoft Agent Framework (MAF)** is the successor SDK to
Semantic Kernel, the top-level and per-language READMEs should direct
community members — especially newcomers landing here from search,
GitHub, PyPI, or NuGet — to MAF for new work, and clearly state SK's
ongoing maintenance posture.

## Description

Adds a prominent GitHub `> [!IMPORTANT]` callout, placed directly under
the existing title/badges block, to:

- `README.md` (top-level)
- `python/README.md`
- `dotnet/README.md`

Each callout:

- Names MAF as Semantic Kernel's successor SDK and links to
https://github.com/microsoft/agent-framework.
- Describes MAF as "an open, multi-language framework for building
production-grade AI agents and multi-agent workflows in .NET and
Python".
- Asks readers to use MAF for the latest abstractions to build agents,
workflows, and multi-agent orchestrations.
- States that Semantic Kernel will continue to receive minimal security
and bug fixes only.

No other README content is modified; SK identity, badges, install steps,
and quickstart samples are preserved.

## Contribution Checklist

- [x] The code builds clean without any errors or warnings — docs-only
change.
- [x] I didn't break anyone — additive callout only.
- [x] All relevant CONTRIBUTING.md sections were followed.
 2026-04-30 15:18:01 +09:00
westey 27971e118b .Net: Sk release version 2026 04 27 (#13929) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
dotnet-1.75.0 		2026-04-29 11:14:15 +00:00
westey c8e3cd0d74 .Net: Upgrade dependencies (#13927) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-04-28 15:38:22 +00:00
Evan Mattson 9c62d9d19a Python: Bump package version to 1.41.3 for a release (#13926) 
### Motivation and Context

Bump package version to 1.41.3 for a release

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Bump package version to 1.41.3 for a release

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
python-1.41.3 		2026-04-28 12:18:17 +09:00
SergeyMenshykhandCopilot 95b1bf85d8 .Net: Harden AllowedBaseUrls validation in RestApiOperationRunner (#13910) 
### Motivation and Context

Improved the URL validation logic in
`RestApiOperationRunner.ValidateUrl()` to ensure stricter matching when
checking request URLs against configured `AllowedBaseUrls`. The previous
implementation could match unintended URLs in certain edge cases
involving path-prefixed base URLs.

### Description

Strengthened the base URL comparison to enforce proper path-boundary
matching, preventing URLs outside the intended allowed scope from
passing validation.

### Changes

- **`RestApiOperationRunner.cs`**: Tightened the base URL matching logic
in `ValidateUrl` to enforce path-boundary alignment.
- **`RestApiOperationRunnerTests.cs`**: Added two new tests to verify
the stricter validation behavior and confirm legitimate sub-paths remain
allowed.

### Risk

Low — the fix tightens existing validation without changing the public
API surface. All URL validation tests pass.

Co-authored-by: Copilot <[email protected]>
 2026-04-23 08:20:41 +00:00
Evan Mattson 79ef93b9cf Python: Extend InMemoryCollection filter attribute blocklist (#13897) 
## Summary
- Minor defense-in-depth hardening for `InMemoryCollection` filter
parsing.
- Extends the internal dunder attribute blocklist and adds a regression
test covering the blocked set.

## Test plan
- [x] `uv run pytest tests/unit/connectors/memory/test_in_memory.py`
 2026-04-22 23:42:01 +00:00
westey 57d9adce81 Python: Add field and table name escaping for python SqlServer connector (#13893) 
### Motivation and Context

### Description

- Add field and table name escaping for python SqlServer connector

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-04-22 21:20:10 +00:00
westey 84ab8221c7 .Net: Validate step types (#13901) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-04-21 14:59:00 +00:00
westey ba37e8e49b .Net: Add backslash escaping to redis text search values (#13902) 
### Motivation and Context

### Description

- Add backslash escaping to redis text search values

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-04-21 14:17:31 +00:00
Shay RojanskyandCopilot bf1b19c84c .Net: Fix single-quote escaping in OBJECT_ID and dynamic SQL string literals (#13900) 
In the SQL Server MEVD provider, table/schema/column names embedded
inside SQL string literals (`N'...'`) were not escaping single quotes.
This could produce broken SQL when names contain single quotes.

For example, a table named `it's` would generate:
```sql
IF OBJECT_ID(N'[dbo].[it's]', N'U') IS NULL
```
which is invalid SQL. The fix produces:
```sql
IF OBJECT_ID(N'[dbo].[it''s]', N'U') IS NULL
```

### Changes

Added `AppendTableNameInsideLiteral` and `AppendIdentifierInsideLiteral`
helper methods that escape single quotes by doubling them, and updated
the 5 call sites where identifiers appear inside string literals:

- `OBJECT_ID` in `CreateTable` (ifNotExists check)
- `OBJECT_ID` in full-text index PK lookup
- Dynamic SQL table name, column names, and catalog name for full-text
indexes

### Tests

Added unit tests for `AppendTableNameInsideLiteral`,
`AppendIdentifierInsideLiteral`, and a
`CreateTable_WithSingleQuoteInName` integration test. All 283 tests pass
(unit + conformance).

Co-authored-by: Copilot <[email protected]>
 2026-04-21 12:28:39 +00:00
Shay Rojansky 1b2f318a61 .Net: Remove MEVD components from SK-release.slnf (#13892) 
With the ongoing move of MEVD components out of the SK repo, this
disables publishing them.
 2026-04-20 11:59:42 +00:00
Shay RojanskyandCopilot 7e216a0f5c .Net: Update SQL Server vector search to latest VECTOR_SEARCH() syntax (#13863) 
Updates the SQL Server vector store connector to support the latest
Azure SQL VECTOR_SEARCH() features, matching what was done in EF Core
(dotnet/efcore#38075).

## Changes

### VECTOR_SEARCH syntax update
- Replace deprecated `TOP_N` parameter with `SELECT TOP(N) WITH
APPROXIMATE`
- Enable iterative WHERE predicates are now applied during the vector
search process, not after retrievalfiltering
- Support `skip` via subquery wrapping (`TOP` and `OFFSET/FETCH` cannot
coexist in the same SELECT)

### Hybrid search
- Same VECTOR_SEARCH syntax changes in the semantic search CTE
- Filter support added in the vector search CTE (iterative filtering)

### Azure SQL runtime detection
- DiskAnn vector indexes and VECTOR_SEARCH require Azure SQL Database or
SQL database in Microsoft Fabric
- Added runtime check via `SERVERPROPERTY('EngineEdition')` at table
creation and query time
- Throws informative `NotSupportedException` when used against on-prem
SQL Server
- Result is cached per collection instance

### Test infrastructure
- Deleted `SqlServerDiskAnnVectorSearchTests.cs` (read-only table
workaround no longer tables with latest vector indexes now support full
DML)needed
- Created `SqlServerConnectionStringRequiredAttribute` to gate DiskAnn
tests on Azure SQL connection string availability
- Rewrote DiskAnn conformance test to handle 100-row minimum requirement
for vector index creation
- Updated all command builder unit tests for new SQL syntax

### Kept
- `PREVIEW_FEATURES` command in `CreateTable` (needed for future on-prem
SQL Server support)

---------

Co-authored-by: Copilot <[email protected]>
 2026-04-16 07:15:46 +00:00
Evan Mattson 20c91a38d1 Python: bump py version to 1.41.2 for a release (#13850) 
### Motivation and Context

bump py version to 1.41.2 for a release

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

bump py version to 1.41.2 for a release

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
python-1.41.2 		2026-04-08 14:57:36 +09:00