- Update VersionPrefix from 1.76.0 to 1.77.0
- Update PackageValidationBaselineVersion from 1.75.0 to 1.76.0
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Strengthen the OpenAPI plugin's server URL handling by making validation
active by default.
### Description
- Introduce `ServerUrlValidator` with host classification and DNS
resolution
- Make `RestApiOperationServerUrlValidationOptions` enforce validation
by default instead of opt-in
- Add `AllowPrivateNetworkAccess` opt-out for scenarios that require it
- Remove experimental `AllowedSchemes` property (SKEXP0040)
- Update `RestApiOperationRunner` to apply validation unconditionally
- Add unit tests
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The code follows the [.NET coding
conventions](https://learn.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
- [x] All unit tests pass
- [x] New unit tests added
---------
Co-authored-by: Copilot <[email protected]>
## Summary
Fixes a moderate-severity transitive vulnerability flagged by `dotnet
list package --vulnerable --include-transitive` across 10 projects in
the solution.
| Package | Current (resolved) | Pinned | Severity | Advisory |
|---|---|---|---|---|
| SharpCompress | 0.30.1 | 0.48.0 | Moderate |
[GHSA-6c8g-7p36-r338](https://github.com/advisories/GHSA-6c8g-7p36-r338)
|
## Why a transitive pin
`SharpCompress` is pulled in transitively via `MongoDB.Driver 3.5.2`:
`MongoDB.Driver (v3.5.2) -> SharpCompress (v0.30.1)`
The latest `MongoDB.Driver` (3.8.0) still declares `SharpCompress (>=
0.30.1)` as a floor, so a minor bump of `MongoDB.Driver` does not lift
the resolved `SharpCompress` version. There is no transitive update path
through the direct dependency.
The advisory's vulnerable range is `<= 0.47.4`, so `0.48.0` is the
smallest non-vulnerable release. `1.0.0` was rejected as it is a
major-version jump.
## Changes
This mirrors the existing `Snappier` vulnerability pin pattern already
in the repo (same file locations, same comment style):
1. `dotnet/Directory.Packages.props` -- add `PackageVersion` for
`SharpCompress 0.48.0` next to the `MongoDB.Driver` / `Snappier` entries
with a vulnerability comment.
2. `dotnet/src/VectorData/MongoDB/MongoDB.csproj` -- add direct
`PackageReference Include="SharpCompress"` to override the transitive
resolution.
3. `dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj` -- same.
The pin in the two `Connectors.*` source projects propagates the
override to all downstream consumers (samples, integration tests,
conformance tests, unit tests).
## Verification
| Check | Scope | Result |
|---|---|---|
| `dotnet list SK-dotnet.slnx package --vulnerable --include-transitive`
| Full solution (155 projects) | All clean (was 10 projects flagging) |
| `dotnet build --warnaserror` | `MongoDB.csproj` | Pass |
| `dotnet build --warnaserror` | `CosmosMongoDB.csproj` | Pass |
| `dotnet format --verify-no-changes` (CI-parity Docker
`mcr.microsoft.com/dotnet/sdk:10.0`) | Both csproj | Pass (Formatted 0
of N files) |
| `dotnet test` | `MongoDB.UnitTests` | 37/37 passed |
| `dotnet test` | `CosmosMongoDB.UnitTests` | 28/28 passed |
Conformance test projects skipped (require live emulators, pre-existing
env-dependent suites, not impacted by a transitive pin).
### Motivation and Context
Bump SK .NET version for the next release.
### Description
- VersionPrefix: 1.75.0 1.76.0
- PackageValidationBaselineVersion: 1.74.0 1.75.0
Co-authored-by: Copilot <[email protected]>
Strengthen input validation for server variable substitution and path
parameter handling in RestApiOperation.
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Fixes#13430
Currently, when a Semantic Kernel function returns `ImageContent`, it
gets serialized to JSON - losing the binary image data and preventing
multimodal-capable models from processing the image.
This PR enables `ImageContent` preservation in tool/function results,
allowing connectors with multimodal capabilities (Gemini 3+, Anthropic)
to pass images natively to the model. This is essential for agentic
workflows where tools generate or process images that the model needs to
analyze.
### Description
#### FunctionCallsProcessor (shared infrastructure)
- Changed `ProcessFunctionResult()` return type from `string` to
`object`
- Added early return for `ImageContent` to preserve it for
multimodal-capable connectors
- Added `ImageContentNotSupportedErrorMessage` constant for consistent
error messaging
#### Google Gemini Connector (native support)
- Extended `FunctionResponsePart` with `Parts` property for nested
multimodal content
- Added `FunctionResponsePartContent` class with `InlineData` support
- Implemented `CreateImageFunctionResponsePart()` to convert
`ImageContent` to Gemini's native `inlineData` format
#### OpenAI Connector (error handling)
- Added `ImageContent` check with clear error message (API does not
support images in tool results)
#### OpenAI Agents (error handling)
- Added `GetFunctionResultAsString()` helper with `ImageContent` error
handling
#### Amazon Bedrock Agents (error handling)
- Added `GetFunctionResultAsString()` helper with `ImageContent` error
handling
#### New Unit Tests
| Test | File |
|------|------|
| `ItShouldPreserveImageContentWithoutSerialization` |
`FunctionCallsProcessorTests.cs` |
| `FromChatHistoryImageContentInToolResultCreatesInlineDataPart` |
`GeminiRequestTests.cs` |
|
`FromChatHistoryImageContentWithoutDataThrowsInvalidOperationException`
| `GeminiRequestTests.cs` |
|
`FromChatHistoryImageContentWithoutMimeTypeThrowsInvalidOperationException`
| `GeminiRequestTests.cs` |
|
`VerifyAssistantMessageAdapterGetMessageWithImageContentInFunctionResult`
| `AssistantMessageFactoryTests.cs` |
#### Notes
- **No breaking changes**: All changes are to internal APIs. The public
`FunctionResultContent.Result` property is already `object?`.
- **Gemini version detection**: The connector does not check the model
version. If an older Gemini model does not support
`functionResponse.parts`, the API will return an appropriate error.
- **URI-based ImageContent**: Only `ImageContent` with binary data is
supported. URI-based `ImageContent` will throw
`InvalidOperationException`.
- **MistralAI**: Out of scope - has its own `ProcessFunctionResult`
implementation.
- **Related**: Prepares infrastructure for PR #13419 (Anthropic
Connector multimodal support)
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
[sk-pr-MultimodalToolResults.md](https://github.com/user-attachments/files/24299998/sk-pr-MultimodalToolResults.md)
---------
Co-authored-by: Roger Barreto <[email protected]>
## Description
Add developer-controlled address configuration and validation for the
gRPC plugin.
### Motivation and Context
The gRPC plugin now supports `GrpcFunctionExecutionParameters` for
configuring address handling, including an optional address override,
allowed base addresses, and scheme restrictions.
### Changes
- Introduced `GrpcFunctionExecutionParameters` class for
developer-controlled gRPC channel configuration
- Added address validation with scheme and allowlist checks in
`GrpcOperationRunner`
- Plumbed execution parameters through all public methods in
`GrpcKernelExtensions`
- Updated and added unit tests
### Type of change
- [x] Bug fix (non-breaking change which fixes an issue)
---------
Co-authored-by: Copilot <[email protected]>
## Problem
NuGet audit reports NU1903 for `Microsoft.Kiota.Abstractions` < 1.22.0
([GHSA-7j59-v9qr-6fq9](https://github.com/advisories/GHSA-7j59-v9qr-6fq9))
— the Kiota `RedirectHandler` leaks `Cookie` and `Proxy-Authorization`
headers on cross-host redirects.
The vulnerability is pulled in transitively via `Microsoft.Graph` →
`Microsoft.Graph.Core` 3.2.5 → `Microsoft.Kiota.Abstractions` 1.17.1.
## Fix
- **`Microsoft.Graph`**: 5.94.0 → 5.105.0
- **`Microsoft.Graph.Core`**: added at 3.2.6 (requires
`Kiota.Abstractions` ≥ 1.22.1)
- **`Microsoft.Kiota.Abstractions`**: added at 1.22.2
- **`Microsoft.IdentityModel.JsonWebTokens`**: 8.15.0 → 8.16.0 (required
by Graph.Core 3.2.6)
- **`System.IdentityModel.Tokens.Jwt`**: 8.15.0 → 8.16.0 (required by
Graph.Core 3.2.6)
- Added direct `Microsoft.Graph.Core` `PackageReference` in
`Plugins.MsGraph.csproj` to pin the transitive version
## Verification
All three affected projects report no vulnerable packages after the
change:
- `Plugins.MsGraph`
- `Concepts`
- `Plugins.UnitTests`
---------
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
### Motivation and Context
`MongoDB.Driver 3.5.2` transitively introduces `Snappier 1.0.0`, which
carries a high-severity vulnerability (GHSA-pggp-6c3x-2xmx): infinite
loop during SnappyStream decompression of malformed framed input. All
Snappier versions ≤ 1.3.0 are affected; 1.3.1 is the first patched
release. This was blocking the merge queue via NU1903.
### Description
- **`dotnet/Directory.Packages.props`** — Add `PackageVersion` entry
pinning `Snappier` to `1.3.1`.
- **`dotnet/src/VectorData/MongoDB/MongoDB.csproj`** — Add explicit
`PackageReference` for `Snappier` (versionless, resolved via CPM) so
NuGet treats it as a direct dependency at 1.3.1, overriding the
transitive 1.0.0 from `MongoDB.Driver`.
- **`dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj`** — Same
override for the CosmosMongoDB connector.
In NuGet's resolution algorithm, a direct reference at depth 1 wins over
a transitive reference at depth 2, so this cleanly forces 1.3.1 without
changing the `MongoDB.Driver` pin itself.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
Please investigate a solution to snappier vulnerability fix (update
version) and propose a PR with the bump, ideally following the first
immediate a non breaking version bump
<analysis>
**Chronological Review:**
1. User asked to analyze PR #13431 (Gemini multimodal tool results in
microsoft/semantic-kernel) for gaps
2. Initial analysis identified ~11 gaps with broad scope including
OpenAI Assistants, AzureAI, Responses API, MistralAI
3. User invoked ouroboros skill, asked to reassess scoping to Google
package only
4. Reassessment: Google connector bypasses FunctionCallsProcessor; only
validated regression is OpenAI Responses API
5. User invoked ouroboros to seed the observation; created seed file
`pr-13431-followup.seed.yaml`
6. User asked to execute seed + identify pipeline error
7. Implemented 5 file changes; identified pipeline error CS8602 in
GeminiRequestTests.cs:809
8. All builds/tests passed; user asked about string→object impact in
plan mode
9. Investigation revealed `FunctionCallsProcessor` is `internal sealed`,
source-distributed, so blast radius small
10. User confirmed all implemented; ran CI-parity dotnet format via
WSL2+Docker (all pass)
11. User asked to commit and push - committed `de08bce99` and pushed to
Cozmopolit fork
12. User asked to check PR comments - found 2 Copilot bot review
comments
13. User said: add OpenAI test (item 1), reply out-of-scope (item 2)
14. Added OpenAI ChatCompletion test, committed `e9f27d21a`, pushed,
replied to both bot comments
15. User asked PR number (13431)
16. User invoked /auto pr_task - PR was green, no action needed
17. User said merge queue failed, asked to investigate
18. Investigation found: NU1903 Snappier 1.0.0 vulnerability blocking
merge queue; not caused by our PR
19. **Most recent: User asked "Do we have a fix in main for this
already?"**
20. **Investigation confirmed: NO fix in main** - origin/main HEAD
`1a5065e5c` unchanged, `MongoDB.Driver 3.5.2` still pinned, no Snappier
override, no PRs/issues for Snappier or NU1903 in the repo recently
21. **Offered to open a small fix PR pinning Snappier to a patched
version**
**Intent Mapping:**
- User wants PR #13431 fully landed
- User wants to understand whether merge queue failure is in scope
- User now considering whether to fix the Snappier vulnerability
separately
**Technical Inventory:**
- .NET 10.0, semantic-kernel repo
- WSL2 + Docker (mcr.microsoft.com/dotnet/sdk:10.0) for CI parity
- gh CLI for PR/CI operations
- Git remotes: origin=microsoft, roger=rogerbarreto fork,
cozmopolit=Cozmopolit fork (added)
- Branch: `fix/multimodal-tool-results`
- PR head fork: Cozmopolit, maintainerCanModify=true
**Code Archaeology:**
Files changed in commits `de08bce99` + `e9f27d21a`:
- `dotnet/src/Agents/OpenAI/Internal/ResponseThreadActions.cs` — added
GetFunctionResultAsString helper
-
`dotnet/src/Agents/UnitTests/OpenAI/Internal/ResponseThreadActionsTests.cs`
— new (3 tests)
-
`dotnet/src/Connectors/Connectors.Google/Core/Gemini/Models/GeminiRequest.cs`
— extracted s_imageFunctionResponseEnvelope
-
`dotnet/src/Connectors/Connectors.Google.UnitTests/Core/Gemini/GeminiRequestTests.cs`
— CS8602 fix
-
`dotnet/src/InternalUtilities/connectors/AI/FunctionCalling/FunctionCallsProcessor.cs`
— XML-doc tightening
-
`dotnet/src/Connectors/Connectors.OpenAI.UnitTests/Services/OpenAIChatCompletionServiceTests.cs`
— added
ItSendsImageContentNotSupportedErrorWhenToolResultIsImageContentAsync
Identified vulnerable package: `MongoDB.Driver 3.5.2` in
`dotnet/Directory.Packages.props:173` brings in transitive `Snappier
1.0.0`
**Progress Assessment:**
- ✅ All planned implementation completed
- ✅ Both bot review comments replied to
- ✅ All 7 todos done
- ⚠️ PR cannot merge due to environmental Snappier vulnerability (not
our PR's fault)
- 🔲 User considering whether to open a separate Snappier fix PR
**Context Validation:**
- PR state: OPEN, MERGEABLE, CLEAN, APPROVED (markwallace-microsoft)
- HEAD SHA: `e9f27d21a85a8b97ee5f29619b23b82a03e313ff`
- All required CI checks pass on PR head
- Merge queue attempt failed at 2026-05-07T10:01:31, removed by
github-merge-queue[bot] at 10:08:05
- Failed merge_group run: 25489152862
**Recent Commands Analysis:**
Most recent two tool batches:
1. `git fetch origin main; git log origin/main
--since="2026-05-06T15:00:00Z" --oneline` → only `1a5065e5c`
(yesterday's commit)
2. `git show origin/main:dotnet/Directory.Packages.props | grep
Snappier|MongoDB.Driver` → only `MongoDB.Driver 3.5.2`, no Snappier
override
3. `gh search prs/issues --state all "Snappier"` → command failed
(invalid `all` state)
4. `gh api search/issues?q=Snappier+repo:microsoft/semantic-kernel` →
empty results
5. `gh api search/issues?q=NU1903+repo:microsoft/semantic-kernel` → 3
historical results from 2024, all unrelated
Final response: confirmed NO fix in main, offered to open a small fix PR
pinning Snappier.
</analysis>
<summary>
1. Conversation Overview:
- Primary Objectives:
- Analyze SK PR #13431 (G...
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
Created from Copilot CLI via the copilot delegate command.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: rogerbarreto <[email protected]>
### Motivation and Context
Fix path validation order in DocumentPlugin to canonicalize paths before
validating against AllowedDirectories. Also removes redundant path
transformation from LocalFileSystemConnector.
### Description
- Canonicalize file paths (expand environment variables and resolve to
absolute form) **before** validating against AllowedDirectories in both
`ReadTextAsync` and `AppendTextAsync`
- Remove environment variable expansion from `LocalFileSystemConnector`
the connector should operate on the path it receives, not transform it
- Add regression tests
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass
- [x] New tests added
---------
Co-authored-by: Copilot <[email protected]>
### Description
Add deny-by-default `AllowedUploadDirectories` to `CloudDrivePlugin`.
- Added `AllowedUploadDirectories` property (defaults to empty =
deny-all)
- `UploadFileAsync` now validates the local file path against the
allowlist before uploading
- Paths are canonicalized with environment variable expansion, UNC
rejection, and directory traversal protection
- Added unit tests for the new behavior
---------
Co-authored-by: Copilot <[email protected]>
Fixes#13681
## Problem
When a `KernelFunction` returns a value whose runtime type is not
registered in `AbstractionsJsonContext` (e.g.
`Microsoft.Extensions.AI.TextContent` returned by an MCP tool via
`.AsKernelFunction()`), the function result logging in
AOT/source-generation mode throws `NotSupportedException` during JSON
serialization. The exception is caught but produces an unhelpful log
entry:
```
Function SomePlugin-SomeTool result: Failed to log function result value
System.NotSupportedException: JsonTypeInfo metadata for type 'Microsoft.Extensions.AI.TextContent' was not provided by TypeInfoResolver of type 'Microsoft.SemanticKernel.AbstractionsJsonContext'.
```
## Solution
Add a `ToString()` fallback in the `NotSupportedException` catch block
of `LogFunctionResultValueInternal`. When JSON serialization fails
because the runtime type is absent from the source-generated context,
the logger now calls `resultValue?.Value?.ToString()` to produce useful
output instead of the generic error message.
## Testing
- Added `ItShouldFallBackToToStringWhenJsonSerializationIsNotSupported`
unit test that uses a restricted source-generated
`JsonSerializerContext` (containing only `object` and
`IDictionary<string, object?>`) to simulate the AOT scenario, verifying
that `ToString()` output appears in the log instead of the failure
message.
- All existing `ItShouldLogFunctionResultOfAnyType` test cases are
unchanged.
---------
Co-authored-by: octo-patch <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Closes#12307. Provides .NET parity with the Python fix in #11852 by
adding an escape-hatch `ExtraBody` property to
`OpenAIPromptExecutionSettings`. This allows callers to inject
vendor-specific or preview parameters into the request body without
waiting for SDK modeling. Use cases from the issue include:
- Qwen3 open-source models requiring `enable_thinking: false` for
non-streaming calls
- ChatGLM thinking-mode flags
- Any OpenAI-compatible endpoint exposing fields not modeled by the SDK
### Description
Adds `IDictionary<string, object?>? ExtraBody` to
`OpenAIPromptExecutionSettings` (inherited automatically by
`AzureOpenAIPromptExecutionSettings`), marked
`[Experimental("SKEXP0010")]`.
#### Hybrid key syntax (diverges intentionally from Python to leverage
the OpenAI .NET SDK's `JsonPatch`)
- A plain key is treated as a literal top-level field name. Keys with
dots, brackets, or other special characters are bracket-quoted
automatically and remain literal.
- `ExtraBody["enable_thinking"] = false` → `{ "enable_thinking": false
}`
- `ExtraBody["weird.key"] = "x"` → `{ "weird.key": "x" }`
- A key starting with `$.` is interpreted as a JSONPath expression and
applied as a deep patch onto the request body.
- `ExtraBody["$.thinking.enabled"] = false` → `{ "thinking": {
"enabled": false } }`
- `ExtraBody["$.tools[0].function.name"] = "x"` → patches into array
elements
- Nested dictionaries are also supported via plain keys:
`ExtraBody["thinking"] = new Dictionary<string,object?> { ["enabled"] =
false }`.
#### Behavior
- **Last-write-wins on collisions** with strongly-typed properties (e.g.
`Temperature`). Documented.
- **`null` values emit JSON `null`**. Field removal is not supported.
- **No input validation, no telemetry emission** of `ExtraBody` contents
(Python parity).
- **Shallow `Clone()`**, `ReadOnlyDictionary` on `Freeze()`.
#### Wiring
- Classic path: `ClientCore.ChatCompletion.cs` and
`AzureClientCore.ChatCompletion.cs` apply patches at the end of
`CreateChatCompletionOptions`.
- `IChatClient` path: new `protected virtual
PrepareChatOptionsForRequest(ChatOptions)` hook on
`PromptExecutionSettings` (mirrors the existing
`PrepareChatHistoryForRequest` pattern). The OpenAI override sets
`ChatOptions.RawRepresentationFactory` and removes the redundant
`AdditionalProperties["extra_body"]` entry produced by `ToChatOptions`'s
round-trip.
#### Files changed
- `SemanticKernel.Abstractions/AI/PromptExecutionSettings.cs` — new hook
+ internal bridge
- `SemanticKernel.Abstractions/AI/PromptExecutionSettingsExtensions.cs`
— invokes the hook on the original derived instance
- `Connectors.OpenAI/Settings/OpenAIPromptExecutionSettings.cs` —
property, Freeze, Clone, `PrepareChatOptionsForRequest` override,
`ApplyExtraBody`/`ApplyExtraBodyEntry` helpers
- `Connectors.OpenAI/Core/ClientCore.ChatCompletion.cs` — apply in
classic path
- `Connectors.AzureOpenAI/Core/AzureClientCore.ChatCompletion.cs` —
apply in Azure classic path
- `samples/Concepts/ChatCompletion/OpenAI_ChatCompletionExtraBody.cs` —
concept sample (flat field + deep patch)
#### Tests (14 new, all passing)
`Connectors.OpenAI.UnitTests` (11): non-streaming flat key, streaming
flat key, collision (last-write-wins), nested dict, `$.` deep patch,
literal dotted key, `null` value, `FromExecutionSettings` round-trip,
Clone shallow, Freeze read-only, `ToChatOptions`
`RawRepresentationFactory` + `AdditionalProperties` cleanup.
`Connectors.AzureOpenAI.UnitTests` (3): flat key, collision, `$.` deep
patch.
#### Regression
- `Connectors.OpenAI.UnitTests`: 485 passed
- `Connectors.AzureOpenAI.UnitTests`: 493 passed
- `SemanticKernel.UnitTests`: 1606 passed (verifies the new hook in
Abstractions has no side effects)
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
Co-authored-by: westey <[email protected]>
## Motivation and Context
Now that **Microsoft Agent Framework (MAF)** is the successor SDK to
Semantic Kernel, the top-level and per-language READMEs should direct
community members — especially newcomers landing here from search,
GitHub, PyPI, or NuGet — to MAF for new work, and clearly state SK's
ongoing maintenance posture.
## Description
Adds a prominent GitHub `> [!IMPORTANT]` callout, placed directly under
the existing title/badges block, to:
- `README.md` (top-level)
- `python/README.md`
- `dotnet/README.md`
Each callout:
- Names MAF as Semantic Kernel's successor SDK and links to
https://github.com/microsoft/agent-framework.
- Describes MAF as "an open, multi-language framework for building
production-grade AI agents and multi-agent workflows in .NET and
Python".
- Asks readers to use MAF for the latest abstractions to build agents,
workflows, and multi-agent orchestrations.
- States that Semantic Kernel will continue to receive minimal security
and bug fixes only.
No other README content is modified; SK identity, badges, install steps,
and quickstart samples are preserved.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings — docs-only
change.
- [x] I didn't break anyone — additive callout only.
- [x] All relevant CONTRIBUTING.md sections were followed.
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Improved the URL validation logic in
`RestApiOperationRunner.ValidateUrl()` to ensure stricter matching when
checking request URLs against configured `AllowedBaseUrls`. The previous
implementation could match unintended URLs in certain edge cases
involving path-prefixed base URLs.
### Description
Strengthened the base URL comparison to enforce proper path-boundary
matching, preventing URLs outside the intended allowed scope from
passing validation.
### Changes
- **`RestApiOperationRunner.cs`**: Tightened the base URL matching logic
in `ValidateUrl` to enforce path-boundary alignment.
- **`RestApiOperationRunnerTests.cs`**: Added two new tests to verify
the stricter validation behavior and confirm legitimate sub-paths remain
allowed.
### Risk
Low — the fix tightens existing validation without changing the public
API surface. All URL validation tests pass.
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
In the SQL Server MEVD provider, table/schema/column names embedded
inside SQL string literals (`N'...'`) were not escaping single quotes.
This could produce broken SQL when names contain single quotes.
For example, a table named `it's` would generate:
```sql
IF OBJECT_ID(N'[dbo].[it's]', N'U') IS NULL
```
which is invalid SQL. The fix produces:
```sql
IF OBJECT_ID(N'[dbo].[it''s]', N'U') IS NULL
```
### Changes
Added `AppendTableNameInsideLiteral` and `AppendIdentifierInsideLiteral`
helper methods that escape single quotes by doubling them, and updated
the 5 call sites where identifiers appear inside string literals:
- `OBJECT_ID` in `CreateTable` (ifNotExists check)
- `OBJECT_ID` in full-text index PK lookup
- Dynamic SQL table name, column names, and catalog name for full-text
indexes
### Tests
Added unit tests for `AppendTableNameInsideLiteral`,
`AppendIdentifierInsideLiteral`, and a
`CreateTable_WithSingleQuoteInName` integration test. All 283 tests pass
(unit + conformance).
Co-authored-by: Copilot <[email protected]>
Updates the SQL Server vector store connector to support the latest
Azure SQL VECTOR_SEARCH() features, matching what was done in EF Core
(dotnet/efcore#38075).
## Changes
### VECTOR_SEARCH syntax update
- Replace deprecated `TOP_N` parameter with `SELECT TOP(N) WITH
APPROXIMATE`
- Enable iterative WHERE predicates are now applied during the vector
search process, not after retrievalfiltering
- Support `skip` via subquery wrapping (`TOP` and `OFFSET/FETCH` cannot
coexist in the same SELECT)
### Hybrid search
- Same VECTOR_SEARCH syntax changes in the semantic search CTE
- Filter support added in the vector search CTE (iterative filtering)
### Azure SQL runtime detection
- DiskAnn vector indexes and VECTOR_SEARCH require Azure SQL Database or
SQL database in Microsoft Fabric
- Added runtime check via `SERVERPROPERTY('EngineEdition')` at table
creation and query time
- Throws informative `NotSupportedException` when used against on-prem
SQL Server
- Result is cached per collection instance
### Test infrastructure
- Deleted `SqlServerDiskAnnVectorSearchTests.cs` (read-only table
workaround no longer tables with latest vector indexes now support full
DML)needed
- Created `SqlServerConnectionStringRequiredAttribute` to gate DiskAnn
tests on Azure SQL connection string availability
- Rewrote DiskAnn conformance test to handle 100-row minimum requirement
for vector index creation
- Updated all command builder unit tests for new SQL syntax
### Kept
- `PREVIEW_FEATURES` command in `CreateTable` (needed for future on-prem
SQL Server support)
---------
Co-authored-by: Copilot <[email protected]>
We are currently using Npgsql 8.0 because that's the last version that's
still compatible with .NET Standard 2.0/netfx; but it seems wrong to
force an older version of Npgsql on modern .NET users just because netfx
users require it
So for the versions of the PgVector MEVD provider targeting
net8.0/net10.0, use the latest Npgsql 10.0; netstandard2.0/net462 still
use Npgsql 8.0. It's not ideal to use different versions of Npgsql
across different TFM targets of the same library, but it seems like the
lesser of the possible evils here.
This incidentally also takes care of the ReloadTypesAsync problem in
#13706.
---------
Co-authored-by: Copilot <[email protected]>
## Changes
* **Extract `ConfigureVectorPropertyEmbedding()`**: Deduplicated
embedding resolution logic that was repeated across
`ProcessTypeProperties` and `ProcessRecordDefinition`.
* **Replace `IRecordCreator` with `Func<object>`**: Removed
`IRecordCreator` interface and two implementing classes
(`ActivatorBasedRecordCreator`, `DynamicRecordCreator`), replacing them
with simple lambdas.
* **Rename `TemporaryStorageName` → `SerializedKeyName`**: Moved from
`PropertyModel` base to `KeyPropertyModel` where it belongs (only used
by CosmosNoSql for key property JSON serializer name remapping).
* **Delegate-based property accessors**: Replaced virtual
`GetValueAsObject`/`SetValueAsObject` overrides with delegate fields
(`_getter`/`_setter`), configured via
`ConfigurePocoAccessors()`/`ConfigureDynamicAccessors()`. Converted
null-coalescing throws to `Debug.Assert`.
* **Improved xmldoc** on `VectorPropertyModel.EmbeddingType` explaining
the `[AllowNull]` invariant.
* **Introduce read-only interfaces** (`IPropertyModel`,
`IKeyPropertyModel`, `IDataPropertyModel`, `IVectorPropertyModel`):
`CollectionModel` now exposes `IReadOnlyList<IVectorPropertyModel>`
etc., giving providers an immutable view post-build. All provider code
updated to consume interface types.
Note that the last is a non-trivial breaking change for providers (not
users), which I think is fine (note that the provider-facing APIs are
flagged as [Experimental]).
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
`VectorStoreKeyAttribute.IsAutoGenerated` was typed as `bool?`, which C#
does not permit as a compile-time attribute argument. This made the
following valid-looking code fail to compile:
```csharp
[VectorStoreKey(StorageName = "name", IsAutoGenerated = true)]
public Guid Key { get; set; }
```
### Description
- **`VectorStoreKeyAttribute.IsAutoGenerated`**: Changed from `public
bool?` to a `public bool` property. Its setter stores the value into a
new `internal bool? IsAutoGeneratedNullable` backing property. The
getter returns `IsAutoGeneratedNullable.GetValueOrDefault()` rather than
throwing; an inline comment explains this is a workaround for the C#
compiler restriction that prevents `Nullable<bool>` from being used as a
compile-time attribute argument. The `bool?` backing preserves the "not
explicitly set" vs. "explicitly set" distinction the framework relies
on.
- **`CollectionModelBuilder`**: Updated to read
`keyAttribute.IsAutoGeneratedNullable` (the `bool?` backing) instead of
the former `bool?` public property, keeping the existing `??
SupportsKeyAutoGeneration(...)` fallback behaviour intact.
- **`KernelFunctionFromMethod`**: Fixed a pre-existing operator
precedence bug in a pattern match expression (`value is not JsonElement
or JsonDocument or JsonNode`) that caused CS9336 redundant-pattern
errors on the .NET 10 compiler. Added parentheses to correctly express
the intended negation of all three types: `value is not (JsonElement or
JsonDocument or JsonNode)`.
- **`CollectionModelBuilderTests`**: Added four new unit tests covering
all `IsAutoGenerated` attribute scenarios: explicitly set to `true`,
explicitly set to `false`, omitted on a `Guid` key (fallback to
`SupportsKeyAutoGeneration` returns `true`), and omitted on an `int` key
(fallback returns `false`).
```csharp
// Now compiles and works correctly
[VectorStoreKey(IsAutoGenerated = true)]
public Guid Key { get; set; }
[VectorStoreKey(IsAutoGenerated = false)]
public Guid Key { get; set; }
[VectorStoreKey] // IsAutoGeneratedNullable remains null, fallback to SupportsKeyAutoGeneration()
public Guid Key { get; set; }
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>[MEVD] Can't set IsAutoGenerated property of
VectorStoreKeyAttribute at compile time</issue_title>
> <issue_description>The following code fails to compile:
>
> ```csharp
> [VectorStoreKey(StorageName = "name", IsAutoGenerated = true)]
> public Guid Key { get; set; }
> ```
>
> Because the `IsAutoGenerated` is `bool?`:
>
>
https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/RecordAttributes/VectorStoreKeyAttribute.cs#L30
>
> Which in C# maps to `System.Nullable<bool>` (a struct) and can't be
set at compile time.
>
> Could we make it just a `bool` like what it's mapped to at the end?
>
>
https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/ProviderServices/KeyPropertyModel.cs#L18
>
> Context:
https://github.com/dotnet/extensions/pull/7423/changes#r2974567816
>
> cc @roji </issue_description>
>
> <agent_instructions>1. Make
[this](https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/RecordAttributes/VectorStoreKeyAttribute.cs#L30)
property be a `bool` rather than `bool?` property.
> 2. Implement the getter and setter for it.
> 3. The setter should set an internal `bool?` property that should be
used instead of the public property everywhere in the repo.
[Example]https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/ProviderServices/CollectionModelBuilder.cs#L162)
> 3. Proof of concept code that I've used to verify it's going to get us
what we need:
>
> ```csharp
> using System.Reflection;
>
> namespace ConsoleApp15
> {
> public class Program
> {
> static void Main()
> {
> TestAttribute setToTrue =
typeof(Program).GetMethod(nameof(SetToTrue))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test(IsAutoGenerated =
true)]: {setToTrue.IsAutoGenerated_Core}");
>
> TestAttribute setToFalse =
typeof(Program).GetMethod(nameof(SetToFalse))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test(IsAutoGenerated =
false)]: {setToFalse.IsAutoGenerated_Core}");
>
> TestAttribute notSet =
typeof(Program).GetMethod(nameof(NotSet))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test]:
{notSet.IsAutoGenerated_Core}");
> }
>
> [Test(IsAutoGenerated = true)]
> public static void SetToTrue() { }
>
> [Test(IsAutoGenerated = false)]
> public static void SetToFalse() { }
>
> [Test]
> public static void NotSet() { }
> }
>
> [AttributeUsage(AttributeTargets.All)]
> public class TestAttribute : Attribute
> {
> public bool IsAutoGenerated
> {
> get => throw new InvalidOperationException(); // provided to satisfy
compiler requirements
> set => IsAutoGenerated_Core = value;
> }
>
> internal bool? IsAutoGenerated_Core { get; set; }
> }
> }
> ```</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- Fixesmicrosoft/semantic-kernel#13697
<!-- START COPILOT CODING AGENT TIPS -->
---
💬 Send tasks to Copilot coding agent from
[Slack](https://gh.io/cca-slack-docs) and
[Teams](https://gh.io/cca-teams-docs) to turn conversations into code.
Copilot posts an update in your thread when it's finished.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: adamsitnik <[email protected]>
Removes all legacy filtering logic from MEVD, leaving only (obsoleted)
FilterClause and subclasses, which are still needed by ITextSearch (see
conversation in
https://github.com/microsoft/semantic-kernel/pull/13384#discussion_r2867207653).
As suggested by @westey-m let's do an SK release before merging this
(see above).
Closes#10456
/cc @alzarei
### Motivation and Context
**Why is this change required?**
PR #10489 added support for configuring embedding [dimensions]
(outputDimensionality) for the Google AI connector, but the equivalent
Vertex AI connector was not updated. This means specifying [Dimensions]
in [EmbeddingGenerationOptions] or via the constructor has no effect
when using Vertex AI — the API always returns the model's default
dimensionality.
**What problem does it solve?**
When using [VertexAIEmbeddingGenerator] or
[VertexAITextEmbeddingGenerationService]with a [dimensions] value (e.g.
128), the output embedding length is the model default (e.g. 3072)
instead of the requested size.
**What scenario does it contribute to?**
Users who need to control embedding dimensionality for storage
optimization, performance, or compatibility with downstream systems when
using the Vertex AI endpoint.
Fixes: #12988
### Description
This PR adds outputDimensionality support to the Vertex AI embedding
connector, mirroring the existing Google AI implementation from PR
#10489.
The Google connector has two parallel embedding paths — Google AI (uses
API key, calls generativelanguage.googleapis.com) and Vertex AI (uses
bearer token, calls [{location}-aiplatform.googleapis.com]). PR #10489
only wired up dimensions for the Google AI path. This PR applies the
same pattern to every layer of the Vertex AI path.
The key structural difference between the two APIs is where
outputDimensionality goes in the request JSON:
Google AI puts it per-content-item: `{ "requests": [{ "content": {...},
"outputDimensionality": 128 }] }`
Vertex AI puts it in the shared parameters block: `{ "instances": [...],
"parameters": { "autoTruncate": false, "outputDimensionality": 128 } }`
The implementation follows this difference. In
[VertexAIEmbeddingRequest], outputDimensionality is added to the
existing [RequestParameters] class (alongside autoTruncate), rather than
on each instance item.
Dimensions flow through the same chain as Google AI:
1. Extension methods accept int? dimensions = null and pass it to the
generator/service constructor
2. [VertexAIEmbeddingGenerator] passes it to
[VertexAITextEmbeddingGenerationService]
3. The service passes it to [VertexAIEmbeddingClient], which stores it
as a default
4. At request time, the client resolves the final value as
[options?.Dimensions ?? this._dimensions] — runtime
[EmbeddingGenerationOptions] take priority over the constructor default
5. [VertexAIEmbeddingRequest.FromData()] sets it on the parameters
block, and [JsonIgnore(WhenWritingNull)] ensures it's omitted when not
specified
All new parameters default to null, preserving full backward
compatibility.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: abbottdev <[email protected]>
Co-authored-by: westey <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bumps core AI SDK dependencies to their latest versions to pick up new
features and fixes.
### Description
Updates the following packages in `Directory.Packages.props`:
- **OpenAI** 2.8.0 → 2.9.1
- **Azure.AI.OpenAI** 2.8.0-beta.1 → 2.9.0-beta.1
- **Azure.AI.Projects** 1.1.0 → 2.0.0-beta.2
- **Azure.Identity** 1.17.1 → 1.19.0 (cascading dependency from
Azure.AI.Projects 2.0.0-beta.2)
- **Microsoft.Extensions.AI\*** 10.3.0 → 10.4.0
- **System.Text.Json, System.Numerics.Tensors,
Microsoft.Extensions.Logging.Abstractions,
Microsoft.Bcl.AsyncInterfaces, System.Threading.Channels** → 10.0.4
Addresses the following breaking changes introduced by OpenAI 2.9.1:
- `CreateInputImagePart` BinaryData overload removed (replaced with data
URI approach)
- Realtime API type renames (`ConversationTool` → `RealtimeTool`,
`ConversationSessionOptions` → `RealtimeConversationSessionOptions`,
etc.)
- `ResponsesClient` constructor no longer accepts a model parameter;
model is now specified on `CreateResponseOptions.Model`
- `ResponseResult.Instructions` is now read-only
Code changes to adapt:
- Added `ModelId` property to `OpenAIResponseAgent` and propagated it
through `ResponseCreationOptionsFactory`
- Updated unit tests (`BaseOpenAIResponseClientTest`,
`OpenAIResponseAgentExtensionsTests`, `OpenAIResponseExtensionsTests`)
- Updated integration tests (`OpenAIResponseAgentTests`,
`OpenAIResponseAgentFixture`)
- Updated `BaseResponsesAgentTest` and `GettingStartedWithAgents`
samples
- Updated `AgentFrameworkMigration` samples (`GetResponsesClient`,
`AsIChatClient`, `CreateAIAgent`, modelId propagation)
- Rewrote `OpenAIRealtime` demo for the restructured Realtime API event
model
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
<!-- START COPILOT CODING AGENT TIPS -->
---
📍 Connect Copilot coding agent with [Jira](https://gh.io/cca-jira-docs),
[Azure Boards](https://gh.io/cca-azure-boards-docs) or
[Linear](https://gh.io/cca-linear-docs) to delegate work to Copilot in
one click without leaving your project management tool.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: stephentoub <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
### Motivation and Context
Improve control and security settings for WebFileDownloadPlugin
- Change AllowedDomains and AllowedFolders defaults from null
(allow-all) to empty (deny-all)
- Change DisableFileOverwrite default to true
- Set MaximumDownloadSize default to 10 MB
- Add path canonicalization via Path.GetFullPath() to prevent directory
traversal
- Switch folder matching from exact to prefix-based with separator
handling
- Fix fileMode variable not being used in FileStream constructor
- Add XML doc security remarks to all three plugins
- Update tests for new defaults
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Improve control and security settings for DocumentPlugin, addressing the
same class of vulnerability (arbitrary file read/write via AI agent
indirect prompt injection) that was patched in SessionsPythonPlugin.
DocumentPlugin previously had **zero security controls** at the plugin
level. Both `ReadTextAsync` and `AppendTextAsync` accepted arbitrary
file paths, delegating directly to `LocalFileSystemConnector` which
calls `File.Open(Environment.ExpandEnvironmentVariables(filePath))` with
no validation.
### Description
- Add `AllowedDirectories` property with deny-by-default (empty HashSet,
no directories allowed)
- Add `IsFilePathAllowed` private method with:
- `Path.GetFullPath()` canonicalization to prevent `../` directory
traversal
- UNC path rejection
- Fully qualified path enforcement
- Prefix matching with directory separator for subdirectory support
- Gate both `ReadTextAsync` and `AppendTextAsync` with path validation
- Add security XML doc remarks documenting secure-by-default behavior
### Tests
- Updated 4 existing tests to configure `AllowedDirectories`
- Added 6 new security tests:
- Deny-by-default (empty AllowedDirectories blocks all paths)
- Path traversal prevention (`../../` canonicalized and rejected)
- UNC path rejection
- Disallowed folder rejection
- Subdirectory prefix matching (subdirectories of allowed folders
succeed)
- Relative path rejection
All 10 DocumentPlugin tests pass.
### Breaking Change
**Yes** — `DocumentPlugin` now denies all file operations by default.
Users must explicitly configure `AllowedDirectories` before any
read/write operations will succeed:
```csharp
var plugin = new DocumentPlugin(documentConnector, fileSystemConnector)
{
AllowedDirectories = ["/path/to/allowed/folder"]
};
```
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
With Qdrant server 1.17 Embeddings stopped being returned.
Fixes#13587
### Description
The `VectorOutput.Data` property became deprecated in `Qdrant.Client`
1.17. The alternative is to use `VectorOutput.Dense.Data` instead or
`VectorOutput.GetDenseVector()` (from `Qdrant.Client` 1.16.0 or later).
Since the `.Dense` already exyists in `Qdrant.Client` 1.15.1 that is
used by the current connector, I used these. The `.GetDenseVector()`
also returns nullable `DenseVector`, so I was unsure how to handle in
context of Semantic Kernel, as as far as I see it Semantic Kernel only
supports Dense Vectors (the other two are `.Sparse` for sparse vectors
and `.MultiDense`).
So this may need special handling in future to throw an exception, when
the server returns one of the other two vector types and not dense
vectors.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
I'm currently unable (or rather I don't know how) to run the local
integration/unit tests against the qdrant database. But I validated the
change in my personal project mentioned in #13587 by directly
referencing the connector in my project and it correctly returned the
vectors on the sample code where it failed previously
```csharp
VectorStoreCollection<ulong, VectorModels.Project> projects = await GetProjectsCollection();
VectorModels.Project? project = await projects.GetAsync((ulong)projectId, new()
{
IncludeVectors = true
});
// project at this poind hat 0 sized Embedding property
if (project is null)
{
return;
}
await projects.UpsertAsync(project);
```
---------
Co-authored-by: westey <[email protected]>
### Motivation and Context
- Update default image model from dall-e-2 to gpt-image-1 in ClientCore
and OpenAITextToImageService
- Handle base64 responses in GenerateImageAsync (gpt-image-1 returns
base64 only, no URLs)
- Add Medium, Low, and Auto quality options to GetGeneratedImageQuality
- Update AzureOpenAI integration tests to use api-version
2025-04-01-preview
- Remove URL-specific assertions since gpt-image-1 returns base64 only
- Update OpenAI integration tests to reference gpt-image-1
- Update testsettings.json defaults from Dalle3/dall-e-2 to gpt-image-1
- Update OpenAITextToImageExecutionSettings XML docs for gpt-image-1
Co-authored-by: Copilot <[email protected]>
## Summary
Update NuGet package dependencies to address
[CVE-2026-26127](https://github.com/advisories/GHSA-73j8-2gch-69rq), a
high severity denial of service vulnerability caused by an out of bounds
read during malformed Base64Url decoding.
This mirrors the fix applied in Agent Framework [PR
#4647](https://github.com/microsoft/agent-framework/pull/4647).
### Package Updates (Directory.Packages.props)
| Package | Old Version | New Version |
|---------|-------------|-------------|
| Microsoft.Bcl.Memory | 10.0.2 | 10.0.4 |
| Microsoft.Bcl.AsyncInterfaces | 10.0.3 | 10.0.4 |
| System.Linq.AsyncEnumerable | 10.0.2 | 10.0.4 |
### Transitive Vulnerability Fix
Added direct `PackageReference` to `Microsoft.Bcl.Memory` in 3 projects
that transitively pulled in the vulnerable 9.0.4 version via
`Microsoft.ML.Tokenizers.Data.Cl100kBase`. The direct reference forces
NuGet to resolve the centrally managed 10.0.4 version instead.
Affected projects:
- `SemanticKernel.UnitTests`
- `IntegrationTests`
- `Concepts` (sample)
### Validation
- `dotnet restore` completes with zero vulnerability warnings
- `dotnet build` succeeds with zero errors
### Motivation and Context
When loading OpenAPI specifications, the SDK uses the `servers[].url`
field to construct HTTP request targets. This PR adds an opt-in
mechanism for consumers to validate and restrict which URLs the OpenAPI
plugin is allowed to call at runtime.
### Description
Introduces `RestApiOperationServerUrlValidationOptions`, a new options
class that can be configured via
`OpenApiFunctionExecutionParameters.ServerUrlValidationOptions` to
control outbound request targets:
- **AllowedSchemes** (`IReadOnlyList\<string\>?`) — restricts which URI
schemes are permitted. When null/empty, defaults to `https` only.
- **AllowedBaseUrls** (`IReadOnlyList\<Uri\>?`) — restricts requests to
URLs matching one of the specified base URL prefixes. When null, no base
URL restriction is applied.
Validation is performed in `RestApiOperationRunner` before any HTTP
request is sent. When `ServerUrlValidationOptions` is not set (default),
behavior is unchanged — no validation is performed.
### Changes
- New class: `RestApiOperationServerUrlValidationOptions`
- `OpenApiFunctionExecutionParameters`: added
`ServerUrlValidationOptions` property (`[Experimental("SKEXP0040")]`)
- `RestApiOperationRunner`: added `ValidateUrl()` with scheme and base
URL checks
- `OpenApiKernelPluginFactory`: wires validation options through to the
runner
- 7 new unit tests covering scheme blocking, base URL allowlisting, and
mixed configurations
### Usage Example
```csharp
var plugin = await kernel.ImportPluginFromOpenApiAsync(
pluginName: "myApi",
filePath: specPath,
executionParameters: new OpenApiFunctionExecutionParameters
{
ServerUrlValidationOptions = new RestApiOperationServerUrlValidationOptions
{
AllowedBaseUrls = [new Uri("https://api.example.com")],
AllowedSchemes = ["https"]
}
});
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass
- [x] New unit tests added
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Alexander Zarei <[email protected]>
Co-authored-by: Alexander Zarei <[email protected]>
Co-authored-by: Chris <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Updates Microsoft.Extensions.AI packages to latest stable releases
(10.3.0) and OpenAI SDK to 2.8.0. The new versions require transitive
dependency updates and fixing breaking type renames in the OpenAI
Responses API. Additionally, the new `ChatOptions.Reasoning` property is
now mapped from `PromptExecutionSettings` and used in samples instead of
`RawRepresentationFactory`.
### Description
**Package Updates:**
- `Microsoft.Extensions.AI` and `Microsoft.Extensions.AI.Abstractions`:
10.2.0 → 10.3.0
- `Microsoft.Extensions.AI.OpenAI`: 10.0.1-preview → 10.3.0 (stable)
- `OpenAI`: 2.7.0 → 2.8.0
- `Azure.AI.OpenAI`: 2.7.0-beta.2 → 2.8.0-beta.1
- Transitive dependencies → 10.0.3:
- `System.Text.Json`
- `System.Numerics.Tensors`
- `Microsoft.Extensions.Logging.Abstractions`
- `Microsoft.Bcl.AsyncInterfaces`
- `System.Threading.Channels`
**OpenAI 2.8.0 Breaking Changes Fixed (~23 files):**
- `OpenAIResponseClient` → `ResponsesClient`
- `ResponseCreationOptions` → `CreateResponseOptions`
- `OpenAIResponse` → `ResponseResult`
- `GetOpenAIResponseClient()` → `GetResponsesClient()`
- API: Input items now passed via `CreateResponseOptions.InputItems`
instead of separate parameter
- API: `StreamingEnabled = true` required for streaming calls
- `OpenAIResponsesModelFactory` removed → using public constructors in
tests
**ChatOptions.Reasoning Mapping:**
- Added `reasoning_effort` → `ChatOptions.Reasoning.Effort` mapping in
`PromptExecutionSettingsExtensions.ToChatOptions`, supporting `low`,
`medium`, `high`, and `xhigh` (→ ExtraHigh) effort levels per OpenAI API
documentation
- Replaced `RawRepresentationFactory` with `ChatOptions.Reasoning` in
the OpenAI and AzureOpenAI Step02_ReasoningModel sample files
- Updated migration documentation in
`.github/upgrades/prompts/SemanticKernelToAgentFramework.md` to use
`TruncationMode` as the provider-specific options example (since
reasoning now has a direct `ChatOptions` equivalent)
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: stephentoub <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
Co-authored-by: Copilot <[email protected]>
copilot-swe-agent[bot]